copy-as-yara

Copy as YARA 作者：alden 将反汇编整齐地格式化以用于 YARA 规则。 描述： 这是一个非常简单的插件，允许你以可用于 YARA 规则的方式复制反汇编。你可以选择按原样复制汇编代码，或使用地址通配符来创建更健壮的规则。 用法： 要复制你需要的反汇编，无论在哪个视图中，直接选中它即可。接下来，导航到 插件 Copy for YARA 选项。格式化后的文本将自动复制到你的剪贴板。 地址通配符 此格式会尝试对可能的地址令牌进行通配，以使规则更健壮。它通过两种策略来实现： x86 root@kitploit: 49 8b 5e 08 // mov rbx, qword...

x64dbg-xfg-marker

x64dbg XFG 标记插件 Microsoft eXtended Flow Guard XFG 是一种控制流完整性（CFI）技术，它通过函数调用签名扩展了 CFG。每个签名长 度为 8 字节，位于目标函数之前。由于签名位于代码段中，x64dbg 会将其误认为 随机指令。这也常常导致 x64dbg 无法正确反汇编函数的起始部分。 该插件会遍历所有 XFG 函数调用签名，并将其标记为 8 字节整数，从而在签名与函数之间形成清晰的分隔。 交叉引用与注释 该插件还提供选项，可为可能的间接调用目标函数添加注释，并在间接调用与每个目标函数之间添加交叉引用，以便于导航。...

NOP_Plugin

NOPPlugin 用于在 IDA 中将指令 NOP 掉的插件。 该插件的创建灵感来自 Vidar Stealer（当时我正在尝试去除垃圾字节 / 指令）。 之前： 之后： 使用说明 将 NOPPlugin.py 文件粘贴到 IDA 的 "plugins" 子目录下。 要 NOP 掉指令，只需选中指令并按 "SHIFT+Z"。...

Linux Distros Unpatched Vulnerability : CVE-2026-55893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the shdisassemble function. An attacker can cause a segmentation fault and terminate the process by supplying crafted SH2A bytecode that leads to an out-of-bounds read in the decode table. Remediation A fix was...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the setregn function. An attacker can cause a four-byte heap buffer overflow by supplying crafted SH2A FPU bytecode processed through csdisasmiter or csdisasm with specific architecture and mode options,...

CVE-2026-55894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

DEBIAN-CVE-2026-55893

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg and setregn using shinfo.op.opcount without checking the fixed-size operands array. Repeated crafted instructions process...

CVE-2026-55894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

CVE-2026-55893

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg and setregn using shinfo.op.opcount without checking the fixed-size operands array. Repeated crafted instructions process...

UBUNTU-CVE-2026-55894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

UBUNTU-CVE-2026-55893

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg and setregn using shinfo.op.opcount without checking the fixed-size operands array. Repeated crafted instructions process...

CVE-2026-55893

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg and setregn using shinfo.op.opcount without checking the fixed-size operands array. Repeated crafted instructions process...

CVE-2026-55894

CVE-2026-55894 is an out-of-bounds read in the Capstone disassembly framework (≤ 6.0.0-Alpha9). The sh_disassemble() function in arch/SH/SHDisassembler.c computes an idx value from a raw 16-bit instruction without validating it against the active mode-specific decode[] function-pointer table. An ...

EUVD-2026-63669

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

PT-2026-79194

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh disassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CS ARCH SH...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49263

Summary: CVE-2026-49263 affects Capstone’s WebAssembly backend prior to 6.0.0-Alpha9. The WASM decoder in cs_disasm() and cs_disasm_iter() can be fed attacker-controlled raw instruction bytes, and for large but well-formed br_table encodings it can mis-handle lengths (exactly 65,536), causing the...

CVE-2026-49263 Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...