https://xitter.cf/t.co/M2In2URzUG Runs the Phoenix 2600 hacker group into the ground.
Phoenix
Joined November 2008
- Tweets3K
- Following180
- Followers671
- Likes215
Joe G retweeted
We'd LOVE to see YOUR CactusCon 15 CFP entry :).
CC helped shape my career. From the day I attended my first CC back in 2013 and took @GironSec's amazing workshop that got me hooked, to the 2014 CC when I presented my first workshop, to the eventual 2 years I helped lead the conference. So memory fond memories. Make some of your own! Let's goooo! CFP it up. You. You reading this. It's time :).
The CactusCon 15 CFP is now OPEN!
cactuscon.com/cfp
Got a weird research rabbit hole, a spicy security take, a ridiculous hack, or something the cybersecurity community needs to know? Submit your technical talk and share your knowledge with our hacker community.
#cc15
Joe G retweeted
They did it again. This time it's Tencent's kernel anticheat VM.
815 of 865 virtualized functions across four kernel drivers statically devirtualized back to native code. 94.2 percent coverage, 99.3 on ACE-GAME.sys.
Same approach. Guided symbolic execution, constant promotion, constant folding. The entire math obfuscation layer comes down to sixteen identity rules that fit on one screen.
If you're unpacking malware protected by Themida or VMProtect, this is the same problem. Same VM architecture, same obfuscation patterns, same deobfuscation techniques. Doesn't matter that it's anticheat, you're learning the same skills.
Denuvo anti-tamper is next.
back.engineering/blog/31/07/…
Author: @BackEngineerLab @_xeroxz
#ReverseEngineering #MalwareAnalysis #Infosec
Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.
back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.
The before/after in the repo is genuinely shocking.
Works on pretty much any VM obfuscator, not just Themida.
Blog: back.engineering/blog/09/05/…
Devirt output: github.com/backengineering/t…
Author: @BackEngineerLab
#ReverseEngineering #InfoSec #Malware
Finally, an 0day, been forever. This time in a Broadcom utility program thingy in a router. Stack smasher via strcpy, byte length 131 bytes, with user controlled input as char *string argument. I thought they were all gone, but then who the hell is opening up router firmware?
Why use windows hooks to create a mouse jiggler (which corpo catches now) when you can use DirectX functions like the DirectInput class?
8 months into my first child people say when's the next one and then I'm thinking myself fuck that shit
Oh hell yeah, late night fuzzing, real basic stuff, found me a heap overflow in a libc parsing function.
