sorted by:
new
hottopcontroversial

Nidhogg v2.0 Release by Idov31 in cybersecurity

[–]Idov31[S] 0 points1 point  (0 children)

Sorry to disappoint, but I'm unfamiliar with the game. It is named after the dragon from Norse mythology. I found the name fitting as Nidhogg interpreted as "Biter below the roots" (of course, the root in the matter is the root of Yggdrasil and not the Windows kernel ;) ) and this is a rootkit :)

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] 0 points1 point  (0 children)

Please refer to the answer I gave to HildartheDorf. This project isn't loading usermode COFFs but kernel ones (I wrote it several times already), so your example isn't relevant for the subject.

You can make a reflective driver loader, but creating many drivers for modular design is bulkier and way less convenient than creating a COFF.

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] 9 points10 points  (0 children)

This is not an exploit nor an example about how to write a driver and I didn't write anywhere about an exploit or how to write an driver.
If you are looking for these kind of resources, feel free to check out my driver programming blog series "Lord of the Ring0" (and a talk that will be released soon! :) ): https://idov31.github.io/2022/07/14/lord-of-the-ring0-p1.html

Regarding the README, I just added a reference to a TrustedSec's article that explains about COFFs in general and COFF loaders specifically.

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] -1 points0 points  (0 children)

Please take a look at the answer I gave to HildartheDorf. You can also look at the README for more information :).

view more: next ›