Shakedown Social

1 post1 participant0 posts today

☮ ♥ ♬ 🧑‍💻Day 32 🗳️💨Things are coming in thick and fast today, so I’ll try to summarise the major themes. No Policies of the <a href="https://ioc.exchange/tags/Liberal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Liberal</a>, <a href="https://ioc.exchange/tags/LNP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LNP</a> and <a href="https://ioc.exchange/tags/Coalition" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Coalition</a>. <a href="https://ioc.exchange/tags/AngusTaylor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AngusTaylor</a> (Opposition Treasurer, Liberal) hands in his <a href="https://ioc.exchange/tags/Economics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Economics</a> homework late, it’s got problems. A 🎃 derivative that is toxic ☢️“A Coalition government would drive the <a href="https://ioc.exchange/tags/budget" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#budget</a> deeper into <a href="https://ioc.exchange/tags/deficit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deficit</a> over the coming two years, as the shadow finance minister, <a href="https://ioc.exchange/tags/JaneHume" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JaneHume</a>, insisted her party’s plan to save $17.2bn by <a href="https://ioc.exchange/tags/slashing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#slashing</a> the number of <a href="https://ioc.exchange/tags/Canberra" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Canberra</a>-based <a href="https://ioc.exchange/tags/PublicServants" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PublicServants</a> by 41,000 through “natural attrition” was achievable.”If returned to power, the Coalition would gut a long list of environment and clean energy programs, including <a href="https://ioc.exchange/tags/scrapping" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scrapping</a> the <a href="https://ioc.exchange/tags/NetZero" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NetZero</a> <a href="https://ioc.exchange/tags/Economy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Economy</a> <a href="https://ioc.exchange/tags/Agency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Agency</a>, reversing Labor’s <a href="https://ioc.exchange/tags/TaxBreaks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TaxBreaks</a> for <a href="https://ioc.exchange/tags/ElectricVehicles" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ElectricVehicles</a>, and redirecting money slated for the <a href="https://ioc.exchange/tags/HomeBatteries" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HomeBatteries</a> program.<a href="https://ioc.exchange/tags/Reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Reversing</a> tax incentives for green hydrogen would save $1.5bn over four years, and not proceeding with Labor’s critical mineral production tax credits would save $1.2bn, the Coalition’s election policy costings show.”<a href="https://ioc.exchange/tags/AusPol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AusPol</a> / <a href="https://ioc.exchange/tags/treasury" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#treasury</a> / <a href="https://ioc.exchange/tags/costings" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#costings</a> / <a href="https://ioc.exchange/tags/economy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#economy</a> / <a href="https://ioc.exchange/tags/future" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#future</a> <<a href="https://www.theguardian.com/australia-news/2025/may/01/coalition-costings-federal-election-promises-larger-deficit-cut-foreign-aid-environment-clean-energy" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theguardian.com/australia-news/2025/may/01/coalition-costings-federal-election-promises-larger-deficit-cut-foreign-aid-environment-clean-energy</a>>

Alexandre BorgesDEFCON 33 CTF Write-Up Series #1: jxl4fun2 (pwn):<a href="https://blog.cykor.kr/2025/04/DEFCON-33-Series-jxl4fun-pwn" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.cykor.kr/2025/04/DEFCON-33-Series-jxl4fun-pwn</a>DEFCON 33 CTF Write-Up Series #2: tinii (rev):<a href="https://blog.cykor.kr/2025/04/DEFCON-33-Series-tinii" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.cykor.kr/2025/04/DEFCON-33-Series-tinii</a><a href="https://infosec.exchange/tags/ctf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ctf</a> <a href="https://infosec.exchange/tags/defcon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#defcon</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a>

Volexity :verified:In the course of its investigations, <a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@volexity</a> frequently encounters malware samples written in Golang. This reflects the increase in popularity of the Golang generally, and presents challenges to reverse engineering tools.   Today, <a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@volexity</a> is releasing GoResolver, open-source tooling to help reverse engineers understand obfuscated samples. <a href="https://infosec.exchange/@r00tbsd" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@r00tbsd</a> & Killian Raimbaud presented details at INCYBER Forum earlier today.   GoResolver uses control-flow graph similarity to identify library code in obfuscated code, leaving analysts with only malware functions to analyze. This saves time & speeds up investigations!   Check out the blog post on how GoResolver works and where to download it: <a href="https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/</a>   <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malwareanalysis</a>

