Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation

This blog post continues the FLARE script series with a discussion of patching IDA Pro database files IDBs to interactively emulate code. While the fastest way to analyze or unpack malware is often to run it, malware won’t always successfully execute in a VM. I use IDA Pro’s Bochs integration in...

PT-2013-3941

Name of the Vulnerable Software and Affected Versions Sixnet UDR versions prior to 2.0 Sixnet RTU firmware versions prior to 4.8 Description The issue allows remote attackers to execute arbitrary code, read, modify, or create files, or obtain file metadata via function opcodes in the universal...

CVE-2013-2802: Improper Control of Generation of Code

The universal protocol implementation in Sixnet UDR before 2.0 and RTU firmware before 4.8 allows remote attackers to execute arbitrary code; read, modify, or create files; or obtain file metadata via function opcodes...