Cracker

Hi everyone i am a reverse engineer and also a software developer if you guys have any question you can message me anytime.

[Cracker @Cracker8oy]

@PandaRE__ I want to learn reverse Engineering like a pro so what do i do @PandaRE__

[Cracker @Cracker8oy]

@PandaRE__ @MalbearLabs The panda is more scary then you

[Cracker @Cracker8oy]

@PandaRE__ We also want that

[Cracker @Cracker8oy]

@PandaRE__ The one in the middle looks one of the biggest noodle

[Cracker @Cracker8oy]

@PandaRE__ Its like shooting 100s bullets at once 🤭

[Cracker @Cracker8oy]

@PandaRE__ Happy for you Panda

[Cracker @Cracker8oy]

@PandaRE__ now its time for you to hack that guy

[Cracker @Cracker8oy]

@ThePrimeagen Ask AI to fix 😄😄😄😄😄😄

[Cracker @Cracker8oy]

@PandaRE__ So you don't get quiet that much and fight with them every time.

[Cracker @Cracker8oy]

Found my another crackme
https://t.co/KxfJVEVk3g

[Cracker @Cracker8oy]

@PandaRE__ I was coming to the researching also but now i gotta stop because you said that researchers are poor and i don't want to be poor.

[Cracker @Cracker8oy]

This is specially for malware analysts and for those who are new to this.

[PandaRE 🐼 🇺�� @PandaRE__]

One way to spot a malicious proxy DLL when there are over 20 DLLs in the folder and one of them is lying, under 60 seconds. Let's go 👇

1/ An unsigned DLL named like a Microsoft runtime (𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶.𝚍𝚕𝚕)? Open it in your favorite disassembler. Exports look normal. Now double-click any export, and you see:

𝚖𝚘𝚟 𝚛𝚊𝚡, 𝚌𝚜:𝚐𝚃𝚊𝚛𝚐𝚎𝚝
𝚓𝚖𝚙 𝚚𝚠𝚘𝚛𝚍 𝚙𝚝𝚛 [𝚛𝚊𝚡+𝟾𝟸𝟶𝚑]

Click another one, and it's the same thing. You see 291 exports but zero real code - every function is a forwarding address.

2/ Now check that table: 𝚐𝚃𝚊𝚛𝚐𝚎𝚝 in the .𝚍𝚊𝚝𝚊 section - it's zeroed on disk. Every export jumps through it, and the file has nothing in it. It stays empty until the DLL loads, then one function does 𝙻𝚘𝚊𝚍𝙻𝚒𝚋𝚛𝚊𝚛𝚢("𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶𝚊.𝚍𝚕𝚕") + 𝙶𝚎𝚝𝙿𝚛𝚘𝚌𝙰𝚍𝚍𝚛𝚎𝚜𝚜 a few hundred times.

And there it is: 𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶𝚊.𝚍𝚕𝚕 - the legitimate DLL in the same folder with one extra letter in the name. The fake DLL carries the real one's name and forwards every call to it.

The 60-second checklist:

☑️ DLL named like a Microsoft runtime (𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶.𝚍𝚕𝚕), but wait, Microsoft didn't sign it
☑️ all exports share one identical code stub
☑️ jump table zeroed on disk
☑️ a second DLL with the same name + one extra letter

[Cracker @Cracker8oy]

@PandaRE__ Good info for malware analysts. You are always giving valuable information.

[Liam Leo @LiamLeo_Dev]

Cables with Box3D physics in Unreal engine
#box3d #unrealengine #physics #ue5

[Cracker @Cracker8oy]

@NahamSec @hackinghub_io @amrelsagaei @CaidoIO Hoping to be the one

[Cracker @Cracker8oy]

@PandaRE__ but you look like a psycho in a movie or a zombie in a movie

[Cracker @Cracker8oy]

Hello everyone new free course launched by blackstormsecurity thanks to @blackstormsecbr made for reverse engineers, malware hunters, vulnerability researchers for all of windows MacOS and Linux users the following is the link
https://t.co/cEGVlcCLBa

[Cracker @Cracker8oy]

@endingwithali we are waiting for your comedy

[Cracker @Cracker8oy]

@endingwithali Select-String -Path node_modules\@privy-io\react-auth\package.json -Pattern "repository|homepage|git|version"

node_modules\@privy-io\react-auth\package.json:3: "version": "3.38.0",
node_modules\@privy-io\react-auth\package.json:14: "homepage": "https://t.co/imjXXXSr5s",