#Wow64 - Twitter Hashtag

over 1 year ago

EDRs love API hooking? PatchGuard doesn’t. Instead of unhooking, do this ... redirect execution using Heaven’s Gate (switching to 64-bit from 32-bit in WoW64) / indirect syscalls. Stay ahead, stay silent. 🕵️‍♂️ #RedTeam #Malware #infosec #cybersecurity #bugbounty #EDR #WoW64

0

4

1

2

163

Shlomi Boutnaru @boutnaru

about 2 years ago

The Windows Concept Journey — “wow64.dll” (Win32 Emulation on NT64) https://t.co/vJSMNim2pS #Windows #Microsoft #Programming #Security #infosec #Technology #TheWindowsCocenptJourney #WOW64 #DevOps #DevSecOps #Learning #Development

0

6

0

2

417

Shlomi Boutnaru @boutnaru

about 2 years ago

The Windows Concept Journey — WOW64 (Windows 32-bit on Windows 64-bit) https://t.co/2a4lECFOj1 #Windows #WOW64 #DevOps #Microsoft #Security #infosec #Microsoft #Tech #IT #TheWindowsConceptJourney

0

6

0

1

280

Mr.Common @hiroki7v11

about 3 years ago

th11 works on Raspberry pi via Gocaine xtajit on AArch64 wine! #x86Emulation #x86 #AArch64 #Wow64 #th11

0

2

0

1

210

Mr.Common @hiroki7v11

about 3 years ago

some #x86 apps works on the #AArch64 wine via #Wow64 with np21w core on the Raspberry Pi 4! #WineHQ #RaspberryPi #IA32 #Emulation

hiroki7v11's tweet photo. some #x86 apps works on the #AArch64 wine via #Wow64 with np21w core on the Raspberry Pi 4!
#WineHQ #RaspberryPi #IA32 #Emulation https://t.co/3TfVKBv9La

0

4

1

0

301

Felix Palmen 📯 @[email protected] @8bitsound

over 4 years ago

#i386 packages still not fully done, need them for #wine (#WoW64) on #FreeBSD and also for a damn old #EeePC, haha. Checking on progress, I'm surprised #poudriere supports #darkmode!

8bitsound's tweet photo. #i386 packages still not fully done, need them for #wine (#WoW64) on #FreeBSD and also for a damn old #EeePC, haha.

Checking on progress, I'm surprised #poudriere supports #darkmode! https://t.co/oIY7DadRVU

1

2

0

Guy Leech

@guyrleech

about 5 years ago

Got a stack trace with #Wow64 calls like Wow64pNotifyDebugger in x64 #windbg which isn't useful/revealing? It'll be because it's a 32 bit process so run these commands & get stack trace again .load wow64exts .effmach x86 (May not need .load line)

guyrleech's tweet photo. Got a stack trace with #Wow64 calls like Wow64pNotifyDebugger in x64 #windbg which isn't useful/revealing? It'll be because it's a 32 bit process so run these commands & get stack trace again

.load wow64exts
.effmach x86

(May not need .load line) https://t.co/EOaOJZB9XO

0

2

0

adr @aaaddress1

over 5 years ago

leave a note here #wow64 #windows #heaven #gate https://t.co/T34Qz9UWPi

0

7

1

0

Andrey Karpov @Code_Analysis

almost 8 years ago

WoW64 internals ...re-discovering Heaven's Gate on ARM https://t.co/4dNHXoDk78 #programming #wow64

0

3

0

yassine lemmou @yassine_lemmou

almost 8 years ago

To get an idea of how #WOW64 subsystem can impact your analysis, refer to The WOW-Effect by Christian Wojner https://t.co/LsE3X9ZaMw From Learning #Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate #Windows malware book.

yassine_lemmou's tweet photo. To get an idea of how #WOW64 subsystem can impact your analysis, refer to The WOW-Effect by Christian Wojner
https://t.co/LsE3X9ZaMw

From Learning #Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate #Windows malware book. https://t.co/ENrVAFjiUU

0

3

1

0

SentinelOne @SentinelOne

about 8 years ago

Now On Stage! Deep Hooks: Monitoring Native Execution In WOW64 Applications Yarden Shafir and Assaf Carlsbad SentinelOne researchers presented on BSidesTLV. Watch it now https://t.co/vxihs6l9TE #WOW64 #injection #HeavensGate #sentinelone #DeepHooks

0

6

5

0

Hacktips @HacktipsIT

over 8 years ago

#wow64 at #BSidesMI18 @BSidesMilano

0

3

2

0

BSides Milano @BSidesMilano

over 8 years ago

@assaf_carlsbad e @yarden_shafir a #BSidesMI18 & OWASPItaly presentano:“Deep hooks: monitoring native execution in WoW64 processes ”. Scopri le tecniche di #hooking dei processi #WoW64 con noi" @proofpoint @sorint.sec @contrastsec @OWASPItaly @MetroOlografix @Peerlyst

0

12

9

0

BSides Milano @BSidesMilano

over 8 years ago

@assaf_carlsbad e @yarden_shafir a #BSidesMI18 & OWASPItaly presentano:“Deep hooks: monitoring native execution in WoW64 processes ”. Scopri le tecniche di #hooking dei processi #WoW64 con noi" @polimi @caldera21 @CrowdStrike @mindedsecurity

0

5

4

0

SentinelOne @SentinelOne

over 8 years ago

On this post, #SentinelOne #researchers demonstrated the ability to #inject 64-bit #DLLs into #WoW64 processes using several different methods https://t.co/0YNjuvD31u See #Mimikatz, compiled with (right) and without (left) #CFG. #wininternals #cyber #security #Windows @aionescu

SentinelOne's tweet photo. On this post, #SentinelOne #researchers demonstrated the ability to #inject 64-bit #DLLs into #WoW64 processes using several different methods
https://t.co/0YNjuvD31u
See #Mimikatz, compiled with (right) and without (left) #CFG.
#wininternals #cyber #security #Windows @aionescu https://t.co/8tpdnJ7WgW

0

15

12

2

0

SentinelOne @SentinelOne

over 8 years ago

https://t.co/0YNjuvD31u After covering methods to inject 64-bit modules into WoW64 applications, in this post we dive into the details of some of the adaptations required for handling CFG-aware systems. #APC #injection #WoW64 #wininternal #windows

0

3

2

0

SentinelOne @SentinelOne

over 8 years ago

https://t.co/dHAtIDT9A2 1st in a 3 post series describing the challenges one has to overcome when trying to hook the native #NTDLL in #WoW64 applications, By Yarden Shafir and Assaf Carlsbad #windev #wininternals #hooks

0

4

5

0