@weak1337

19 - Student

 Deutschland
Joined October 2020
  • Tweets31
  • Following37
  • Followers234
1Media
Today I released Alcaztaz - an x64 binary obfuscator featuring: - Obfuscation of immediate moves - Control flow flattening - Mutation / Obfuscation of certain instructions like MOV, ADD, LEA - Anti disassembly - Entry point obfuscation Read more at: github.com/weak1337/Alcatraz

GitHub - weak1337/Alcatraz: x64 binary obfuscator

x64 binary obfuscator. Contribute to weak1337/Alcatraz development by creating an account on GitHub.

github.com
5
131
471
45,307
Reversed how EasyAntiCheat grabs your MAC + gateway MAC on load: a WFP L2 filter (MAC_FRAME_ETHERNET, in+out) with no conditions inspects every Ethernet frame for 30s. Same filter sees your DNS and unencrypted payloads, questionable access for a MAC read: github.com/weak1337/FilterTa…

GitHub - weak1337/FilterTap

Contribute to weak1337/FilterTap development by creating an account on GitHub.

github.com
4
27
1
389
19,208
Detect Tpm Spoofing github.com/weak1337/DetectTp…

GitHub - weak1337/DetectTpmSpoofing

Contribute to weak1337/DetectTpmSpoofing development by creating an account on GitHub.

github.com
1
1
10
757
Generate a HWID using Intel iGPU OpRegion github.com/weak1337/IntelOpR…

GitHub - weak1337/IntelOpRegionFingerprint

Contribute to weak1337/IntelOpRegionFingerprint development by creating an account on GitHub.

github.com
2
267
🚀Last week, I got a sneak peek at @BackEngineerLab's latest project! Their demo ran in a bin2bin'd Windows kernel —flawlessly, without any stability issues. For those who know, dealing with exceptions, especially in binary obfuscation is quite a pain. Something to look out for!
3
12
4,780
My new article using HexRays IDA. to deal with obfuscated code. comercial like VmProtect and OpenSource like Alcatraz: keowu.re/posts/Analyzing-Mut…

Keowu Blog's

Security Researcher | i like All OS Internals, Malware & Reverse Engineering, C++, Intel/ARM Assembly and cool things.

keowu.re
3
75
221
27,639
Improving MBA Deobfuscation using Equality Saturation by @fvrmatteo and @mr_phrazer. secret.club/2022/08/08/eqsat…

Improving MBA Deobfuscation using Equality Saturation

This blog post will first give a brief overview of obfuscation based on Mixed-Boolean-Arithmetic (MBA), how it has historically been attacked and what are the known limitations. The main focus will...

secret.club
73
6
140
github.com/weak1337/SkipHook

GitHub - weak1337/SkipHook

Contribute to weak1337/SkipHook development by creating an account on GitHub.

github.com
5
Have you ever wondered if it was possible to execute code inside of a drivers .data section? Well, I did. I created a PoC that abuses Windows' LargePageDrivers feature to copy shellcode into the beep.sys .data section and execute it. Blog post: vollragm.github.io/posts/abu…

Abusing LargePageDrivers to copy shellcode into valid kernel modules

Introduction Most people in the game hacking community write their kernel-mode drivers to get around kernel-level anti-cheats such as EasyAntiCheat. However, those anti-cheats have several methods to...

vollragm.github.io
2
161
3
376
Latest reversal of NVIDIAs nvml.dll which allows developers to query DeviceName, UUID and similar values. Communicates directly with NVIDIAs kernel module github.com/weak1337/NvidiaAp…

GitHub - weak1337/NvidiaApi

Contribute to weak1337/NvidiaApi development by creating an account on GitHub.

github.com
6
Touché
3
Detect @_cheatengine by listening to the global debug output: github.com/weak1337/CEDetect…

GitHub - weak1337/CEDetector

Contribute to weak1337/CEDetector development by creating an account on GitHub.

github.com
2
8
Finally... Windows Insider Preview WDK build 22557 integrates with VS 2022 microsoft.com/en-us/software…

Download Windows Insider Preview WDK

microsoft.com
2
19
3
52
Deobfuscate ricochet anti cheat github.com/weak1337/ricochet…

GitHub - weak1337/ricochet_deobfuscator

Contribute to weak1337/ricochet_deobfuscator development by creating an account on GitHub.

github.com
1
3
HMDM (Highly Modular Driver Mapper), is a driver mapper which uses any method of executable kernel memory allocation and arbitrary kernel writes to map unsigned code into the windows kernel. The repo contains a MSREXEC and VDM example. githacks.org/_xeroxz/hmdm
47
130
msrexec is a framework that can be used to elevate all arbitrary MSR writes to kernel execution. Its another project under the VDM namespace and integrates with VDM (and thus PTM). Special thanks to @drewbervisor for pointing out AC bit can be set in UM. githacks.org/_xeroxz/msrexec
3
32
3
112
Hiding execution of unsigned code in system threads by @drewbervisor secret.club/2021/01/12/callo…

Hiding execution of unsigned code in system threads

Anti-cheat development is, by nature, reactive; anti-cheats exist to respond to and thwart a videogame’s population of cheaters. For instance, a videogame with an exceedingly low amount of cheaters...

secret.club
2
30
76
Driver mapper that does not map a driver into the "kernel", but rather only maps the driver into the current context. This keeps the driver out of the kernels paging tables, generally making it difficult to find :) githacks.org/xerox/nasa-mapp…
5
35
2
110
Driver communication without a valid image github.com/weak1337/EvCommun…

GitHub - weak1337/EvCommunication

Contribute to weak1337/EvCommunication development by creating an account on GitHub.

github.com
1
1
2
Abusing @equ8anticheat driver to protect your own processes. github.com/weak1337/EQProtec…

GitHub - weak1337/EQProtect

Contribute to weak1337/EQProtect development by creating an account on GitHub.

github.com
1
Load more