Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.
A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.
No paywall. No course. Just research. Free as in beer.
https://t.co/x516DQRcB8
Author: @ale_sp_brazil
#ReverseEngineering #MalwareAnalysis #InfoSec
Most people learn security research by reading finished writeups. This one shows the actual process.
The messy, organic, step-by-step reality of reversing an unknown Windows mitigation from scratch. WinDbg. IDA. Hex Rays. Guard page violations. Trap flags. Zero prior knowledge of the target.
If you want to learn how to actually approach unknown Windows internals, start here.
https://t.co/Xq8xbSnG75
Author: @yarden_shafir
#ReverseEngineering #WindowsInternals #InfoSec
@vxunderground@5mukx@martinwoodward i reached out to my contact in github and apparently it's copy-right infringement. ill ask around for you to see if they can help internally.
I believe I was trying to say itโs a โmalware technique.โ, obviously itโs not doing anything malicious but you could easily add functionality to do that in the user-mode component. Most game cheats use malware-like techniques. It helps non-technical individuals understand similarities.
This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.
A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).
Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.
Reads like malware. Because it is. Videos and full technical breakdown in the link.
Author: https://t.co/iHtxyJSbwy
#ReverseEngineering #Malware #AntiCheat
While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.
After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.
They found $12 million in Bitcoin and kept going.
This is what kernel anti-cheat is actually fighting.
https://t.co/zHjWeLgQ3X
Authors: @BackEngineerLab
#AntiCheat #Malware #InfoSec
@BackEngineerLab published one of the first public Hyper-V hyperjacking frameworks back in 2021. Module injection and VM-exit hooking for both AMD and Intel. A lot of the techniques being discussed here trace back to that work.
blog: https://t.co/z0oQMuGPBT
GitHub: https://t.co/gdY3IeMEyB
Author: @_xeroxz
Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.
A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.
No paywall. No course. Just research. Free as in beer.
https://t.co/x516DQRcB8
Author: @ale_sp_brazil
#ReverseEngineering #MalwareAnalysis #InfoSec
@IAMERICAbooted@jonasLyk i was probably in high school when this legend was hacking. I wanted to sell my 0-exploits too but someone told be it is cyber weapon and itโs illegal. So instead I just use in game cheats.
@NinjaParanoid@Octoberfest73 what experiences have you had with EDR vendors? Iโm curious to know peopleโs interactions for reporting bugs or bypasses and their bounty programs. Are they okay with releasing blog posts to bypass them or are they same as anti-cheat vendors?
Server-side authority works well for smaller player counts but at millions of concurrent players the latency and infrastructure cost becomes a real problem. Most studios cannot afford to run authoritative physics and position validation at that scale. Client-side is not ideal but it is a practical reality. The honest answer is both are needed and neither alone solves it.
Gamers worry about kernel anti-cheats when any user-mode software (ring-3) can already read your passwords, browser history, log your keystrokes, record your camera, steal your files, and exfiltrate your data.
Spyware has never needed the kernel. Kernel access is not what makes something spyware.
Cheaters have been loading kernel drivers and hypervisors for years to hide from detection. A usermode anti-cheat has no way to detect something already operating below it.
Loading at boot is necessary. If anti-cheat loads after a cheat driver is already in the kernel, it has already lost.
Read: Why Anti-Cheat Software Utilize Kernel Drivers
https://t.co/eTi683zHgc
Author: @vm_call from @the_secret_club
#AntiCheat #GameSecurity
Vanguard runs at boot because cheats run at boot.
Riot clones the PML4 table, inserts a shadow entry into a free slot, hooks SwapContext, and swaps CR3 per-thread at context switch time.
If it was spyware, researchers would have found it. They found this instead.
Reverse engineering is an art. When in doubt, reverse it.
#ReverseEngineering #Vanguard #InfoSec
Full RE breakdown by @Xyrem256: https://t.co/RyUreWosL5
@jonasLyk@IAMERICAbooted do you think it is possible that you are affiliated with a game hacking research group called the back engineering lab and secret club?