Alexandre BorgesHacking the Xbox 360 Hypervisor: 01. Hacking the Xbox 360 Hypervisor Part 1: System Overview: <a href="https://icode4.coffee/?p=1047" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icode4.coffee/?p=1047</a>02. Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit: <a href="https://icode4.coffee/?p=1081" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icode4.coffee/?p=1081</a><a href="https://mastodon.social/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://mastodon.social/tags/exploit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exploit</a> <a href="https://mastodon.social/tags/exploitation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exploitation</a> <a href="https://mastodon.social/tags/xbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#xbox</a> <a href="https://mastodon.social/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://mastodon.social/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#informationsecurity</a> <a href="https://mastodon.social/tags/hardware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hardware</a> <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.social/tags/hypervisor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hypervisor</a>

Alexandre BorgesHacking the Xbox 360 Hypervisor: 01. Hacking the Xbox 360 Hypervisor Part 1: System Overview: <a href="https://icode4.coffee/?p=1047" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icode4.coffee/?p=1047</a>02. Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit: <a href="https://icode4.coffee/?p=1081" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icode4.coffee/?p=1081</a><a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/exploit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exploit</a> <a href="https://infosec.exchange/tags/exploitation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exploitation</a> <a href="https://infosec.exchange/tags/xbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#xbox</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#informationsecurity</a> <a href="https://infosec.exchange/tags/hardware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hardware</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/hypervisor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hypervisor</a>

LobstersHacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit <a href="https://lobste.rs/s/6wj9mi" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lobste.rs/s/6wj9mi</a> <a href="https://mastodon.social/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://icode4.coffee/?p=1081" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icode4.coffee/?p=1081</a>

Rairii :win3_progman: :win3: a discord guild i was in got some malspam (link to reddit post which linked to malware present on compromised wordpress site sexccessories.co[.]ke)Funnily enough, there were supposedly both windows and mac samples present, except they fucked up with the mac one, a passworded zip containing a “dmg” which is actually the following text:<pre><code>Build failed: failed to create DMG: exit status 64 Output: Creating disk image... Mounting disk image... Device name: /dev/disk4 Searching for mounted interstitial disk image using /dev/disk4s... Mount dir: /Volumes/dmg.kfA109 Copying background file '/tmp/8aAwS.png'... Copying volume icon file '/Users/user/desktop/TradingView_3760.icns'... Will sleep for 2 seconds to workaround occasions "Can't get disk (-1728)" issues... Running AppleScript to make Finder stuff pretty: /usr/bin/osascript "/var/folders/1p/6ssndcmx4j7_gb_c2_0cdklm0000gn/T/createdmg.tmp.XXXXXXXXXX.dIQPQTlFZk" "dmg.kfA109" /var/folders/1p/6ssndcmx4j7_gb_c2_0cdklm0000gn/T/createdmg.tmp.XXXXXXXXXX.dIQPQTlFZk:85:89: execution error: Finder got an error: Can’t get disk "dmg.kfA109". (-1728) Failed running AppleScript Unmounting disk image... "disk4" ejected. </code></pre>I predicted it would be a packed stealer of some description. I was right, unpacked binary is lumma stealer.Been a while since I’ve done manual unpacking of a malware sample, this one was fun. The packer is the same as described here <a href="https://alertoverload.com/posts/2025/01/remcos-v5.3.0/" rel="nofollow noopener noreferrer" target="_blank">https://alertoverload.com/posts/2025/01/remcos-v5.3.0/</a>Original zipfile has the hash <code>85a2619c5bc5ae10d9ab3aab48c364b638d7b835d169f651b08c1f0282c39d58</code>.The original binary was ~800MB, padded with garbage. Removing that padding yields a binary with the hash <code>d0e956e5fe825e8f2817ce660d3680294d790cf1baec0bdfdc540841e7202c80</code> - and manually unpacking that gives <code>bbd1e2cc95f1907d4c8c92d66bc62f43aa3e5634af6bdb947dfd826023195253</code>.There’s also a bunch of additional stuff in the zip alongside the malware sample; copied straight from a windows installation, and the way it was copied in revealed the localisation installed on that system, which is unsurprisingly Russian (Russia) [<code>ru-RU</code>].<a class="hashtag" href="https://labyrinth.zone/tag/malware" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a class="hashtag" href="https://labyrinth.zone/tag/reversing" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a class="hashtag" href="https://labyrinth.zone/tag/infosec" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

MottGPoC GTFO Vol. II by Manul Laphroaig is a wonderful compilation of articles from Proof of Concept or Get The Fuck Out zine articles on hacking, reverse engineering, etc. It has a great article on reverse engineering the Tytera MD380 digital hand-held radio. It has some cool stuff on reversing LoRa and spectrograms also. The illustrations are wonderful. You can read articles from all 3 volumes of PoC GTFO at: <a href="https://github.com/angea/pocorgtfo" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/angea/pocorgtfo</a><a href="https://researchbuzz.masto.host/tags/hamRadio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hamRadio</a> <a href="https://researchbuzz.masto.host/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://researchbuzz.masto.host/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a>

Shawn WebbIDA Pro is moving to a subscription model on 30 Sep 2024.NOW is the time to obtain or renew your perpetual (non-subscription) license.IDA Pro 8.x will be the last non-subscription version.<a href="https://bsd.network/tags/IDAPro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IDAPro</a> <a href="https://bsd.network/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://bsd.network/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Adam Van HineMe and my homie Joe have been working on <a href="https://hachyderm.io/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> an IoT gateway he has that is used to control his blinds. The ultimate goal is to get a shell on it. We started by decompiling the Android app.We were able to figure out the API of the gateway just from strings in the app. Since the code was unobfuscated we could really easily see how they were forming their requests to the API.Later we found out that some of the <a href="https://hachyderm.io/tags/homeassistant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#homeassistant</a> folks had done a bunch of this already :P

Alexandre DulaunoyPretty and nifty nice tool and format to describe and visualize binary files/format by Corkami (Ange Albertini) <a href="http://corkami.github.io/sbud/hexii.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">http://corkami.github.io/sbud/hexii.html</a>The output is in SVG format.Presentation at <a href="https://infosec.exchange/@hack_lu" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hack_lu</a> cti summit<a href="https://infosec.exchange/tags/infovis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infovis</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/visualization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#visualization</a>

Vissi have a <a href="https://mastodon.social/tags/mobile" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mobile</a> <a href="https://mastodon.social/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#android</a> <a href="https://mastodon.social/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> question. lets say i have an apk. i want to fetch all the dns names in it that are being used for API calls. Are there tools that make that easy, or are we still talking about 'decompile the apk and manually go through all the code by hand'?

Davide Eynard (+mala)Hi everyone! Six more months passed since my last <a href="https://fosstodon.org/tags/introduction" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#introduction</a>, so here is an updated one:AKA: +mala, AiTTaLaMJob: Doin’ trustworthy <a href="https://fosstodon.org/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> @ moz://a.ai - more generally I love <a href="https://fosstodon.org/tags/teaching" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#teaching</a>, no matter if to humans or machines :-)Projects: 3564020356.org is the oldest (~22yrs 😅), <a href="https://fosstodon.org/tags/PicoGopher" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PicoGopher</a> the most recent... Look around and find the rest! 😜Interests: <a href="https://fosstodon.org/tags/bouldering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bouldering</a> <a href="https://fosstodon.org/tags/gopher" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gopher</a> <a href="https://fosstodon.org/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SelfHosting</a> <a href="https://fosstodon.org/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://fosstodon.org/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://fosstodon.org/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a> <a href="https://fosstodon.org/tags/recsys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#recsys</a> <a href="https://fosstodon.org/tags/ML" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ML</a> <a href="https://fosstodon.org/tags/solarpunk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#solarpunk</a> <a href="https://fosstodon.org/tags/CommunitiesOfExperience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CommunitiesOfExperience</a>

Cindʎ Xiao 🍉The Rust Windows kernel GDI code also has symbols for <code>fallible_vec::FallibleVec<T,A></code> , which looks like a non-panicking <code>Vec</code> implementation. <code>try_extend</code>, <code>try_extend_from_slice</code>, <code>try_splice_in</code>, and <code>try_insert</code> are all implemented.In fact it looks suspiciously similar to the <code>rust_fallible_vec</code> crate, which Microsoft recently open-sourced: <a href="https://github.com/microsoft/rust_fallible_vec" rel="nofollow noopener noreferrer" target="_blank">https://github.com/microsoft/rust_fallible_vec</a> :thonking: ( <a href="https://hachyderm.io/@TehPenguin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@TehPenguin</a> 👋 )The methods are generic over the allocator type <code>A</code>; some of these <code>FallibleVec</code> method implementations use the registered global allocator <code>gdi_alloc::Win32Allocator</code> , and others use the <code>gdi_alloc::TaggedAllocator</code> with the GDI-specific pool tags.<a href="https://infosec.exchange/tags/rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rust</a> <a href="https://infosec.exchange/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> <a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://infosec.exchange/tags/microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoft</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a>

Cindʎ Xiao 🍉For the specific GDI objects, there are still allocations made with the existing GDI-specific pool tags.It looks like the <code>rgncore::scan::ScanBuilder<gdi_alloc::TaggedAllocator<_>></code> object uses the existing GDI pool tag <code>Gscn</code> ( i.e. <code>GDITAG_SCAN_ARRAY</code>) for vector allocations. (Probably <code>gdi_alloc::TaggedAllocator<_></code> requires specifying a pool tag)I also see <code>Gedg</code> (i.e. <code>GDITAG_EDGE</code>) being used in <code>gdi_rust::region::from_path::GlobalEdgeTable::add_edge</code>, and <code>gdi_rust::region::from_path::ActiveEdgeTable::new</code> , among other places.<a href="https://infosec.exchange/tags/rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rust</a> <a href="https://infosec.exchange/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> <a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://infosec.exchange/tags/microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoft</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a>

