вторник, 30 июня 2020 г.

search references in arm64 code

›
Let's assume that you want to find address of non-exported CrashdmpCallTable in kernel. Usual old school way is to find unicode string ...
пятница, 19 июня 2020 г.

sve/sve2 instructions for arm64

›
Today I finished adding of sve/sve2 instructions to my pet-project armpatched I used as reference ISA_A64_xml_futureA-2019-09_OPT.pdf Sure...
пятница, 12 июня 2020 г.

arm64 pc-relative literals

›
Lets see for example non-exported function function SepInitializeCodeIntegrity from arm64 kernel:   STP             X19, X20, [SP,#-0x20+va...
вторник, 9 июня 2020 г.

undocumented env vars in mscorwks.dll

›
There are lots of env vars with prefix COMPlus_ So lets see only not presented in this document Main function constructing name of env v...
понедельник, 8 июня 2020 г.

COMPlus_ETWEnabled

›
There is nice trick to hide that your .NET assemblies does not have ETW logging Lets see if we can detect this not from environment vars ...
четверг, 21 мая 2020 г.

kernel pte in windows 10 64bit

›
Quarantine is a good time to re-read some old but useful papers and check if you can catch trick with making KUSER_SHARED_DATA writable aga...
1 комментарий:
вторник, 5 мая 2020 г.

afd endpoints owner

›
Alex and Yarden as usually made perfect work to bypass even paranoid EDRs The main problem is detection of duplicated sockets. There is a ...