me.c3

[me.c3 @mec314]

the developer helped to solve everything

[me.c3 @mec314]

How to fix the Yara signatures empty field? This tab stopped displaying information for me on any open file.

[Malcat dev @malcat4ever]

Malcat version 0.9.9 is out! Check out the new offline version of Kesakode for blazing-fast (unpacked) #malware identification across 2000+ families.
Also python 3.13 support (& disassembler), new file parsers & improved UI:
https://t.co/wU87EzSARb

[Hex-Rays SA @HexRaysSA]

We are thrilled to announce the winners of the 2024 Hex-Rays Plugin Contest!

🥇1st Place: hrtng
🥈2nd Place: aiDAPal
🥉3rd Place: idalib Rust bindings

Check out our reviews of the winners and other notable submissions here: https://t.co/MDQV6uwBxw
Huge thank you to all participants for their innovative contributions. Your creativity continues to enhance the IDA community.

#HexRays #IDAPro #PluginContest #ReverseEngineering

[Karsten Hahn @struppigel]

My colleagues wrote about unpacking PyArmor V8
#PyArmor
https://t.co/5q6GUMBH85

[Wietze @Wietze]

🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own

🔥 68 executables supported out of the box - use right away, make tweaks, or create your own

👉 Now available at https://t.co/eZbpI08AzP

[Joe Desimone @dez_]

Bypass AMSI by uninitializing the IActiceScript object (zero ptr at 0x3c8). Slightly modified wscript no longer calls into AMSI.

[x86matthew @x86matthew]

I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D

Project:
https://t.co/xJvm24qqXv

[me.c3 @mec314]

@filip_dragovic try for another dir not C:\Config.Msi or with > medium IL

[Duncan Ogilvie 🍍 @mrexodia]

DataExplorer is a plugin for @x64dbg that integrates the pattern language from @WerWolv's ImHex. You can quickly visualize data structures in memory!

[sixtyvividtails @sixtyvividtails]

Small gift for you! 🔺🟦🔺
Code to reliably stop almost any 3rd party Windows security system, via ci!CiValidateFileAsImageType.
No privileges needed at all, user rights are enough. Shall work on most OS: 10 22H2, 11 24H2, WS2022.
But: it requires CI policies (e.g. HVCI/UMCI on).

[hasherezade @hasherezade]

Updated #TinyTracer (v2.9) is out: https://t.co/qvbQqaUq16 ! Now you can trace indirect #syscalls, and dump context before each logged instruction.

[Stephan Berger @malmoeb]

"Raspberry Robin uses an interesting approach to avoid detection while adding registry data.

Rather than modifying the Windows registry directly using common Windows API functions (e.g. RegOpenKey, RegSetValueEx), Raspberry Robin first renames the target registry key to a random one, writes the registry data into the renamed key, and renames it back to its original name.

However, if administrator privileges are available, Raspberry Robin uses a different approach. At first, it renames the registry key, creates an offline registry hive in the Windows temporary directory with a random filename. Then, it writes the registry data in the offline registry hive and loads the offline hive to the global registry tree using ZwRestoreKey."

https://t.co/ruEHK6YQRu

[Eli @elikaski]

I wrote an article about known attacks on Elliptic Curve Cryptography, check it out! https://t.co/hFAatykkxo

[me.c3 @mec314]

@threatactress https://t.co/gu9LAK6aOn lvl9 - serpentine

[me.c3 @mec314]

flareon serpentine.exe ?

[me.c3 @mec314]

@malcat4ever @joe4security does the option require a corporate tariff to the sandbox? no access to dumps on a free communitie account

[sixtyvividtails @sixtyvividtails]

You've coded brilliant fallback codepath for case when menacing 𝐁𝐞𝐞𝐩 EDR is running, but have no rights to check its presence?
EZ check:

isBeepEdrDriverRunning = NtQueryFullAttributesFile(
ObjAttr(L"\\Driver\\Beep"),
NtCurrentTeb()) == STATUS_OBJECT_TYPE_MISMATCH;

[me.c3 @mec314]

@aldityairfan this lvl is crazy

[Nicolas Krassas @Dinosn]

Introducing Early Cascade Injection: from Windows process creation to stealthy injection https://t.co/xoMCN5eo1g

[me.c3 @mec314]

@TriggerMeHappy Stuck on level 5. What should i pay more attention to: the LZMA algorithm, RSA or download symbolic names for some additional libraries?