Cindʎ Xiao 🍉In the new Rust Windows kernel GDI code, there is a new global allocator registered named <code>gdi_alloc::Win32Allocator</code> . It calls <code>Win32AllocPool</code> with a fun new pool tag name, "Rust"!<a href="https://infosec.exchange/tags/rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rust</a> <a href="https://infosec.exchange/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> <a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://infosec.exchange/tags/microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoft</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a>

Cindʎ Xiao 🍉For the new Windows kernel Rust GDI stuff that is all the rage now (win32kbase_rs.sys, win32kfull_rs.sys): here are the links to download copies of those binaries, from the Microsoft Symbol Server:<a href="https://msdl.microsoft.com/download/symbols/win32kbase_rs.sys/272C4A031b000/win32kbase_rs.sys" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://msdl.microsoft.com/download/symbols/win32kbase_rs.sys/272C4A031b000/win32kbase_rs.sys</a><a href="https://msdl.microsoft.com/download/symbols/win32kfull_rs.sys/8264C482a000/win32kfull_rs.sys" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://msdl.microsoft.com/download/symbols/win32kfull_rs.sys/8264C482a000/win32kfull_rs.sys</a>These should be the versions that are in Windows 11 Insider Preview 25357.1 (zn_release) amd64 . The SHA-256 hashes are: 87ee0235caf2c97384581e74e525756794fa91b666eaacc955fc7859f540430d win32kbase_rs.sys 2efb9ea4032b3dfe7bf7698bd35e3ea3817d52f4d9a063b966f408e196957208 win32kfull_rs.sys(I first extracted these files myself from the update package for build 25357.1, then generated the symbol server download URLs from the PE metadata in the files)Of course, in addition to the actual executables, symbols are available from the symbol server as well (see screenshot).<a href="https://tech.lgbt/@analog_feelings" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@analog_feelings</a> already did some reversing of win32kbase_rs.sys several weeks ago, here: <a href="https://tech.lgbt/@analog_feelings/110232321999960466" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://tech.lgbt/@analog_feelings/110232321999960466</a> 🤘Now, time for me to go figure out how to actually reverse Rust 🦀<a href="https://infosec.exchange/tags/rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rust</a> <a href="https://infosec.exchange/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> <a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a> <a href="https://infosec.exchange/tags/microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoft</a>

beSpacific<a href="https://newsie.social/tags/FDA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FDA</a> approves <a href="https://newsie.social/tags/overdose" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#overdose</a> <a href="https://newsie.social/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://newsie.social/tags/Narcan" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Narcan</a> for sale without <a href="https://newsie.social/tags/prescription" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#prescription</a>. Move seen as a key strategy to control the US <a href="https://newsie.social/tags/overdose" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#overdose</a> <a href="https://newsie.social/tags/crisis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#crisis</a>, which has been linked to more than 100,000 deaths a year <a href="https://www.fda.gov/news-events/press-announcements/fda-approves-first-over-counter-naloxone-nasal-spray" rel="nofollow noopener noreferrer" target="_blank">https://www.fda.gov/news-events/press-announcements/fda-approves-first-over-counter-naloxone-nasal-spray</a> <a href="https://newsie.social/tags/OTC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTC</a> <a href="https://newsie.social/tags/naloxone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#naloxone</a> <a href="https://newsie.social/tags/opiod" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opiod</a> <a href="https://newsie.social/tags/overdoses" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#overdoses</a>

WashiWhat really is the entry point of a <a href="https://infosec.exchange/tags/dotnet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dotnet</a> application? Is it `public static void Main()`, or are there other places that we should look at when reverse engineering .NET samples?👉Read about it in my new blog post: <a href="https://washi.dev/blog/posts/entry-points/" rel="nofollow noopener noreferrer" target="_blank">https://washi.dev/blog/posts/entry-points/</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

too many namesShort and enjoyable <a href="https://hachyderm.io/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> read I was introduced to today:> Reverse Engineering A Mysterious UDP Stream in My Hotel<a href="https://www.gkbrk.com/2016/05/hotel-music/" rel="nofollow noopener noreferrer" target="_blank">https://www.gkbrk.com/2016/05/hotel-music/</a>

Recent searches

Search options

Administered by:

Server stats:

#reversing