DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...

NativePe

NativePe NativePe is a Windows Portable Executable library written in Object Pascal for Delphi. The project focuses on PE parsing, mapping, loading, relocation, import and export handling, dumping, process memory reading, and related Windows internals. It supports Win32 and Win64 builds from the...

RpcInvestigator

RPC Investigator Please read our blog post announcement. RPC Investigator RPCI is a .NET/C Windows Forms UI application that provides an advanced discovery and analysis interface to Windows RPC endpoints. The tool provides a visual interface around the existing core RPC capabilities of the...

Win32_Offensive_Cheatsheet

Win32 Offensive Cheatsheet Win32 and Kernel abusing techniques for pentesters & red-teamers made by @UVision and @RistBS Dev mode enabled, open to any help : Windows Binary Documentation PE structure PE Headers Parsing PE Export Address Table EAT Resolve function address Import Address Table IAT...

radare2:ia_fuzz: Heap-buffer-overflow in dotnet_parse_version_info

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=6551356612870144 Project: radare2 Fuzzing Engine: afl Fuzz Target: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 8...

AZL-35255 CVE-2023-40548 affecting package shim for versions less than 15.8-3

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This fl...

radare2:ia_fuzz: Heap-buffer-overflow in Pe32_r_bin_pe_get_sections

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=6282559331500032 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type:...

ClamAV antivirus multiple security vulnerabilities

Memory corruption on PDF and PE parsing...

Microsoft Malware Protection Engine TWO DoS Vulnerabilities

CVE-2008-1437 CVE-2008-1438 There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine...