Tyro retweeted
Here's an interesting one shared by @malwrhunterteam: 9b0efba16de053c58e1d79d0b51c7331b74da729bd7913b9c9dfa95381398fb8 - DocSendInstaller-Installer (DMG, funny name) with currently 1 VT detection. This one is pretty long due to some added complexity..🧵
Tyro retweeted
My latest research on a new way to exploit vulnerable windows drivers: bring your own trusted caller (BYOTC). In addition to bringing a legitimate driver, an attacker can also bring a trusted user-mode client process and gain code execution inside of it: xusheng.dev/posts/byotc/main…
Tyro retweeted
They did it again. This time it's Tencent's kernel anticheat VM.
815 of 865 virtualized functions across four kernel drivers statically devirtualized back to native code. 94.2 percent coverage, 99.3 on ACE-GAME.sys.
Same approach. Guided symbolic execution, constant promotion, constant folding. The entire math obfuscation layer comes down to sixteen identity rules that fit on one screen.
If you're unpacking malware protected by Themida or VMProtect, this is the same problem. Same VM architecture, same obfuscation patterns, same deobfuscation techniques. Doesn't matter that it's anticheat, you're learning the same skills.
Denuvo anti-tamper is next.
back.engineering/blog/31/07/…
Author: @BackEngineerLab @_xeroxz
#ReverseEngineering #MalwareAnalysis #Infosec
Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.
back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.
The before/after in the repo is genuinely shocking.
Works on pretty much any VM obfuscator, not just Themida.
Blog: back.engineering/blog/09/05/…
Devirt output: github.com/backengineering/t…
Author: @BackEngineerLab
#ReverseEngineering #InfoSec #Malware
Tyro retweeted
A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via DKOM, masquerades as a minifilter and a fake Microsoft service, and — most notably — receives C2 commands through the Windows registry. Includes the full recovered command table, IOCs and a matching YARA figure.
core-jmp.org/2026/07/sakdriv…
#CobaltStrike #DKOM #EDREvasion #ETW #ETWBypass #IDAPro #KernelCallbacks #KernelDriver #KernelDriverReverseEngineering #MalwareAnalysis #MinifilterDriver #Rootkit #SakDriver #WFP #WindowsFilteringPlatform #WindowsInternals #WindowsKernel #WindowsMalware
Tyro retweeted
New blog post, it's been a while! Have you ever wanted to know what HyperGuard protects from NTOSKRNL?
I also found a few interesting bits of information around its protection of the (beautiful :3) Alt Syscalls - so check it out here!
fluxsec.red/what-does-hyperg…
Tyro retweeted
Highly targeted, elite C++ implant but they forgot to disable RTTI support in the compiler?
OPSEC fail?
Or perhaps the metadata was left deliberately to prevent threat intelligence researchers from assigning a silly name to it when it was picked up in the wild? 🙂
