I know a lot of what I do on this web site is related to RE and assembly and malware and such. It works fine. Today will be different. Today we’re going to rip apart some open source software. The target today is Phoronix Test Suite. We’re going to find us some vulnerabilities, because I […]
Finally, I’m done with this my crypter. I’ve written the entire thing in a mish mash of C#, C, and assembly. The crypter I made modifies exes, packs them, and adds AV / VM / Sandbox / debugging evasions inside of a wrapper. I’m employing a basic process hollowing technique for the payload that is […]
Howdy fellow readers. My time is split between video games, code, and work. I have a number of interesting samples I’ve seen that I’ve decided to share with you all. This is a 3+ stage malware. Each stage meaning its own executable (think inception, but with exes). This isn’t all that uncommon with malware. Typically […]
Hello loyal readers! Sorry for the delay in posts, I’ve just been busy with life. Anywho, I got some code to share. A lil script I put together for scanning office documents for the Sandworm exploit. aka Microsoft Security Bulletin MS14-060. For those of you who don’t know / live under a rock, its a […]
Howdy all! Long time no updates. Sorry about that, the life of the AV reverse engineer is a busy one, but busy is good right? Anywho, I come bearing gifts. An anti-debugger trick I learned (while coding skiddy AV tool). The way it works is simple – under normal circumstances, the working set (amount of […]
Hello all! Last Friday was our local Phoenix conference called CactusCon. I gave a 2 hour workshop on cheating at video games. It wasn’t recorded, but I still said I would share the slides (html file), code, and videos. Notes? Check it out! Videos? Now that I have some free time I can finally work […]
Ladies and gentleman – I give you yet another case of VMware detection. Unfortunately, this only works for VMware. A friend of mine, one Aaron Yool told of me a way to detect VMware via the use of privileged instructions. Specifically the “IN” instruction. This instruction is used for reading values from I/O ports. What […]
People often wonder “Joe, how the heck do you know if an AV is worth its weight in sand?” and to them I answer “I have to test it first”. This is one of my tools I coded up. Presently I have to do AV evasions with a debugger, modifying the entry point and looking […]
Modems Do you have cable internet? Own a surfboard modem? Since most of my buddies in AZ do, I sent them to this page and to my amusement, they got knocked off the net for a few minutes. How? Javascript. Specifically a CSRF in the Motorolla Surfboard. The Surfboard cable modem offers little in functionality […]
Hello all! I got a lot more attention that I thought I would get for my blog post. Way more than what I’m used to. I want to re-iterate what I found and hopefully clear up any misconceptions. I found the capabilities for Uber to spy. It doesn’t mean uber is spying. The app can, […]