m3

m3 A simple and scalable Android bot emulation framework. A detailed explanation can be found here. This project was first published at Black Hat Europe 2021's Arsenal. Aside from the documentation in the code both in-line and as JavaDoc, one can learn more about extending the framework here. The...

unicorn

ユニコーンエンジン コントリビュータ募集中！ 詳細はこちら。 Unicornは、QEMUをベースとした、軽量でマルチプラットフォーム、マルチアーキテクチャのCPUエミュレータフレームワークです。 Unicornには、以下のような比類のない機能があります。 マルチアーキテクチャ: ARM、ARM64 ARMv8、M68K、MIPS、PowerPC、RISCV、SPARC、S390X、TriCore、X86（16、32、64ビット） クリーン/シンプル/軽量/直感的なアーキテクチャ非依存のAPI 純粋なC言語で実装されており、Crystal、Clojure、Visual...

Finding vulnerabilities in ClipSp, the driver at the core of Windows’ Client License Platform

By Philippe Laulheret ClipSP clipsp.sys is a Windows driver used to implement client licensing and system policies on Windows 10 and 11 systems. Cisco Talos researchers have discovered eight vulnerabilities related to clipsp.sys ranging from signature bypass to elevation of privileges and sandbox...

Using Speakeasy Emulation Framework Programmatically to Unpack Malware

Andrew Davis recently announced the public release of his new Windows emulation framework named Speakeasy. While the introductory blog post focused on using Speakeasy as an automated malware sandbox of sorts, this entry will highlight another powerful use of the framework: automated malware...