Daniel Jary

Security researcher

[Daniel Jary @JanielDary]

For anyone that's interested, following my talk 'Immoral Fiber: Unlocking & Discovering New Offensive Capabilities of Fibers' at Black Hat Asia 2024 #BlackHat I have open-sourced my new techniques here:
https://t.co/0vESTgXPOt

[Rasta Mouse @_RastaMouse]

https://t.co/66vtthyDoR

[0xor0ne @0xor0ne]

PatchGuard internals (KPP, Kernel Patch Protection)

https://t.co/tBZ0KOEWmu

Credits @r0keb

#infosec

[Smukx.E @5mukx]

Tickling VMProtect with LLVM: Part 1

https://t.co/Y3hAqFVj4b

[Outflank @OutflankNL]

Here's our new blog on hiding your implant in VTL1, where even an EDR's kernel sensor can't see it.🧑‍🦯

Post includes full operational details. Plus our OST offering has been updated with a Cobalt Strike sleep mask exploiting secure enclaves.

Full read ➡️ https://t.co/oe9A6RowDV

[secret club @the_secret_club]

Hypervisors for Memory Introspection and Reverse Engineering by @memn0ps

https://t.co/yVi4yKE9ku

[Check Point Research @_CPResearch_]

Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code.
In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking.
Read More : https://t.co/ptdomYaAZG

[T3nb3w @T3nb3w]

🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection

Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research!

🔍 Blog: https://t.co/TKdtwuj509
💻 Code: https://t.co/tlppakaLPO

[S3cur3Th1sSh1t @ShitSecure]

Bypass AMSI in 2025, my newest blog post is published 🥳! A review on what changed over the last years and what's still efficient today.

https://t.co/hSqMxeJx2K

[Alex Plaskett @alexjplaskett]

ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries

https://t.co/dYzepTTJ6U

[x86matthew @x86matthew]

I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D

Project:
https://t.co/xJvm24qqXv

[Alex Plaskett @alexjplaskett]

Windows Sockets: From Registered I/O to SYSTEM Privileges by Luca Ginex

https://t.co/OhiGURj2mq

[Rasta Mouse @_RastaMouse]

[BLOG]
This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs.

https://t.co/7wTF0zqgPP

[Daniel Jary @JanielDary]

Virus Bulletin (VB) just released my talk & white paper on Shared Object injection & detection on Linux.

Pleasure to be invited & attend. Great conference guys! @virusbtn #VB #VirusBulletin #Linux

https://t.co/TzlJgIx1V4

https://t.co/nP5zWsMNIv

[Hors @horsicq]

obfus.h is the powerfull compile-time obfuscator for C (win32/64). Supports virtualization, anti-debugging, control flow obfuscation and other code mutation techniques to prevent disassembly or decompilation.
#CodeSecurity #Obfuscation #infosec

https://t.co/i6dnpRJUAF

[Zerotistic @gegrgtezrze]

Excited to share my latest blog post: "Breaking Control Flow Flattening: A Deep Technical Analysis"

I showcase usage of formal proofs and graph theory to automate CFF deobfuscation, among other things !
Might make it a talk...? 👀
https://t.co/iWoP9GeZhX

[Duncan Ogilvie 🍍 @mrexodia]

Watch the blog for part 2! https://t.co/f4YQfemVVG

[Daniel Jary @JanielDary]

@jamieantisocial @BlackHatEvents Cheers dude :)

[Daniel Jary @JanielDary]

My talk from earlier in the year @BlackHatEvents #BlackHatAsia just got posted.

Immoral Fiber: Unlocking & Discovering New Offensive Capabilities of Fibers https://t.co/AMe3aGD4zQ

[hasherezade @hasherezade]

In my new blog for @_CPResearch_ I propose a new injection technique, using the Thread Name API - check it out! 💙

[Virus Bulletin @virusbtn]

At #VB2024 @JanielDary will dig into techniques used to maliciously load Shared Objects & describe ways to detect them. He'll present a tool that identifies SO injection, shellcode injection, process hollowing &entry point manipulation of running processes https://t.co/hznsAn2AAQ