Samuel Tulach

web:

[Samuel Tulach @tulachsam]

Protecting processes PML4 address using a global kernel exception hook. Does not trigger PatchGuard and is compatible with HVCI.

Bit unstable, does not handle any edge cases at all, just wanted to experiment with it a little.

https://t.co/SzFA5kBUHa

[Samuel Tulach @tulachsam]

Trying to implement "cr3 shuffling" used by some anticheats. Spend last 4 days going back and fourth between IDA and WinDbg.

It works already, but after a while the system crashes :/

[Samuel Tulach @tulachsam]

@kernullist Being verified doesn’t help much, it just turns into more generic refusal message without mention of “cyber content”.

[Samuel Tulach @tulachsam]

@ken_chung ist es in deutschland nicht illegal, keinen zu haben?

[Samuel Tulach @tulachsam]

Do you know how to press F5 in IDA, some C/C++ and system internals?

Come work with our team. We are hiring.

[Samuel Tulach @tulachsam]

@MERGE_EGO Let’s say you can get a company bike

[Samuel Tulach @tulachsam]

@karollooool I don’t know a single good anticheat person who would not be an ex-cheat dev.

It would be preferable to have some other work experience though, since that makes you more trustworthy. Also, obviously, you cannot be working on cheats anymore (unless for internal testing ofc).

[Samuel Tulach @tulachsam]

@TwoHumpChump I've played around with automated pipelines using LLMs for reversing and honestly if the entirety of the job was just analyzing samples, then it could be almost fully automated.

With that said, we've got Claude too and if we could just prompt it, we would not need new hire :)

[Samuel Tulach @tulachsam]

@MrShadow_CPP I also wasn't in Germany, there is relocation support provided, but if you are outside of the EU it might be a bit painful due to visa issues.

[Samuel Tulach @tulachsam]

@spookythyscary Primary team location is in Düsseldorf and while I can't promise anything, we used to have people working from Montreal as well, so exceptions could be made.

[Samuel Tulach @tulachsam]

https://t.co/xSJ3kJZkjY

[Samuel Tulach @tulachsam]

@crvvdev @ogisadaDMA Underpaid compared to other security positions? Maybe. Doing a P2C on the side? That would be a career suicide. If anyone figures, you are not getting hired in any remotely serious company ever.

[Samuel Tulach @tulachsam]

@daaximus I might be out of the loop but I thought RE CTFs were free-for-all (except solution sharing) most of the time, and if LLMs get you to the result, doesn’t that just mean CTFs need to level up?

I am pretty sure LLMs can’t write VMP devirt (yet).

[Samuel Tulach @tulachsam]

@crvvdev You don’t have to even directly ask about something. OpenAI models have so aggressive filtering you can have IDA MCP running, it will find cheat related strings and it will refuse to continue because “reversing a cheat might help you recreate it” 🤦‍♂️

[Samuel Tulach @tulachsam]

@s4dbrd .be0 is in fact VMProtect section, as VMProtect allows you to change what section name to use and its definitely not decrypted at runtime as that would break compatibility with kernel code integrity checks…

[Samuel Tulach @tulachsam]

>download codex
>try it out with first prompt ever
>immediately fails
maybe they should use codex to fix codex idk

[Samuel Tulach @tulachsam]

@virustotal Another weird thing is that I was checking the rating few months ago, and it had more ratings (even positive). Might be VT removing entries from obvious bots/spam? (3/3)

[Samuel Tulach @tulachsam]

I had to already file false positive reports to several EDRs so they would stop blocking my website.

I have a really bad feeling they just leech off the community rating on @virustotal, because for some reason my site is bombarded with bogus negative ratings. (1/2)

[Samuel Tulach @tulachsam]

@virustotal From what I've checked, other people's blogs don't have this issue, so I am kind of wondering why my site specifically. It's a static blog hosted on GitHub pages. There are sites writing about literal malware development having no issues what so ever... (2/3)

[Samuel Tulach @tulachsam]

@psifertex It's not, but for testing I mostly use those two libraries (compiled with MSVC):
- https://t.co/mCD1qPnPIJ (both AVX and SSE)
- https://t.co/l7EcYlqr8C

[Samuel Tulach @tulachsam]

Pushed yet another small update to unxorer, this time improving performance by a bit (std::move skill issue)

[Samuel Tulach @tulachsam]

Submitted it to the official Hex-Rays plugins list as well. I hope they will eventually allow you to download and install plugins automatically from within IDA itself.