Tags
Exploiting HackSys Extreme Vulnerable Driver (HEVD) on Windows 7 x86: a kernel stack buffer overflow using token-stealing shellcode, and privilege escalation via a Write-What-Where overwrite of the HalDispatchTable
Read full articleHow to build the Chrome V8 engine source on Windows and Linux
Read full articleStatic reverse engineering of two 32-bit PE binaries identified as Ryuk ransomware (Hermes variant). Covers the dropper/loader and the encryption payload, including persistence, process injection, and VSS deletion behavior.
Read full articleStatic/dynamic analysis of two 32-bit PE binaries — a WinMain-based narrow-down analysis using IDA
Read full articleAn introduction to malware analysis techniques — static/dynamic analysis, malware types, and Windows DLL import analysis
Read full articleAnalysis of an Integer Overflow (SMBGhost) and an uninitialized kernel memory leak (SMBleed) in the SMBv3.1.1 decompression routine, and a Pre-Auth RCE achieved by chaining the two bugs
Read full articleMS17-010 EternalBlue analysis — the SMBv1 buffer overflow exploit used in WannaCry and NotPetya, and a packet-level analysis of the Metasploit module
Read full article