BinAbsInspector

What is BinAbsInspector? BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It...

rasputin

RASPutin 与我的演讲和 unRASP 工作相关的资源和论文。 这些工作正在进行中，请耐心等待 : 欢迎随时贡献 / 联系我 / 提交 PR！ 演讲 Insomni'hack 2022 - 打造对抗 Android 应用保护的金锤 这次演讲是一个新系列的第一场。 幻灯片 摘要 Insomni'hack 网站 Yara 规则 / RASP 分析 Koodous 上已有多个规则生效。它们可用于检测合法应用的木马化版本。关注 Dexcalibur 账号 以保持关注。 https://koodous.com/rules/N7QqMdLzegGAm4eW/general...

GhidraEmu

GhidraEmu 这个实验性的 Ghidra 插件让你能够轻松处理原生 pcode 模拟。不再需要编写脚本，可以直接在 Ghidra 中使用它。它对于处理各种常见模拟器不支持的非主流处理器尤为有用。 如果处理器/虚拟机受 Ghidra 支持以进行逆向工程，它就可以被模拟！例如，下面演示了 eBPF 指令模拟： 它能做什么 本质上，该插件是对 ghidra.app.emulator 包内类的扩展包装。以下是已实现的功能： 支持 Ghidra 支持的所有架构，因此你可以添加非主流处理器并进行模拟 CPU 上下文、栈和堆模拟 通过 Ghidra GUI 应用补丁字节以改变模拟进程...

ghidralligator

Ghidralligator Ghidralligator 是一款基于 Ghidra libsla 的 C++ 多架构 pcode 模拟器，专为配合 AFL++ 进行模糊测试而设计。 它允许进行基于模拟的模糊测试，同时在处理运行于特殊架构上的二进制文件时保持可观的性能。 其可扩展性使得模拟几乎所有架构都变得容易（只要你能编写相应的 Sleigh 规范文件），从而对任意代码片段进行模糊测试。 安装 Ghidralligator 可在 Linux 系统上运行。仅需要拥有支持 C++17 的 GCC 版本（已在 GCC 12.2.0 上测试并正常工作）。 Ghidra 依赖项已嵌入项目自身的...

CVE-2025-40023

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...

DEBIAN-CVE-2025-40023

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...

CVE-2025-40023 drm/xe/vf: Don't expose sysfs attributes not applicable for VFs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...

Malicious code in common-pcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1765a8063fe1e232a2b16271a3e738c52dba4a11ebdafb34ffbd5624d4b8bede Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2124 Malicious code in common-pcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1765a8063fe1e232a2b16271a3e738c52dba4a11ebdafb34ffbd5624d4b8bede Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...

How we developed our simple Harbour decompiler

https://github.com/KasperskyLab/hbdec Every once in a while we get a request that leaves us scratching our heads. With these types of requests, existing tools are usually not enough and we have to create our own custom tooling to solve the "problem". One such request dropped onto our desk at the...