Jämes Ménétrey

PhD. Student | Software Engineer | Reverse engineering, Cryptography, TEEs.

[Jämes Ménétrey @JamesMenetrey]

I was thrilled to have presented my paper titled WaTZ: A Trusted #Wasm Runtime Environment with Remote Attestation for TrustZone at #ICDCS. Kudos to the colleagues in @IIUN_UniNE at @UniNeuchatel, as part of the European project @VEDLIoT.

[VEDLIoT @VEDLIoT]

A new publication has been accepted in the #ICDCS22, titled WaTZ: A Trusted WebAssembly Runtime Environment with Remote Attestation for TrustZone.

Find out more about it here: https://t.co/tHzIhbVnmU

[Smukx.E @5mukx]

Early Exception Handling

TLDR; This post will show how it is possible to insert our own exception handling logic without relying on VEH or SEH and to manipulate the exception handling long before VEH is called.

Blog: https://t.co/nqXMuZ8WFq

PoC in Rust: https://t.co/w9vvBaCvvX

[Smukx.E @5mukx]

Malware development series - Learn the basics of DLL Injection.

https://t.co/912XYJVy4A

[Smukx.E @5mukx]

Malware development Basics - How EDRs work, Effective techniques to circumvent them and How to compensate for EDR protection gaps..

https://t.co/dQsF3mXtMm

[FAMASoon @FAMASoon]

EvilBytecode/GoDefender: Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY. - https://t.co/ZkgTVh3dXO

[tetsuo @tetsuoai]

Socket cheatsheet.

[herrcore @herrcore]

The original video that got a DMCA takedown from VMPSoft had 48K views, let's try and match that number...

(p.s. you can pinch to zoom on the video if the text is too small on your phone, or pop open a viewer on your desktop)

[Jämes Ménétrey @JamesMenetrey]

@UMich (@ToddMAustin's lab) released Bringup-bench v1.4, a set of benchmarks with minimal dependencies. It would be interesting to compile and run in WebAssembly runtimes. Maybe a replacement for our good old Polybench?

[Muqsit 𝕏 @mqst_]

👾 Game Hacking: A Comprehensive Guide on Game Hacking

Part 0: https://t.co/xK4MAo1qwU
Part 1: https://t.co/upl5n5zQp5
Part 2: https://t.co/sri4iuQkTE
Part 3: https://t.co/UKsoGXIkaq
Part 4: https://t.co/jszNkTVgHH
Part 5: https://t.co/i6I8G2sASZ

#infosec #gamehacking

[Rohan Paul @rohanpaul_ai]

WOW. @Microsoft just open-sourced the code for one of "THE MOST" influential Paper of 2024 🔥

1-bit LLMs (e.g., BitNet b1.58).

Now you can run a 100B param models on local devices quantized with BitNet b1.58 on single CPU at 5-7 tokens/sec 🤯

The dream we have all been waiting for.

📊 Performance Improvements:

- Achieves speedups of 1.37x to 5.07x on ARM CPUs

- Larger models see greater performance gains

- Reduces energy consumption by 55.4% to 70.0% on ARM

- On x86 CPUs, speedups range from 2.37x to 6.17x

[Jämes Ménétrey @JamesMenetrey]

How to destroy any open-source initiatives for your project 101.

[WordPress @WordPress]

@wp_acf This has happened several times before, and in line with the guidelines you agreed to by being in the directory: https://t.co/90ni1jB7E2

Best of luck with your version. We're looking forward to making ours amazing for our users, using the best GPL code available.

[Hex-Rays SA @HexRaysSA]

In a couple of days, we'll be releasing IDA 9.0! We're excited to introduce our supercharged FLIRT Manager plus thousands of new signatures, available as separate downloads 🤩 Learn more 🌐 https://t.co/sG7UDhfho5

#idapro

[Binni Shah @binitamshah]

Reversing VMCrack : https://t.co/VmzTle4cpw

[Usman Sikander @UsmanSikander13]

Basics to Advanced Process Injection.
Covering 25 Techniques
https://t.co/BIKAZ1C6Ob

#processinjection #malwaredevelopment #infosec #cybersecurity #offensivesecurity

[Jiří Vinopal @vinopaljiri]

#IDA TIP to load #Windows #Kernel types:
[1/2] Windows Kernel types (e.g., EPROCESS, ETHREAD, etc.) are not a part of the built-in IDA TILs (because they are changing across different WIN versions).

1. These types are a part of the "ntoskrnl.exe" debug symbols -> "ntkrnlmp.pdb".
2. IDA supports loading "only types" from arbitrary "pdb" file.
3. One can also use the IDA->File->Load file->PDB file dialog to load specific version of "ntoskrnl.exe" and IDA will proceed with automatic download of appropriate "ntkrnlmp.pdb" applying "only types" (if optional checkbox is selected).
4. See example video...

[Binni Shah @binitamshah]

How EDR works : the (Anti-)EDR Compendium : https://t.co/tKffa1EGSu

Ref :

Gotta Catch ‘Em all! Catching Your Favorite C2 In Memory Using Stack & Thread Telemetry : https://t.co/S08wNLXsfn

[Michal Strehovský @MStrehovsky]

Different ways .NET makes sure your code is done fast.

[Mark Ermolov @_markel___]

Intel HW is too complex to be absolutely secure! After years of research we finally extracted Intel SGX Fuse Key0, AKA Root Provisioning Key. Together with FK1 or Root Sealing Key (also compromised), it represents Root of Trust for SGX. Here's the key from a genuine Intel CPU😀

[David Fowler @davidfowl]

In .NET 9 it's now possible to get an alternative lookup structure to search dictionaries and hashsets (and some other specialized collections) by spans. This allows for allocation free lookups!

#dotnet

[Josh Stroschein | The Cyber Yeti @jstrosch]

Great intro to #reverse #engineering blog by @0x6D6172636F along with some amazing #ascii art!

https://t.co/sUwTkQSPcC

[dodyg @dodyg]

Type Unions for C#

"we're cautiously optimistic about this proposal and moving forward with it."

https://t.co/jHXeivhGK1