sbox

sbox - C++向けコンパイル時AES文字列難読化 標準的な解決策は length + "" + string に依存しています。これは簡単にリバースできます。 sbox は constexpr AES-128 ブロック暗号を利用して、文字列を高エントロピーノイズに変換します。 背景 Neetcode の「Encode and Decode Strings」チャレンジの際に、難読化プロジェクト Obfusk8 から AES エンジンを移植しました。 実装は初回提出で 7ms で通過しました。暗号セキュリティはパフォーマンスとトレードオフになるべきではありません。 特徴 区切り文字なし...

Obfusk8

Obfusk8: Biblioteca de Ofuscación Basada en C++17 Obfusk8 es una biblioteca ligera de solo cabecera header-only para C++17, diseñada para mejorar significativamente la ofuscación de tus aplicaciones, haciendo que la ingeniería inversa sea una tarea sustancialmente más difícil. Lo consigue mediant...

static_asm

staticasm ヘッダーオンリーのC++20ライブラリで、コンパイル時のx86/x86-64命令エンコーディングを提供します。 このプロジェクトはBoost Software License 1.0とMIT Licenseのデュアルライセンスです。どちらかのライセンスを選択できます。 目的 実用的かつ楽しい方法でx86アセンブリエンコーディングを学ぶ 完全な型安全性を持ってコンパイル時にアセンブリ命令を生成する ランタイムオーバーヘッドなしでシェルコードやJITコードテンプレートを作成する クイックスタート root@kitploit: include "staticasm.hpp"...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

CVE-2022-24713-POC

PoC von CVE-2022-24713 auf Ubuntu Installieren Sie das aktuelle rust-regex-Paket auf Ubuntu. Dann klonen Sie dieses Repo. Dann führen Sie cargo build aus. Die Regex-Abhängigkeit ist auf den Ordner /usr/share/cargo/registry gesetzt, daher gibt es keine Abhängigkeitsprobleme. Wenn die Kompilierung...

WTSRM2

WTSRM2 Dies ist eine Fortsetzung meines ursprünglichen Projekts WTSRM und des zugehörigen Vortrags. Dieses Projekt wurde neu geschrieben, um C++17 zu nutzen und eine Vorlage zu erstellen, die es uns ermöglicht, die gewünschte Funktionalität zur Compilezeit problemlos zu ändern! Es ist als reine...

obfus.h

obfus.h obfus.h è una libreria composta solo da macro per l'offuscamento in fase di compilazione di applicazioni C, progettata specificamente per Tiny C tcc puoi scaricarlo qui - Tiny-C-Compiler/releases. È pensata per piattaforme Windows x86 e x64 e supporta quasi tutte le versioni del...

nimvoke

nimvoke Syscall indiretti + DInvoke resi semplici. Progettato per essere importato direttamente nei tuoi progetti Nim, nimvoke usa macro per astrarre i dettagli delle chiamate di sistema indirette e delle dichiarazioni di delegati in stile DInvoke. Questa libreria è pensata per essere facile da...

CVE-2026-59989

Phalcon (PHP framework) versions 5.15.0 and earlier are vulnerable to a Server-Side Template Injection (SSTI) in the Volt compiler's join filter. The root cause is in resolveFilter within phalcon/Mvc/View/Engine/Volt/Compiler.zep, which inserts raw separator and array token values directly into g...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

Script security bypass vulnerability in script-security

script-security 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied. This ma...

CVE-2026-44294

A flaw was found in protobufjs. This vulnerability occurs because protobufjs, which compiles protobuf definitions into JavaScript JS functions, does not properly escape certain control characters in field names when generating JavaScript property accessors. A remote attacker could provide a...

EUVD-2026-31772

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a lar...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Fortify: Fixed the compiletimestrlen function under UBSANBOUNDSLOCAL conditions. With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observed a runtime panic when running Android’s Compatibility Test Suite CTS. This iss...

Compile-Time Security Analysis and Optimization of Sensitive String Producers

Content composition vulnerabilities remain among the most prevalent and persistent classes of security weakness in deployed software. Prior mitigations, including developer training, static analysis tools, and domain-specific template languages, each face diminishing returns; AI code generation...

Moving beyond Strings in Spring Data

If you've worked with data access in Java and especially with Spring Data for a while, then you are familiar with various Query and Update programming models. You write data access code. You refactor a property name. You run your tests. They fail. Your query strings? Still pointing to the old...

Chasing Elusive Memory Bugs in GPU Programs

Memory safety bugs, such as out-of-bound accesses OOB in GPU programs, can compromise the security and reliability of GPU-accelerated software. We report the existence of input-dependent OOBs in the wild that manifest only under specific inputs. All existing tools to detect OOBs in GPU programs...

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

SUSE CVE-2022-50778

In the Linux kernel, the following vulnerability has been resolved: fortify: Fix compiletimestrlen under UBSANBOUNDSLOCAL With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's CTS android.hardware.input.cts.tests...

EUVD-2022-55783

In the Linux kernel, the following vulnerability has been resolved: fortify: Fix compiletimestrlen under UBSANBOUNDSLOCAL With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's CTS android.hardware.input.cts.tests...