MemITM

ما هي أداة MemITM؟ تم تطوير أداة MemITM Mem In The Middle لتسهيل اعتراض "الرسائل" في ذاكرة عمليات Windows. قمنا بتطوير العديد من أدوات اعتراض الذاكرة المخصصة لالتقاط رسائل الشبكة قبل التشفير، أو رسائل IPC، ولتتمكن من فحصها أو تعديلها لإجراء اختبارات التطفير fuzzing. كانت كل أداة مخصصة حقًا، وليست...

idahunt

Aperçu Prérequis Fonctionnalités Scripts Utilisation Simuler sans exécuter Analyse initiale Exécuter un script IDA Python Diff de binaires Prérequis Analyse initiale Diff de fichiers Diff d'une fonction Filtres Détection d'architecture Spécifique à une cible Projets connus utilisant idahunt Aperç...

ntoskrnl-metadata

ntoskrnl-metadata Windows ntoskrnl.exe 이진 파일에서 중요 커널 메타데이터를 추출하기 위한 IDA Python 스크립트입니다. 이 도구는 CVE-2026-40369 및 기타 커널 취약점을 대상으로 하는 익스플로잇 개발에 필요한 함수 RVA와 EPROCESS 구조체 오프셋을 자동으로 추출합니다. 목적 이 도구는 익스플로잇 페이로드에 하드코딩해야 하는 버전별 커널 메타데이터를 자동으로 추출하여 CVE-2026-40369 에 대한 성공적인 익스플로잇을 컴파일하는 데 도움을 줍니다. 추출된 값은 다양한...

astaroth-deobfuscator

astaroth-deobfuscator Script Python d'IDA pour désobfusquer la DLL injecteur Astaroth/Guildma En essayant d'analyser la DLL injecteur d'une récente campagne Astaroth/Guildma grâce à ce journal du SANS ISC, je suis tombé sur une tentative d'obfuscation vraiment agaçante. Une fonction que j'ai nomm...

KPOT-string-decrypter

KPOT-string-decrypter Scripts Python pour IDA permettant de déchiffrer les chaînes du voleur stealer KPOT et de les définir comme commentaires à côté de la variable qui les recevra lors de l'exécution. Fonctionnement : Récupère l'offset passé dans eax à l'une ou l'autre fonction de déchiffrement ...

Karta - Source Code Assisted Fast Binary Matching Plugin For IDA

"Karta" Russian for "Map" is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries 200,000 functions, with almost no impact on the overall performance. The matching algorithm is...

MemITM - Tool To Make In Memory Man In The Middle

The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them ...

Memory Man in the Middle: MemITM

The MemITM Mem In The Middle tool has been developed in order to easily intercept “messages” in Windows processes memory. We developed a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them to...

TPLINK TLWR740N路由器远程代码执行漏洞(CVE-2017-13772)

INTRODUCTION In October of 2017 we disclosed multiple vulnerabilities in TP-Link’s WR940n router that occurred due to multiple code paths calling strcpy on user controllable unsanitised input CVE-2017-13772 The httpd binary responsible for these vulnerabilities contained patterns of code that...

Malware monitor - leveraging PyREBox for malware analysis

This post was authored by Xabier Ugarte Pedrero In July 2017 we released PyREBox, a Python Scriptable Reverse Engineering Sandbox as an open source tool. This project is part of our continuous effort to create new tools to improve our workflows. PyREBox is a versatile instrumentation framework...