Xappy

I figured out a generic way to generate those polyglots! Introducing: bppb! github.com/theXappy/bppb This PoC takes 2 files, a bplist and a protobuf, and merges them into one unholy abomination. #bplist #protobuf #polyglot #dfir #digitalforensics

Ever wondered what your modem really says to your SIM card? I sniffed raw APDU traffic off the SIM pins, decoded the UART based on the ATR, and piped it into Wireshark. Full guide: how to wire it, decode it, and see the bytes for yourself. 🔎💥📶 github.com/theXappy/trace…

stuxnet on its way to make some spinny things spin faster

Vessel.exe

Centralized resource for listing and organizing known injection techniques and POCs #malware #dfir github.com/itaymigdal/awe…

After #flareon11 challenge 7, I got inspired to build tooling for #dotnet Native AOT reverse engineering. As such, I built a #Ghidra Analyzer that can automatically recover most .NET types, methods and frozen objects (e.g., strings). Blog:👉blog.washi.dev/posts/recoveri…

"Mark of the Web" sounds way too cool for what it really is

This is a WinAPI meme

Visual Studio is an awesome piece of software 🤯

re-using the malware's baked-in cleanup routine will always be funny to me.

Adding to my ETW research toolkit, a tiny program to consume information from a provider with as little overhead as possible. PockETWatcher, a tool to get the essential information from a ETW provider to the CLI or a JSON file github.com/olafhartong/Po…

Jupyter notebook is actually..... kidna nice for exploit dev 👀

👌🏻 timdbg.com/posts/recogniz…

object oriented programming

Memory Segmentation Cheat Sheet

Or is it Apple delaying patch of actively exploited kernel bugs, as usual