twentyeight

Security Researcher | Malware Analysis & Reverse Engineering |

[twentyeight @b_sendpacket]

@MamboJambo85 @k_flowstate @zack_overflow long can be i32 or i64 depending on platform, long long is i64 regardless of platform

[twentyeight @b_sendpacket]

@cyb3rops I understand where Shellter is coming from here, and while I agree it would be nice for Elastic to have reported this directly- I don’t see this being feasible for every suspected case. I also don’t see anything in their signatures you couldn’t create via the malicious binaries?

[Tim Blazytko @mr_phrazer]

The slides from our @reconmtl talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolodev), are now online!

Slides: https://t.co/O9s6ItbHFw

Plugin: https://t.co/cek4bXbNyB

[twentyeight @b_sendpacket]

@_winter_wonders This is really cool! I’m curious if in this visual form, could you still differentiate malware families even after obfuscation passes?

[twentyeight @b_sendpacket]

Did you know that WinDbg has a `dx` command that lets you define variables, cast memory, and walk structures?

Here's some absolutely cursed code I wrote today to walk the PEB, locate ntdll.dll, and dump its exports - using only `dx`!

[Washi @washi_dev]

After #flareon11 challenge 7, I got inspired to build tooling for #dotnet Native AOT reverse engineering.

As such, I built a #Ghidra Analyzer that can automatically recover most .NET types, methods and frozen objects (e.g., strings).

Blog:👉https://t.co/qmGBlgCUir

[ACE Responder @ACEResponder]

How Component Object Model (COM) works.

#ThreatHunting #DFIR #Windows #Microsoft

[twentyeight @b_sendpacket]

@micrictor @ForensicITGuy Unfortunate :/ Hopefully that gets implemented one day, and then it might truly be a worthwhile switch

[twentyeight @b_sendpacket]

@xyz3va it’s funny, they clearly underestimate what a team of reverse engineers can and will do lol

[twentyeight @b_sendpacket]

@micrictor @ForensicITGuy Do you happen to know if they now support password protected 7z archives?

[安坂星海 Azaka || VTuber @AzakaSekai_]

victim does WHAT

[Jesko Hüttenhain @huettenhain]

What a great opportunity for a #BinaryRefinery showcase!

xt exe | xt | push [
| bat
| carve -d string
| iffs =
| b64
| pop k i
| carve -sd b64
| aes --iv=eat:i eat:k
| zl
| peek -mm ]

📌 https://t.co/E20pgo1E4d

[twentyeight @b_sendpacket]

@0x6D6172636F Using the CAPA plugin in IDA is a game changer on large binaries where drilling down functionality would be miserable otherwise, fully agreed

[Invoke RE @InvokeReversing]

Huge congrats to @b_sendpacket and @Autonomatom for being the first students to finish the Introduction to Malware Binary Triage (IMBT) course! They have now received their certificates of completion 🥳