cr3ghost

A student passionate about reverse engineering, windows internals, anti-cheat research, malware research, and exploit research. Aspiring red teamer.

[cr3ghost @cr3ghost]

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.

A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.

No paywall. No course. Just research. Free as in beer.

https://t.co/x516DQRcB8

Author: @ale_sp_brazil

#ReverseEngineering #MalwareAnalysis #InfoSec

[cr3ghost @cr3ghost]

Credits to @aionescu for the amazing FREE content and training on the website. World-class researchers: https://t.co/WueTrjdXHZ

[cr3ghost @cr3ghost]

Most people learn security research by reading finished writeups. This one shows the actual process.

The messy, organic, step-by-step reality of reversing an unknown Windows mitigation from scratch. WinDbg. IDA. Hex Rays. Guard page violations. Trap flags. Zero prior knowledge of the target.

If you want to learn how to actually approach unknown Windows internals, start here.

https://t.co/Xq8xbSnG75

Author: @yarden_shafir

#ReverseEngineering #WindowsInternals #InfoSec

[cr3ghost @cr3ghost]

@HackingLZ Microsoft does a great job at helping the security industry by staying more vulnerable.

[cr3ghost @cr3ghost]

@vxunderground @5mukx @martinwoodward i reached out to my contact in github and apparently it's copy-right infringement. ill ask around for you to see if they can help internally.

[cr3ghost @cr3ghost]

@vxunderground at this point the CEO of Microsoft is probably on autopilot or should we say copilot 🤣

[cr3ghost @cr3ghost]

I believe I was trying to say it’s a “malware technique.”, obviously it’s not doing anything malicious but you could easily add functionality to do that in the user-mode component. Most game cheats use malware-like techniques. It helps non-technical individuals understand similarities.

[cr3ghost @cr3ghost]

This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.

A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).

Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.

Reads like malware. Because it is. Videos and full technical breakdown in the link.

Author: https://t.co/iHtxyJSbwy

#ReverseEngineering #Malware #AntiCheat

[cr3ghost @cr3ghost]

While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.

After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.

They found $12 million in Bitcoin and kept going.

This is what kernel anti-cheat is actually fighting.

https://t.co/zHjWeLgQ3X

Authors: @BackEngineerLab

#AntiCheat #Malware #InfoSec

[cr3ghost @cr3ghost]

@BackEngineerLab published one of the first public Hyper-V hyperjacking frameworks back in 2021. Module injection and VM-exit hooking for both AMD and Intel. A lot of the techniques being discussed here trace back to that work.

blog: https://t.co/z0oQMuGPBT
GitHub: https://t.co/gdY3IeMEyB

Author: @_xeroxz

[cr3ghost @cr3ghost]

Free resources is the best way to learn.

[cr3ghost @cr3ghost]

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.

A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.

No paywall. No course. Just research. Free as in beer.

https://t.co/x516DQRcB8

Author: @ale_sp_brazil

#ReverseEngineering #MalwareAnalysis #InfoSec

[cr3ghost @cr3ghost]

@IAMERICAbooted @jonasLyk i was probably in high school when this legend was hacking. I wanted to sell my 0-exploits too but someone told be it is cyber weapon and it’s illegal. So instead I just use in game cheats.

[cr3ghost @cr3ghost]

@NinjaParanoid @Octoberfest73 what experiences have you had with EDR vendors? I’m curious to know people’s interactions for reporting bugs or bypasses and their bounty programs. Are they okay with releasing blog posts to bypass them or are they same as anti-cheat vendors?

[cr3ghost @cr3ghost]

@cyb3rops do they even have a security team and if they do then why are they not part of the SDLC?

[cr3ghost @cr3ghost]

Server-side authority works well for smaller player counts but at millions of concurrent players the latency and infrastructure cost becomes a real problem. Most studios cannot afford to run authoritative physics and position validation at that scale. Client-side is not ideal but it is a practical reality. The honest answer is both are needed and neither alone solves it.

[cr3ghost @cr3ghost]

Gamers worry about kernel anti-cheats when any user-mode software (ring-3) can already read your passwords, browser history, log your keystrokes, record your camera, steal your files, and exfiltrate your data.

Spyware has never needed the kernel. Kernel access is not what makes something spyware.

Cheaters have been loading kernel drivers and hypervisors for years to hide from detection. A usermode anti-cheat has no way to detect something already operating below it.

Loading at boot is necessary. If anti-cheat loads after a cheat driver is already in the kernel, it has already lost.

Read: Why Anti-Cheat Software Utilize Kernel Drivers

https://t.co/eTi683zHgc

Author: @vm_call from @the_secret_club

#AntiCheat #GameSecurity

[cr3ghost @cr3ghost]

Vanguard runs at boot because cheats run at boot.

Riot clones the PML4 table, inserts a shadow entry into a free slot, hooks SwapContext, and swaps CR3 per-thread at context switch time.

If it was spyware, researchers would have found it. They found this instead.

Reverse engineering is an art. When in doubt, reverse it.

#ReverseEngineering #Vanguard #InfoSec

Full RE breakdown by @Xyrem256: https://t.co/RyUreWosL5

[cr3ghost @cr3ghost]

@nnwakelam #BugBountyTips 🤣

[cr3ghost @cr3ghost]

@blackroomsec You can always uninstall Windows and go to Linux.

[cr3ghost @cr3ghost]

@LowLevelTweets You should search for “MSRC scams security researchers”

[cr3ghost @cr3ghost]

@Pirat_Nation We should call it goddess of love.

[cr3ghost @cr3ghost]

@vxunderground Free as in Beer? We wish.

[cr3ghost @cr3ghost]

@HackingLZ @github what repos did you have. would be helpful to see what they're flagging so we can reverse the why.

[cr3ghost @cr3ghost]

@jonasLyk @IAMERICAbooted do you think it is possible that you are affiliated with a game hacking research group called the back engineering lab and secret club?