memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

ifuncd-up

Hacker News에 대한 답변으로... 주황색 웹사이트hn의 장난꾼들이 나를 괴롭히고 있는 것 같군요. 아래에 몇 가지 엄선된 답변을 준비했지만, 먼저 도전장을 내겠습니다: ifunc 없이 이 공격 을 시연할 수 있는 첫 번째 사람에게 제 돈 500달러 를 보내겠습니다. 진심으로 흥미롭고, 깨달음을 얻기 위해 기꺼이 지불할 의향이 있습니다. 이 저장소를 포크하고 작동하는 PoC와 함께 PR을 제출하세요. 승리하면 개인적으로 우편 주소를 요청하겠습니다. 이제 답변입니다: 이건 잘못된 나무를 짖는 격이다. 이보게, 나는 잘못된...

ShellcodeFluctuation

Shellcode Fluctuation PoC 셸코드의 내용을 주기적으로 암호화하고 복호화하여 RW또는 NoAccess와 RX 메모리 보호 상태 사이를 오가도록 만드는 또 다른 인메모리 회피 기법의 PoC 구현체입니다. 셸코드가 RW 또는 NoAccess 메모리 페이지에 상주하면 Moneta나 pe-sieve 같은 스캐너가 이를 추적하거나 덤프하여 분석할 수 없게 됩니다. Intro ThreadStackSpoofer를 릴리스한 후 README의 다음 항목에 대한 질문을 몇 가지 받았습니다. 슬립 전에 Beacon의 메모리 페이...

NovaHypervisor

NovaHypervisor 설명 NovaHypervisor는 방어적인 x64 Intel 호스트 기반 하이퍼바이저입니다. 이 프로젝트의 목표는 방어 제품AntiVirus/Endpoint Protection과 커널 메모리 구조를 보호하고 커널 메모리에 대한 무단 액세스를 방지하여 커널 기반 공격자체 취약 드라이버BYOVD 또는 기타 수단을 통한으로부터 보호하는 것입니다. NovaHypervisor는 C++와 어셈블리로 작성되었으며, Windows 10 이상에서 실행되도록 설계되었습니다. 사용 방법에 대한 자세한 내용은 설정 섹션을...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. 네이티브 API 및 APC 인젝션 x64dbg 메모리 덤프는 Agent Tesla가 하위 레벨 작업을 위해 네이티브 APINT API 호출을 사용하며, APC비동기 프로시저 호출 인젝션 을 포함함을 보여줍니다. 관찰된 주요 함수: NtQueueApcThread – APC를 통해 대상 스레드에 코드를 주입합니다. NtReadVirtualMemory – 다른 프로세스의 메모리를 읽습니다. NtQuerySystemInformation – 시스템 정보를 수집합니다. NtCreateThreadEx 있을 가능성 높음 – 실행을 위한...

HeapCrypt

HeapCrypt Sleep을 후킹하고 힙을 암호화한 후 잠시 대기했다가 힙을 복호화하는 자체 함수로 Sleep을 수정하여, 잠자는 동안 힙을 암호화합니다: 16bit key xor heap encryption : 16bit key xor heap decryption : 참고 자료 : https://www.arashparsa.com/hook-heaps-and-live-free/...

USN-8871-1 linux-raspi vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86: Added SRCU protection for reading PDPTRs in getsregs2. Added read-side protection when reading PDPTR registers in getsregs2. Reading PDPTRs may trigger access to guest memory: kvmpdptrread - svmcachereg - loadpdptrs ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: The risk of out-of-memory access has been prevented. The dvbdev module contains a static variable used to store dvb minors. Its behavior depends on whether CONFIGDVBDYNAMICMINORS is set or not. When it is not set,...

cve-writeups-and-pocs

CVE-2026-80724 PoC 및 분석 문서 CVE-2026-80724 — Linux 커널 ptp: vmclock: 읽기 전용 매핑이 쓰기 가능해지는 문제 방지 전체 PoC개념 증명 + 기술 분석 문서 Abdifatah Suruursuruur의 보안 연구 — 독자적으로 발견한 취약점에 대한 CVE 분석 문서 및 PoC 모음. CVE ID : CVE-2026-80724 심각도 : 8.8높음 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 구성 요소 : Linux 커널...

CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

DEBIAN-CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

UBUNTU-CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

EUVD-2026-90133

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

CVE-2026-47591

The NVIDIA GPU Display Driver for Linux contains a vulnerability in its kernel mode layer . Due to incorrect authorization, an unprivileged user can bypass read-only memory protection to gain write access to memory marked as read-only. Successful exploitation could result in code execution , deni...

CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

CVE-2026-47591

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...

USN-8849-1 linux-nvidia-tegra-5.15 vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...