Rizin v0.4.0 and Cutter v2.1.0 are here! 🥳

Rizin team:
We continue our focus on stability and performance while introducing new features, including:
- FLIRT signatures applied automatically during the analysis!
- New Intermediate Language — RzIL
https://github.com/rizinorg/rizin/releases/tag/v0.4.0

Cutter team:
Introducing exciting new features including auto-detection of common library functions, a YARA plugin to quickly create and test signatures, and many more...
https://github.com/rizinorg/cutter/releases/tag/v2.1.0

#reverse #rizin #cutter

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

https://github.com/h3xduck/TripleCross

#rootkit #redteam #linux #kernel #Aligner

One I/O Ring to Rule Them All: A Full Read/Write Exploit Primitive on Windows 11

https://windows-internals.com/one-i-o-ring-to-rule-them-all-a-full-read-write-exploit-primitive-on-windows-11/

https://github.com/yardenshafir/IoRingReadWritePrimitive

#expdev #windows #kernel #expolit #tips #Aligner

At the beginning of 2020, we discovered the Red Unlock technique that allows extracting Intel Atom Microcode. We were able to research the internal structure of the microcode and then x86 instruction implementation. Also, we recovered a format of microcode updates, algorithm and the encryption key used to protect the microcode

https://github.com/chip-red-pill/MicrocodeDecryptor

#tools #reverse #intel #interlnals #microcode #Aligner

IDA Pro 8.0 released!

* Golang 1.18
* iOS 16 dyld shared cache support
* ARC decompiler
* Better firmware analysis
* FLAIR pattern generator (makepat)

https://hex-rays.com/products/ida/news/8_0/

✨Happy New Year!✨

Take care of yourself and those close to you!

UserComment is a plugin to display user-added comments in disassembly and pseudocode views.

https://forum.reverse4you.org/t/usercomment-an-ida-plugin-to-show-user-added-comments/19747

#reverse #idapro #plugin

CASR – collect crash (or UndefinedBehaviorSanitizer error) reports, triage, and estimate severity. It is based on ideas from exploitable and apport.

https://github.com/ispras/casr

Kevin Mitnick R.I.P.

https://www.washingtonpost.com/obituaries/2023/07/20/kevin-mitnick-hacker-dies/

Dota 2 Under Attack: How a V8 Bug Was Exploited in the Game

https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/

#gamehack #expdev #reverse #v8 #exploit

Awesome HyperDbg: A list of awesome resources about HyperDbg.

https://github.com/HyperDbg/awesome

#reverse #tools #hyperdbg

Dissecting and Exploiting TCP/IP RCE Vulnerability “EvilESP”

https://securityintelligence.com/x-force/dissecting-exploiting-tcp-ip-rce-vulnerability-evilesp/

#expdev #windows #1day

Debugging Windows Isolated User Mode (IUM) Processes

In this blog post discussed how to debug Windows' Isolated User Mode (IUM) processes, also known as Trustlets, using the virtual TPM of Microsoft Hyper-V as our target.

https://blog.quarkslab.com/debugging-windows-isolated-user-mode-ium-processes.html

#reverse #windows #trustlets

Analysis of CVE-2023-29336 Win32k Privilege Escalation Vulnerability (with POC)

https://www.numencyber.com/cve-2023-29336-win32k-analysis/

#expdev #reverse #windows #poc

Smart Contract Security: The Ultimate Guide

This article serves as a mini course on smart contract security and provides an extensive list of the issues and vulnerabilities that tend to recur in Solidity smart contracts.

https://www.rareskills.io/post/smart-contract-security

#crypto #security

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)

https://github.com/memN0ps/bootkit-rs

#redteam #malware #bootkit #windows #rust

Living Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks. The project helps security professionals stay informed and mitigate potential threats.

https://www.loldrivers.io/

#redteam #loldrivers #windows

Finding and exploiting process killer drivers with LOL for 3000$

In this article, I will introduce some kernel driver/internals theory and explain how to use the data in LOLDrivers to find interesting drivers. Finally, I will present 2 examples of vulnerable drivers and explain how to quickly reverse them and create a PoC to exploit them.

https://alice.climent-pommeret.red/posts/process-killer-driver/

#redteam #loldrivers #windows

WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory

https://www.x86matthew.com/view_post?id=windows_no_exec

#windows #ctf #malware #tips

Process Injection without R/W target memory and without creating a remote thread

https://github.com/Maff1t/InjectNtdllPOC

#windows #redteam #ctf #malware #tips