idahunt

نظرة عامة المتطلبات الميزات البرمجة النصية الاستخدام المحاكاة دون تنفيذ التحليل الأولي تنفيذ سكربت IDA Python مقارنة الملفات الثنائية المتطلبات التحليل الأولي مقارنة الملفات مقارنة دالة عوامل التصفية اكتشاف البنية خاص بالهدف مشاريع معروفة تستخدم idahunt نظرة عامة idahunt هو إطار عمل لتحليل الملفا...

MemITM

Cos'è lo strumento MemITM? Lo strumento MemITM Mem In The Middle è stato sviluppato per intercettare facilmente i "messaggi" nella memoria dei processi Windows. Abbiamo sviluppato molti strumenti di intercettazione personalizzati della memoria per catturare messaggi di rete prima della...

ntoskrnl-metadata

ntoskrnl-metadata Ein IDA-Python-Skript zum Extrahieren kritischer Kernel-Metadaten aus Windows-ntoskrnl.exe-Binärdateien. Dieses Tool extrahiert automatisch Funktions-RVAs und EPROCESS-Strukturoffsets, die für die Entwicklung von Exploits gegen CVE-2026-40369 und andere Kernel-Schwachstellen...

astaroth-deobfuscator

astaroth-deobfuscator Astaroth/Guildma इंजेक्टर DLL को डीऑबफसकेट करने के लिए IDA पायथन स्क्रिप्ट हाल ही में एक Astaroth/Guildma अभियान से इंजेक्टर DLL का विश्लेषण करने की कोशिश करते समय SANS ISC से इस डायरी के लिए धन्यवाद, मुझे obfuscation का एक वाकई कष्टप्रद प्रयास मिला। एक फ़ंक्शन जिसे मैंने नी...

KPOT-string-decrypter

KPOT-string-decrypter KPOT स्टीलर के स्ट्रिंग्स को डिक्रिप्ट करने और उन्हें रनटाइम के दौरान प्राप्त करने वाले वेरिएबल के बगल में कमेंट के रूप में सेट करने के लिए IDA python स्क्रिप्ट्स। यह इस प्रकार काम करता है: उस ऑफसेट को प्राप्त करता है जो किसी भी डिक्रिप्शन फ़ंक्शन दो हैं, इसीलिए इस रिपो में ...

Karta - Source Code Assisted Fast Binary Matching Plugin For IDA

"Karta" Russian for "Map" is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries 200,000 functions, with almost no impact on the overall performance. The matching algorithm is...

MemITM - Tool To Make In Memory Man In The Middle

The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them ...

Memory Man in the Middle: MemITM

The MemITM Mem In The Middle tool has been developed in order to easily intercept “messages” in Windows processes memory. We developed a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them to...

TPLINK TLWR740N路由器远程代码执行漏洞(CVE-2017-13772)

INTRODUCTION In October of 2017 we disclosed multiple vulnerabilities in TP-Link’s WR940n router that occurred due to multiple code paths calling strcpy on user controllable unsanitised input CVE-2017-13772 The httpd binary responsible for these vulnerabilities contained patterns of code that...

Malware monitor - leveraging PyREBox for malware analysis

This post was authored by Xabier Ugarte Pedrero In July 2017 we released PyREBox, a Python Scriptable Reverse Engineering Sandbox as an open source tool. This project is part of our continuous effort to create new tools to improve our workflows. PyREBox is a versatile instrumentation framework...