How to fix the Yara signatures empty field? This tab stopped displaying information for me on any open file.
Malcat version 0.9.9 is out! Check out the new offline version of Kesakode for blazing-fast (unpacked) #malware identification across 2000+ families.
Also python 3.13 support (& disassembler), new file parsers & improved UI:
malcat.fr/blog/099-is-out-of…
me.c3 retweeted
We are thrilled to announce the winners of the 2024 Hex-Rays Plugin Contest!
🥇1st Place: hrtng
🥈2nd Place: aiDAPal
🥉3rd Place: idalib Rust bindings
Check out our reviews of the winners and other notable submissions here: eu1.hubs.ly/H0gRDRn0
Huge thank you to all participants for their innovative contributions. Your creativity continues to enhance the IDA community.
#HexRays #IDAPro #PluginContest #ReverseEngineering
me.c3 retweeted
My colleagues wrote about unpacking PyArmor V8
#PyArmor
cyber.wtf/2025/02/12/unpacki…
me.c3 retweeted
🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own
🔥 68 executables supported out of the box - use right away, make tweaks, or create your own
👉 Now available at argfuscator.net
me.c3 retweeted
Bypass AMSI by uninitializing the IActiceScript object (zero ptr at 0x3c8). Slightly modified wscript no longer calls into AMSI.
me.c3 retweeted
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. elastic.co/security-labs/win…
Project:
github.com/x86matthew/WinVis…
me.c3 retweeted
Small gift for you! 🔺🟦🔺
Code to reliably stop almost any 3rd party Windows security system, via ci!CiValidateFileAsImageType.
No privileges needed at all, user rights are enough. Shall work on most OS: 10 22H2, 11 24H2, WS2022.
But: it requires CI policies (e.g. HVCI/UMCI on).
ALT Screenshot of some source code and cicerti.exe running with user rights. It's about to stop csagent.sys and something else. Src with link to compiled binary: https://pastebin.com/ViDsA2Jc Explanation: this time there's none. Please note 3 sigils in the tweet, corresponding to the 3 layers of the post.
me.c3 retweeted
Updated #TinyTracer (v2.9) is out: github.com/hasherezade/tiny_… ! Now you can trace indirect #syscalls, and dump context before each logged instruction.
me.c3 retweeted
"Raspberry Robin uses an interesting approach to avoid detection while adding registry data.
Rather than modifying the Windows registry directly using common Windows API functions (e.g. RegOpenKey, RegSetValueEx), Raspberry Robin first renames the target registry key to a random one, writes the registry data into the renamed key, and renames it back to its original name.
However, if administrator privileges are available, Raspberry Robin uses a different approach. At first, it renames the registry key, creates an offline registry hive in the Windows temporary directory with a random filename. Then, it writes the registry data in the offline registry hive and loads the offline hive to the global registry tree using ZwRestoreKey."
zscaler.com/blogs/security-r…
me.c3 retweeted
I wrote an article about known attacks on Elliptic Curve Cryptography, check it out! github.com/elikaski/ECC_Atta…
me.c3 retweeted
You've coded brilliant fallback codepath for case when menacing 𝐁𝐞𝐞𝐩 EDR is running, but have no rights to check its presence?
EZ check:
isBeepEdrDriverRunning = NtQueryFullAttributesFile(
ObjAttr(L"\\Driver\\Beep"),
NtCurrentTeb()) == STATUS_OBJECT_TYPE_MISMATCH;
me.c3 retweeted
Introducing Early Cascade Injection: from Windows process creation to stealthy injection outflank.nl/blog/2024/10/15/…
me.c3 retweeted
Gepetto 1.4 is officially released: github.com/JusticeRage/Gepet…
It's a cool one:
- Support for local models
- Added a CLI interface to interact with the model directly
- Developing support for other models is now easier (no UI updates needed)
me.c3 retweeted
Pleased to announce Gepetto is compatible with IDA 9.0 out of the box! Thanks to @HexRaysSA for providing me with a beta key for testing.
The next feature will be support for local models with Ollama.
github.com/JusticeRage/Gepet…
me.c3 retweeted
LIEF 0.15.0 is released! You can checkout lief.re/blog/2024-07-21-lief… for the details.
me.c3 retweeted
Themida Spotter - A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer’s obfuscated code locations.
Can be useful to quickly find mutated and virtualized functions in a binary.
Link: github.com/ergrelet/themida-…
