Malcat version 0.9.9 is out! Check out the new offline version of Kesakode for blazing-fast (unpacked) #malware identification across 2000+ families.
Also python 3.13 support (& disassembler), new file parsers & improved UI:
https://t.co/wU87EzSARb
We are thrilled to announce the winners of the 2024 Hex-Rays Plugin Contest!
🥇1st Place: hrtng
🥈2nd Place: aiDAPal
🥉3rd Place: idalib Rust bindings
Check out our reviews of the winners and other notable submissions here: https://t.co/MDQV6uwBxw
Huge thank you to all participants for their innovative contributions. Your creativity continues to enhance the IDA community.
#HexRays #IDAPro #PluginContest #ReverseEngineering
🚀 Today I'm launching ArgFuscator: an open-source platform documenting command-line obfuscation tricks AND letting you generate your own
🔥 68 executables supported out of the box - use right away, make tweaks, or create your own
👉 Now available at https://t.co/eZbpI08AzP
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D
Project:
https://t.co/xJvm24qqXv
Small gift for you! 🔺🟦🔺
Code to reliably stop almost any 3rd party Windows security system, via ci!CiValidateFileAsImageType.
No privileges needed at all, user rights are enough. Shall work on most OS: 10 22H2, 11 24H2, WS2022.
But: it requires CI policies (e.g. HVCI/UMCI on).
"Raspberry Robin uses an interesting approach to avoid detection while adding registry data.
Rather than modifying the Windows registry directly using common Windows API functions (e.g. RegOpenKey, RegSetValueEx), Raspberry Robin first renames the target registry key to a random one, writes the registry data into the renamed key, and renames it back to its original name.
However, if administrator privileges are available, Raspberry Robin uses a different approach. At first, it renames the registry key, creates an offline registry hive in the Windows temporary directory with a random filename. Then, it writes the registry data in the offline registry hive and loads the offline hive to the global registry tree using ZwRestoreKey."
https://t.co/ruEHK6YQRu
You've coded brilliant fallback codepath for case when menacing 𝐁𝐞𝐞𝐩 EDR is running, but have no rights to check its presence?
EZ check:
isBeepEdrDriverRunning = NtQueryFullAttributesFile(
ObjAttr(L"\\Driver\\Beep"),
NtCurrentTeb()) == STATUS_OBJECT_TYPE_MISMATCH;
@TriggerMeHappy Stuck on level 5. What should i pay more attention to: the LZMA algorithm, RSA or download symbolic names for some additional libraries?