21 matches found
themida-devirt
Themida/CodeVirtualizer 去虚拟化示例 本项目演示了针对 Themida 或 CodeVirtualizer 保护的代码进行去虚拟化的效果。下面，你可以看到一个简单的示例，展示了虚拟化前 的代码和去虚拟化后 的代码并排对比。 虚拟化前| 去虚拟化后 ---|--- | 虚拟化后，代码被转换成复杂、混淆的形式，难以分析。去虚拟化器恢复原始逻辑，使代码再次可读。 详细解释和更多示例，请阅读完整文章：https://back.engineering/blog/09/05/2026/...
themida-unmutate
themida-unmutate Una herramienta de Python 3 para desofuscar estáticamente funciones protegidas por la ofuscación basada en mutaciones de Themida, WinLicense y Code Virtualizer 3.x. La herramienta ha sido probada en Themida hasta la versión 3.1.9. Se espera que funcione también con WinLicense y...
0xGUARD
📄 功能特性 模块重映射 线程过滤 模块隐藏 内存检查 完整性检查 反DLL注入 反调试 进程策略 字面字符串混淆 兼容 Themida/VMProtect ✔️ 依赖项 Windows 711 Visual Studio 2019 🔧 使用方法 1. 在 options.h 中设置选项，并构建 0xGuard。 2. 在你的项目中包含 0xGuardSDK.h 并链接 0xGuard.lib。 3. 构建你的项目。 📝 示例 root@kitploit: include include include "../0xGuard/0xGuardSDK.h" pragma comment...
unlicense
Unlicense 一个 Python 3 工具，用于动态脱壳受 Themida/WinLicense 2.x 和 3.x 保护的可执行文件。 警告：此工具将执行目标可执行文件。如果你不确定目标可执行文件的作用，请确保在虚拟机中使用此工具。 注意：你需要使用 32 位 Python 解释器来转储 32 位可执行文件。 功能 支持 Themida/Winlicense 2.x 和 3.x 支持 32 位和 64 位 PE 文件（EXE 和 DLL） 支持 32 位和 64 位 .NET 程序集（仅 EXE） 自动恢复原始入口点（OEP） 自动恢复（混淆的）导入表 已知限制 不支持 .NET...
CVE-2012-4865
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file...
SupremeBot and Mario cross the finish line together
Researchers have reported how popular game installers like Super Mario Games are being used to deliver malware. The malicious components include cryptominers, the SupremeBot mining client, and the open-source Umbral stealer. The game installers route offers some very distinct advantages to the...
A Decade-Long Chinese Espionage Campaign Targets Southeast Asia and Australia
A previously undocumented Chinese-speaking advanced persistent threat APT actor dubbed Aoqin Dragon has been linked to a string of espionage-oriented attacks aimed at government, education, and telecom entities chiefly in Southeast Asia and Australia dating as far back as 2013. "Aoqin Dragon seek...
Raccoon Stealer Crawls Into Telegram
A credential stealer that first rose to popularity a couple of years ago is now abusing Telegram for command-and-control C2. A range of cybercriminals continue to widen its attack surface through creative distribution means like this, researchers have reported. Raccoon Stealer, which first appear...
Cellebrite UFED 7.29 Hardcoded ADB Authentication Keys Vulnerability
Cellebrite UFED versions 5.0 through 7.29 use four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place evidence onto target devices when performing a forensic extraction. Title: Cellebrite Hardcoded ADB Authentication Keys Publicatio...
Cellebrite UFED 7.29 Hardcoded ADB Authentication Keys
KL-001-2020-001 : Cellebrite Hardcoded ADB Authentication Keys Title: Cellebrite Hardcoded ADB Authentication Keys Advisory ID: KL-001-2020-001 Publication Date: 2020.04.13 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2020-001.txt 1. Vulnerability Details Affected Vendor...
Cellebrite Hardcoded ADB Authentication Keys
Vulnerability Details Affected Vendor: Cellebrite Affected Product: UFED Affected Version: 5.0 - 7.29 Platform: Embedded Windows CWE Classification: CWE-321: Use of hardcoded cryptographic keys CVE ID: CVE-2020-11723 2. Vulnerability Description Cellebrite UFED uses four hardcoded RSA private...
Analysis antivirus BitDefender of an integer overflow vulnerability, the first part-the vulnerability warning-the black bar safety net
In software vulnerabilities“Pantheon”, the security software vulnerability is considered other than software vulnerabilities in more serious. We rely on security software to defend against attackers, so our defensive system in the vulnerability only allows an attacker to cause harm, but also will...
Bitdefender Internet Security Themida Emulator Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...
Oreans Themida 2.1.8.0 - TMD File Handling Buffer Overflow Vulnerability
No description provided by source. / Oreans Themida v2.1.8.0 TMD File Handling Buffer Overflow Vulnerability Vendor: Oreans Technologies Product web page: http://www.oreans.com Affected version: 2.1.8.0 32/64bit Summary: Advanced Windows software protection system, developed for software develope...
CVE-2012-4865
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file...
Buffer overflow
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file...
CVE-2012-4865
CVE-2012-4865 arises from a boundary error in Oreans Themida 2.1.8.0 when processing .TMD files, causing a buffer overflow that can allow remote code execution. The vulnerability is documented across multiple sources (e.g., Red Hat, NVD, CVE lists, and Zero Science Lab), with details indicating t...
CVE-2012-4865
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file...
Oreans Themida 2.1.8.0 - '.TMD' File Handling Buffer Overflow
/ Oreans Themida v2.1.8.0 TMD File Handling Buffer Overflow Vulnerability Vendor: Oreans Technologies Product web page: http://www.oreans.com Affected version: 2.1.8.0 32/64bit Summary: Advanced Windows software protection system, developed for software developers who wish to protect their...
Oreans Themida v2.1.8.0 TMD File Handling Buffer Overflow Vulnerability
Summary Advanced Windows software protection system, developed for software developers who wish to protect their applications against advanced reverse engineering and software cracking. Description The vulnerability is caused due to a boundary error in the processing of a project file, which can ...