NullSection

NullSection NullSection 是一款反逆向工具，它采用一种技术将节头覆盖为空字节。 安装 git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection 优势 在任何 ELF 文件（例如 .ko rootkit）上运行 nullsection 后，如果你使用 Ghidra/IDA 来解析 ELF 函数，将不会显示任何内容——反编译器中不会有可解析的函数。即便你运行 readelf -S...

winlow

Windows Internals & Exploitation A concise, practical referen...

NullSection - An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes

NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running nullsection on any ELF, it could ...

Targeted Malware Reverse Engineering Workshop follow-up. Part 2

If you have read our previous blogpost "Targeted Malware Reverse Engineering Workshop follow-up. Part 1", you probably know about the webinar we conducted on April 8, 2021, with Kaspersky GReATs Ivan Kwiatkowski and Denis Legezo, to share best practices in reverse engineering and demonstrate...