dddong

Binary security researcher of Ant Security Light-Year Lab, focus on browser security and macOS security.

[dddong @Jdddong]

@zh1x1an1221 价值！还有精力搞chrome啊，太强了

[dddong @Jdddong]

@trustednstaller @ant4g0nist @HexRaysSA what is this vscode plugin's name?

[dddong @Jdddong]

每日欣赏蜘蛛纸牌胜利界面

[Danis Jiang @danis_jiang]

Our talk "Dark Corners: How a Failed Patch Left VMware ESXi VM Escapes Open for Two Years" has been accepted by BlackHat USA 2025!

Super excited to present this work with @0x140ce and @ezrak1e. See you at #BHUSA! @BlackHatEvents

https://t.co/L7Aff1rCWR

[dddong @Jdddong]

@Gtangier @DebugPrivilege ida also has a great debugger, you are not required to remember each command you need, just use the graphic interface!

[dddong @Jdddong]

@DebugPrivilege @windbgtips thanks for sharing！

[dddong @Jdddong]

@phLaul Thanks!

[dddong @Jdddong]

@phLaul @hexacon_fr I know little about windows kernel and hope to hear your opinion😀

[dddong @Jdddong]

@phLaul @hexacon_fr Thank you very much for sharing. I have a question about the deobfuscation of ClipSp. Compared to using qiling for emulation execution, why can't we set a breakpoint after all the decrypt functions have finished running, and dump the memory at that moment?

[dddong @Jdddong]

@Mixailos incorrect selector value of segments

[dddong @Jdddong]

@Mixailos This will cause the generated pdb to be invalid. I want to know how I can manually assign selectors to these segments and how exactly these selectors affect the normal generation of the pdb.

[dddong @Jdddong]

@Mixailos In this case, I need to modify FakePdb to achieve same functionality, because there are segments from different dlls in ida. When Fakepdb dumps segment info, it uses selector value of segment, but the selector values of the segments created by the memory snapshot are all 0.

[dddong @Jdddong]

@Mixailos Sorry, since I'm unable to send you private message, I chose to reply under this post. I really like your FakePDb project, but I've encountered some issues. I need to analyze multiple DLLs within the same IDA database simultaneously, which I achieve through IDA's memory snapshot

[dddong @Jdddong]

@allthingsida `Memory snapshot` when debugging is useful to help me analyze multiple modules in one IDA database, but it is rather annoying to deal with aslr and keep dll load in a fixed address, I usally use `rebase.exe` to give each dll used my target exe a unique load address.

[dddong @Jdddong]

Any methods to debug crash in frida-agent.dll itself when using frida？frida doesn't offer debug symbols，i tried build frida myself but failed in build step.

[dddong @Jdddong]

Nice tutorial!

[Binary Wizards @BinaryWizards]

In this video, we cover the basics of breakpoints in IDA. We explore absolute, module relative, symbolic, source, and hardware breakpoints, as well as conditional breakpoints with practical applications like a mock file monitor. Additionally, we discuss organizing, importing/exporting breakpoints, and using the SDK and IDAPython with breakpoints.

https://t.co/hFlCffuAHX

[dddong @Jdddong]

6. The error message changed to "Cannot install on a hard disk with a GPT partition table".
7. Used the diskpart command to convert the hard disk to an MBR partition table.
8. Success!(4/4)

[dddong @Jdddong]

When did install windows so difficult🥲? I thought I would just create a USB boot disk, install, and be done! I didn't expect to get stuck at the step of selecting the installation hard disk partition
Sharing my experience, hoping it will be useful to you.(1/4)

[dddong @Jdddong]

4. Still prompted that it couldn't be installed, but the error message changed to "Unable to install... Error code is 0x80300024".
5. Listening to the advice on the internet, I went into BIOS and forced offline all the disks except the one I wanted to install the system on.(3/4)