Tyro

Im not real

[L0Psec @L0Psec]

Here's an interesting one shared by @malwrhunterteam: 9b0efba16de053c58e1d79d0b51c7331b74da729bd7913b9c9dfa95381398fb8 - DocSendInstaller-Installer (DMG, funny name) with currently 1 VT detection. This one is pretty long due to some added complexity..🧵

[Tyro @Tyrovisor]

@Sentdex how about OMP

[Tyro @Tyrovisor]

@He1s_Sammy why in mine is not free

[Tyro @Tyrovisor]

@EricParker ive done this before in my last post 03 Jun and rn still fine no ban. the strange part about that guy is he said he purely uses Proton which is weird. Proton runs entirely in Ring 3 so either he emulate alll the pipe or idk

[Tyro @Tyrovisor]

@pfhandler @ItsGamerDoc Pproton runs entirely in r 3 user space,how did you get vgk.sys to execute privileged ring 0 instructions like RDMSR and walk Windows _EPROCESS structures without throwing a General Protection Fault, or are you just running a stealth KVM?

[Tyro @Tyrovisor]

@pfhandler did u port all of the emulate all kernel calls in proton that needed for vanguard?

[Tyro @Tyrovisor]

@PELock @aftermath_labs how these thing work then just curious

[Tyro @Tyrovisor]

@secona0 Soal job market? Di era internet sekarang, peluang kerja itu kebuka luas. Rajinrajin gabung komunitas aja, Bro. Riset atau lowongan compiler engineering tuh masih banyak banget, asalkan kitanya nggak sok elitis."

[Tyro @Tyrovisor]

@CrackmesOne can u share ur updated workflow? that took 1h

[Tyro @Tyrovisor]

@entoutcas_tech @voidpro_dev how and what model to create an vm solver

[Tyro @Tyrovisor]

@pmontesel @mahal0z @es3n1n but the real world also compete like this, its not the ctf that end, its adapt. the real world also adapt to this new methodology

[Tyro @Tyrovisor]

@mrexodia @bl4sty when x64dbg tui mcp??

[Crackmes.one @CrackmesOne]

My latest research on a new way to exploit vulnerable windows drivers: bring your own trusted caller (BYOTC). In addition to bringing a legitimate driver, an attacker can also bring a trusted user-mode client process and gain code execution inside of it: https://t.co/iLVmoCqyU7

[Crackmes.one @CrackmesOne]

Flare-on 13 announced! https://t.co/zQkDfrBMV5

[Tyro @Tyrovisor]

@anylink20240604 strict windows 11 enforce cross policy so it required specific Ev certs to load

[Tyro @Tyrovisor]

@mrexodia @C5pider i've used ur project as refference to all of my devirtualization project. Such an awesome project dude

[cr3ghost @cr3ghost]

They did it again. This time it's Tencent's kernel anticheat VM.

815 of 865 virtualized functions across four kernel drivers statically devirtualized back to native code. 94.2 percent coverage, 99.3 on ACE-GAME.sys.

Same approach. Guided symbolic execution, constant promotion, constant folding. The entire math obfuscation layer comes down to sixteen identity rules that fit on one screen.

If you're unpacking malware protected by Themida or VMProtect, this is the same problem. Same VM architecture, same obfuscation patterns, same deobfuscation techniques. Doesn't matter that it's anticheat, you're learning the same skills.

Denuvo anti-tamper is next.

https://t.co/FKRijJIBXk

Author: @BackEngineerLab @_xeroxz

#ReverseEngineering #MalwareAnalysis #Infosec

[eleven red pandas @bytecodevm]

A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via DKOM, masquerades as a minifilter and a fake Microsoft service, and — most notably — receives C2 commands through the Windows registry. Includes the full recovered command table, IOCs and a matching YARA figure.
https://t.co/xFvESOTSGY

#CobaltStrike #DKOM #EDREvasion #ETW #ETWBypass #IDAPro #KernelCallbacks #KernelDriver #KernelDriverReverseEngineering #MalwareAnalysis #MinifilterDriver #Rootkit #SakDriver #WFP #WindowsFilteringPlatform #WindowsInternals #WindowsKernel #WindowsMalware

[flux @0xfluxsec]

New blog post, it's been a while! Have you ever wanted to know what HyperGuard protects from NTOSKRNL?

I also found a few interesting bits of information around its protection of the (beautiful :3) Alt Syscalls - so check it out here!

https://t.co/JLll5mFYgZ

[winterknife 🌻 @_winterknife_]

Highly targeted, elite C++ implant but they forgot to disable RTTI support in the compiler?

OPSEC fail?

Or perhaps the metadata was left deliberately to prevent threat intelligence researchers from assigning a silly name to it when it was picked up in the wild? 🙂