Leony

Vulnerability Researcher

[Leony @leonyson]

@TruKno_cyber What’s Ransomware hash?

[Leony @leonyson]

KISA recently released decryptor tool for victims of #rhysida #ransomware. @CISACyber @CISAgov @FBI https://t.co/ZllLnjT8EV

[Leony @leonyson]

Figure out that AFL use the branch hit count for calculating coverage. It’s really novel idea.

[Leony @leonyson]

Windows CVE-2020-1034 LPE Exploit

[Leony @leonyson]

Made it. My #AFL can fuzz command-line arguments on binary mode. Let’s fuzz it.

[Leony @leonyson]

RF Signal CTF Challenge write-up
https://t.co/3fy503W7ig

[Leony @leonyson]

This result in a single library file being split into more multiple memory region for the purpose.

[Leony @leonyson]

AArch64 support XOM(eXecute-Only-Memory) which block leaking code region. Memory map Like —x https://t.co/nww3rIoWoJ

[Leony @leonyson]

Anyway, The mutation algorithm of AFL fuzzer is optimized for file input. This is because the first funtion is bitflip.

[Leony @leonyson]

AFL_PRELOAD is useful environment value when fuzzing command-line binary on qemu mode.

[Leony @leonyson]

If an error occurs while compiling qemu for #AFL, Check it out this.
https://t.co/WhUB3Ro3K5

[Leony @leonyson]

Enforcing Type confusion in memory also uses ie vbscript #exploitation case.
Depending on what target memory can be manipulated, the reliability of the exploit increases. good blog post for iOS example.
https://t.co/eGIhqiOVhE

[Leony @leonyson]

The recently released #Radare2 looks like more accuratly identify between start and end address of a functions now.
https://t.co/HpTmbZyqN9

[Leony @leonyson]

Some Linux binary has a extra space at the end of function. #radare2 is rarely unable to identify the end of function when processing disassembly.

[Leony @leonyson]

Memory allocator of android 11 fully moved over to scudo. heap is getting hardening.

[Leony @leonyson]

If a file viewer/editor program adds an exploit mitigation(aslr,dep), the attempts to find memory corruption are significantly lower. Even through it is exploited, exploit is typically less reliable. There are few elements that can make a memory leak.

[Leony @leonyson]

Broken phishing email accidentally reveal 0-day as well.
https://t.co/TQ9tGXpQmn

[Leony @leonyson]

Sometimes pin tool can't find end of routine during static analysis as rtn callback. So They suggest analysing rtn at runtime.

[Leony @leonyson]

When intel #pintool disassemble xor ax, ax it returns weird value. The result is data16 nop.

[Leony @leonyson]

Arbitrary R/W comes from not only vulnerability ifself but also exploit primitives.