iossefy

so-called hacker

[cr3ghost @cr3ghost]

They did it again. This time it's Tencent's kernel anticheat VM.

815 of 865 virtualized functions across four kernel drivers statically devirtualized back to native code. 94.2 percent coverage, 99.3 on ACE-GAME.sys.

Same approach. Guided symbolic execution, constant promotion, constant folding. The entire math obfuscation layer comes down to sixteen identity rules that fit on one screen.

If you're unpacking malware protected by Themida or VMProtect, this is the same problem. Same VM architecture, same obfuscation patterns, same deobfuscation techniques. Doesn't matter that it's anticheat, you're learning the same skills.

Denuvo anti-tamper is next.

https://t.co/FKRijJIBXk

Author: @BackEngineerLab @_xeroxz

#ReverseEngineering #MalwareAnalysis #Infosec

[Frank Wu @FrankOverF1ow]

IonStack Blog Series:

Part I (Firefox SpiderMonkey JIT RCE): https://t.co/PbUJTlFLa2

Part II (GhostLock, a 15 yo universal Linux LPE): https://t.co/TxHv6lBaAd

IonStack Part III (Rooting Android with GhostLock): https://t.co/z98lRbnWiH

[rekdt @rekdt]

Hear me out:

[Johann Rehberger @wunderwuzzi23]

Wrote up a blog for the PipeWire sandbox escape via malicious library loading

CVE-2026-5674

Details ⬇️

https://t.co/Nl4VdmFrrl

[starlabs @starlabs_sg]

AI is changing vulnerability research but not in the way many expect
Our intern, Jia Jie, reflects on how AI made Linux kernel 0-day hunting feel surprisingly similar to n-day analysis & why deep system knowledge remains essential for reliable exploitation
https://t.co/9A5V1hqRYe

[TheRealClarity @imnotclarity]

As promised, DarkSword Kernel Exploit writeup is now live at https://t.co/aji0Xc3JNU
This goes over the root cause, what happens on the Kernel side and how the kernel exploit is implemented.
Hope it helps anyone looking to understand it! :)

[Chaofan Shou @shoucccc]

Kimi K3 exploited the latest Redis server with a 0day it discovered.

All it took was 27min with 32 agents.

https://t.co/ZOKA2wchLa

[vx-underground @vxunderground]

This super ultra mega rare fuck off ultra malware my colleague sent me has a really fancy schmancy anti-VM feature. It is the fanciest I've seen to date. I like it.

After bonking this goop with a stick, sifting through dummy and decoy data, I figured out how they evaded my VM, RecordedFuture Triage, AnyRun, and VirusTotal.

They made a really fancy entropy thingie by collecting a bunch of data and doing fancy math.

I respect it.

https://t.co/097fsse2w5

[herrcore @herrcore]

https://t.co/4WQJMzS2XS

[lazyming @vn_lazyming]

RAM is expensive these days :’/
Found a KVM bug that lets the guest eat the host’s RAM, but the guest itself loses nothing. That memory is never returned to the host - a permanent leak.
Maybe this bug, someone could just drain entire physical host RAM of some cloud provider 🫪

[Тsфdiиg @tsoding]

Soviet Union in C

[Florian Hansemann @CyberWarship]

''BYOVD and Looting LSASS in the Modern EDR Era''

#infosec #pentest #redteam #blueteam
https://t.co/puKekCyxJ0

[Calif @calif_io]

https://t.co/Wdnd3jXSw4

Alright, let's try this livestream thing again. Hopefully it will work this time.

We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations.

The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST.

Ask your questions by filling in this form: https://t.co/OfBzuTUzd1

Add to your Google calendar: https://t.co/QewG6L1QkI

Add to your Outlook calendar: https://t.co/fyJHXlGd2W

https://t.co/Wdnd3jXSw4

[Tiziano Marra @_MrTiz]

Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway.

New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks.

Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇

https://t.co/fJOmAcFGOa

[Shift @Shiftreduce]

I gave claude the bad epoll vuln to port onto a modern Pixel 10, it got there, w/ my help

https://t.co/GRwxbL4U95

[Dominic White 👾 @singe]

We've documented a new EDR-bypassing process injection technique from @z3ro2504 & Max Hirschberger on the @sensepost blog. Link to post and code in the replies.

[Binary Wizards @BinaryWizards]

Slides are out. Please grab them from here: https://t.co/G24BV6xBTD

[Dmitry Vyukov @dvyukov]

#ThreadSanitizer can now injects random delays info program execution to catch more tricky data races:

https://t.co/QVAlKs9AiL

Enabled with TSAN_OPTIONS=enable_adaptive_delay=1

Thanks to Chris Cotter
(not in any release still)

[Expel @ExpelSecurity]

The Gentlemen ransomware, in a BYOVD attack, used a zero-day exploit to kill EDRs before deploying their payload. The driver they abused wasn't on any public blocklist. Here's our analysis of their techniques. 🧵

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

既知のWindowsカーネルルートキット技法5つ（プロセス/ドライバ隠蔽・プロセス保護解除・権限昇格・ドライバ署名強制の回避・カーネルコールバック除去）をRustで実装し、各操作がPatchGuard（Windowsカーネルの改ざん検知機構）に検出されるかどうかを明示しながら原理を解説したオープンソースPoC「Eagle」の技術解説です。2022年に公開され2024年に更新された記事で、技法自体は既知ですが、各技法のPatchGuard検出有無の整理と、Rustでのカーネルドライバ実装の実例としてまとまっています。Eagle[.]sysカーネルドライバとclient[.]exeコントローラのクライアント・サーバー構成。

・プロセス隠蔽はEPROCESS（カーネルがプロセス情報を管理する内部構造体）のActiveProcessLinks（プロセス一覧を構成する二重リンクリスト）から対象のリンクを付け替えてリストから切り離す方式（DKOM）。タスクマネージャーやプロセス列挙APIからプロセスが不可視になる。ドライバ隠蔽もDriverSection→LDR_DATA_TABLE_ENTRYを同様に操作。いずれもPatchGuardが検出する操作だが、PatchGuardの定期チェックは計算負荷が高く常時監視ではないため、変更→即時復元のレースコンディションで回避できる余地があるとされている

・プロセス保護の解除はEPROCESSのSignatureLevel・SectionSignatureLevel・Protection（PS_PROTECTION構造体のType/Signer）をゼロ化する方式。Windowsのプロセス保護はPP（Protected-Process）がPPL（Protected-Process-Light）より上位で、Signer階層（None=0→Authenticode=1→…→WinTcb=6→WinSystem=7）によりアクセスが制御される。PPL保護下のLSASS（認証情報を管理するプロセス）のゼロ化でMimikatz等による資格情報ダンプを可能にする用途が文書化されている。この操作はPatchGuardに検出されない

・権限昇格はPID-4（SYSTEMプロセス）のトークン（プロセスの権限情報を格納する構造体）を取得し、対象プロセスのトークンポインタを上書きする方式。通常ユーザー権限（Medium-Integrity）からNT-AUTHORITY\SYSTEM＋SeDebugPrivilege等の全トークン権限が有効化された最高権限に一操作で昇格する

・DSE（Driver-Signature-Enforcement、ドライバ署名強制）のバイパスはCI!g_CiOptionsの値を6（署名必須）からE（テスト署名許可）に変更し、未署名ドライバをロード後に即時復元する方式でPatchGuard検出あり。カーネルコールバック除去はPspCreateProcessNotifyRoutine配列（EDR等がプロセス生成を監視するために登録するコールバック関数の配列、最大64エントリ）の対象インデックスをゼロ化してEDRの検知を無効化する方式でPatchGuard検出なし。ゲームのアンチチートはEDRより先にこれらの対策を進めており、EDRが同じ道を追っている段階との指摘もある

詳細は以下を参照：
https://t.co/RR0hXqdnND