weak

19 - Student

[weak @weak1337]

Today I released Alcaztaz - an x64 binary obfuscator featuring:
- Obfuscation of immediate moves
- Control flow flattening
- Mutation / Obfuscation of certain instructions like MOV, ADD, LEA
- Anti disassembly
- Entry point obfuscation

Read more at: https://t.co/UWMkq1Mt9J

[weak @weak1337]

🚀Last week, I got a sneak peek at @BackEngineerLab's latest project! Their demo ran in a bin2bin'd Windows kernel —flawlessly, without any stability issues. For those who know, dealing with exceptions, especially in binary obfuscation is quite a pain. Something to look out for!

[João Vitor(Keowu) @keowu]

My new article using HexRays IDA. to deal with obfuscated code. comercial like VmProtect and OpenSource like Alcatraz:

https://t.co/D64Cut4hfm

[weak @weak1337]

@modexpblog @solardiz This is possible and can be implemented as an alternative way for the pdb lookup (if exceptions are enabled). I will take a look at it.

[weak @weak1337]

Today I released Alcaztaz - an x64 binary obfuscator featuring:
- Obfuscation of immediate moves
- Control flow flattening
- Mutation / Obfuscation of certain instructions like MOV, ADD, LEA
- Anti disassembly
- Entry point obfuscation

Read more at: https://t.co/UWMkq1Mt9J

[weak @weak1337]

@solardiz It does since it relies entirely on the pdb

[weak @weak1337]

@confusedcoder18 @yarden_shafir https://t.co/bMZZ6H7M1P

[weak @weak1337]

@dinqr0 @gynvael @vollragm @OSaltyRoad @vm_call @HexRaysSA Well if they really decided to hold the mutex for the idbs, the cheat devs have to spend quite a bit of time (not just modifying some values in the pe header). However, I don’t see a point of having it open during game runtime anyway.

[weak @weak1337]

@gynvael @vollragm @OSaltyRoad @vm_call @HexRaysSA The goal of an Anti-Cheat is to also stop cheat developers in its tracks. Besides it’s capabilities of decompiling it can also be used as a debugger (which are blocked for obvious reasons).

[weak @weak1337]

@OSaltyRoad @vm_call @HexRaysSA Lots of games close themselves after finding out that IDA is running in the background (which is understandable). Banning for it just doesn’t make sense without any proof of it being attached to the game / having the executable in the history database

[secret club @the_secret_club]

Improving MBA Deobfuscation using Equality Saturation by @fvrmatteo and @mr_phrazer.

https://t.co/JPYwVfrLQW

[weak @weak1337]

https://t.co/ttWMB6gLIa

[VollRagm @vollragm]

Have you ever wondered if it was possible to execute code inside of a drivers .data section? Well, I did.

I created a PoC that abuses Windows' LargePageDrivers feature to copy shellcode into the beep.sys .data section and execute it.

Blog post: https://t.co/pcGVQkDBd8

[weak @weak1337]

Latest reversal of NVIDIAs nvml.dll which allows developers to query DeviceName, UUID and similar values. Communicates directly with NVIDIAs kernel module
https://t.co/bJVkwlzfxy

[weak @weak1337]

Touché

[weak @weak1337]

@_cheatengine Yep doing this since Halo Infinite recently introduced this technique 👍🏻

[weak @weak1337]

Detect @_cheatengine by listening to the global debug output:
https://t.co/GuukBPWTNB

[Pavel Yosifovich @zodiacon]

Finally... Windows Insider Preview WDK build 22557 integrates with VS 2022
https://t.co/ButGtzZ0vd

[weak @weak1337]

@AntiCheatPD @vollragm 😂

[weak @weak1337]

@vollragm No

[weak @weak1337]

@vollragm No