Protecting processes PML4 address using a global kernel exception hook. Does not trigger PatchGuard and is compatible with HVCI.
Bit unstable, does not handle any edge cases at all, just wanted to experiment with it a little.
https://t.co/SzFA5kBUHa
Trying to implement "cr3 shuffling" used by some anticheats. Spend last 4 days going back and fourth between IDA and WinDbg.
It works already, but after a while the system crashes :/
@karollooool I don’t know a single good anticheat person who would not be an ex-cheat dev.
It would be preferable to have some other work experience though, since that makes you more trustworthy. Also, obviously, you cannot be working on cheats anymore (unless for internal testing ofc).
@TwoHumpChump I've played around with automated pipelines using LLMs for reversing and honestly if the entirety of the job was just analyzing samples, then it could be almost fully automated.
With that said, we've got Claude too and if we could just prompt it, we would not need new hire :)
@MrShadow_CPP I also wasn't in Germany, there is relocation support provided, but if you are outside of the EU it might be a bit painful due to visa issues.
@spookythyscary Primary team location is in Düsseldorf and while I can't promise anything, we used to have people working from Montreal as well, so exceptions could be made.
@crvvdev@ogisadaDMA Underpaid compared to other security positions? Maybe. Doing a P2C on the side? That would be a career suicide. If anyone figures, you are not getting hired in any remotely serious company ever.
@daaximus I might be out of the loop but I thought RE CTFs were free-for-all (except solution sharing) most of the time, and if LLMs get you to the result, doesn’t that just mean CTFs need to level up?
I am pretty sure LLMs can’t write VMP devirt (yet).
@crvvdev You don’t have to even directly ask about something. OpenAI models have so aggressive filtering you can have IDA MCP running, it will find cheat related strings and it will refuse to continue because “reversing a cheat might help you recreate it” 🤦♂️
@s4dbrd .be0 is in fact VMProtect section, as VMProtect allows you to change what section name to use and its definitely not decrypted at runtime as that would break compatibility with kernel code integrity checks…
@virustotal Another weird thing is that I was checking the rating few months ago, and it had more ratings (even positive). Might be VT removing entries from obvious bots/spam? (3/3)
I had to already file false positive reports to several EDRs so they would stop blocking my website.
I have a really bad feeling they just leech off the community rating on @virustotal, because for some reason my site is bombarded with bogus negative ratings. (1/2)
@virustotal From what I've checked, other people's blogs don't have this issue, so I am kind of wondering why my site specifically. It's a static blog hosted on GitHub pages. There are sites writing about literal malware development having no issues what so ever... (2/3)
@psifertex It's not, but for testing I mostly use those two libraries (compiled with MSVC):
- https://t.co/mCD1qPnPIJ (both AVX and SSE)
- https://t.co/l7EcYlqr8C
Submitted it to the official Hex-Rays plugins list as well. I hope they will eventually allow you to download and install plugins automatically from within IDA itself.