VMProtect-devirtualization

VMProtect 脱仮想化 VMProtect 3.x によって保護された純粋関数を脱仮想化するための 実験的な 動的アプローチ TL;DR はじめに アプローチ 例1: 保護された単純なビット演算 例2: 保護されたMBA演算 例3: 複数の基本ブロック 結論と制限 参考文献 TL;DR VMProtect によって保護された純粋関数を脱仮想化する動的アプローチに関するメモを共有します。 このアプローチは、仮想化された関数が単一の基本ブロックのみを含む場合に非常に良い結果を示します （サイズに関係ありません）。これは、バイナリが算術演算を保護するときによくあるシナリオです。ただし、...

Pishi

Pishi Pishi 是一个静态二进制重写工具，旨在对 XNU 内核和任意 macOS 内核扩展（kext）中的 basic blocks 进行插桩。 就 XNU 内核而言，Pishi 允许你在函数、文件或文件夹级别进行插桩。例如，你可以对 /bsd/net/ 目录中的所有内容进行插桩，也可以专门聚焦于 contentfilter.c，或者只针对 XNU 源代码中的某一个特定函数，例如 vnodegetfromfd。这可以实现定向模糊测试。 构建并安装 Pishi 后，你可以使用我修改过的 libprotobuf-mutator 版本，这需要你先应用我的补丁（使 libfuzzer 具...

Obfuscation-Resilient Binary Code Similarity Analysis Using Dominance Enhanced Semantic Graph

Binary code similarity analysis BCSA serves as a core technique for binary analysis tasks such as vulnerability detection. While current graph-based BCSA approaches capture substantial semantics and show strong performance, their performance suffers under code obfuscation due to the unstable...

[SECURITY] Fedora 33 Update: radare2-5.4.0-1.fc33

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

Fedora Update for radare2 FEDORA-2019-b3de19c346

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: radare2-3.9.0-1.fc31.1

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364 1. In the Chakra's JIT compilation process, it stores variables' type information by basic block. function optb let o; if b // BASIC BLOCK a o = ; else // BASIC BLOCK b o = 1.1; // BASIC BLOCK c return o; For example, let's...

CVE-2017-8284

The disasinsn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated...