понедельник, 15 марта 2021 г.

ecdsa in driver

›
Lets assume that we have buggy and dangerous driver (which "rely on many unexported functions and select them via pattern scans which a...
2 комментария:
четверг, 18 февраля 2021 г.

poorgcc: IDA Pro plugin to fix poor gcc code on arm64

›
Lets see what generates gcc for arm64 - for example gcc7.5 and linux kernel Function do_sysinstr : ADRP            X0, #__func__.48604@PAGE...
понедельник, 15 февраля 2021 г.

fsm rules for rpcrt4!GlobalRpcServer

›
I already described how you can extract address of GlobalRpcServer and offset to some RPC_SERVER_T fields. Lets do it for arm64 in declarat...
среда, 10 февраля 2021 г.

using FSM to recover struct fields offsets

›
In previous  post I described declarative way to find non-exported data and functions using FSM . But often you also need to know offsets to...
понедельник, 8 февраля 2021 г.

fsm rules syntax

›
I added saving and loading of FSM rules in file - so now you can edit them (or perhaps even write new manually) and then apply with new to...
вторник, 26 января 2021 г.

auto-derived FSM for usermode dlls

›
As expected results of auto-derived FSM for usermode dlls are much worse - for example on rpcrt4.dll can be found only 76 symbols from 228....
понедельник, 25 января 2021 г.

W32pServiceTable from windows 10 build 20292 64bit

›
 It seems that MS cut off whole apfnSimpleCall dispatching - no more functions NtUserCallHwndParamLock NtUserCallHwndParam NtUserCallHwndLoc...