понедельник, 24 августа 2020 г.

IMAGE_LOAD_CONFIG_DIRECTORY from sdk 20190

›
just as illustration to paper about XFG size is 0xB8 for 32 bit and 0x130 for 64 bit
понедельник, 17 августа 2020 г.

etw part 4: _TlgProvider_t in kernel

›
let's continue to dissect ETW (parts 1 , 2 & 3 ) Basically structure _TlgProvider_t in kernel almost the same as in user mode bu...
вторник, 28 июля 2020 г.

etw tracing handles in kernel

›
let's continue to dissect ETW (part 1 & 2 ). This time consider how tracing is implemented in the kernel itself. I made PoC to fin...
пятница, 24 июля 2020 г.

_TlgProvider_t

›
let's continue to dissect ETW and consider one of the many usermode tracing structures - _TlgProvider_t. It is even officially document...
суббота, 11 июля 2020 г.

what`s wrong with Etw

›
Disclaimer:  as I am aware that the given code examples can be dangerous for Etw-based EDR products - all code was made for least popular ve...
вторник, 30 июня 2020 г.

search references in arm64 code

›
Let's assume that you want to find address of non-exported CrashdmpCallTable in kernel. Usual old school way is to find unicode string ...
пятница, 19 июня 2020 г.

sve/sve2 instructions for arm64

›
Today I finished adding of sve/sve2 instructions to my pet-project armpatched I used as reference ISA_A64_xml_futureA-2019-09_OPT.pdf Sure...