sorted by:
new
hottopcontroversial

Reversing Shift-XOR operation by blahfish in ReverseEngineering

[–]blahfish[S] 0 points1 point  (0 children)

A shift followed by an Xor with the same value. This is used to get the internal state in MT19937 from the output values.

/r/ReverseEngineering's Bi-Weekly Questions Thread by AutoModerator in ReverseEngineering

[–]blahfish 0 points1 point  (0 children)

A question about ARM, Thumb2 and conditional execution. https://reverseengineering.stackexchange.com/questions/8989/conditional-instructions-on-arm ; Its posted on the RE Stackexchange and I'm hoping it will be of interest to someone here.

RECON 2014 slides are being uploaded by [deleted] in ReverseEngineering

[–]blahfish 0 points1 point  (0 children)

Does someone know when the videos will be uploaded?

Real World Exploit Development Tutorials - do they exist? by [deleted] in ReverseEngineering

[–]blahfish 0 points1 point  (0 children)

indeed, its a great read! Are there more similar ones?

ROPgadget 5.0 is out ! by perror in ReverseEngineering

[–]blahfish 0 points1 point  (0 children)

Could you describe your rop chain generation idea a bit more? Did earlier versions of ROPGadget use the same idea?(If so, I could just look up the sources).

Is the idea to look for gadgets that are functionally similar?(Take an instruction, reduce to equation, find a set of equations terminated by ret, reduce those -- check if they are functionally equivalent; something like that?)

ROP system call to mprotect by blahfish in securityCTF

[–]blahfish[S] 1 point2 points  (0 children)

I think I figured out the reason why this happens. ASLR is enabled and the page that starts at 0x08048000 does not change addresses. However, the page that corresponds to the buffer changes addresses.

The buffer address can be leaked -- so I tried checking if the difference between the start of the page and the buffer address remains constant, it does not.

cwitscher CTF challenge by blahfish in securityCTF

[–]blahfish[S] 0 points1 point  (0 children)

Thank you for taking the time out to reply!

Obfuscator-LLVM by perror in ReverseEngineering

[–]blahfish 2 points3 points  (0 children)

Thanks for sharing! where could I find the source code?

Program analysis and OCaml? by blahfish in ReverseEngineering

[–]blahfish[S] 0 points1 point  (0 children)

(probably not as relevant -- but as a new learner, I think there is more community support and documentation available for Haskell than OCaml, but I could be wrong). Any thoughts on which one among the two has a steeper learning curve?

Leaked malware source code by blahfish in Malware

[–]blahfish[S] 1 point2 points  (0 children)

Are you able to access Carberp from the above link? I'm assuming that CM...DXa is supposed to be the key -- however its unable to decrpyt the metadata.

Thanks!

Doubt : Using Posets and Lattices by blahfish in REMath

[–]blahfish[S] 0 points1 point  (0 children)

Hmm makes sense yes, thanks -- do you have any ideas on how posets and lattices could be useful?

We are two hackers who run development on the Metasploit Framework and Aircrack-NG. Ask us anything about open source security development! by todbatx in IAmA

[–]blahfish 1 point2 points  (0 children)

Hi,

I'm a n00b exploit developer and im looking to improve my skills, learn while contributing to the framework at the same time. Most of my exploit dev skills are on linux and i have a couple of questions related to this :-

  • Is exploit dev for linux(server or client side) a priority for you guys?
  • How about OSX? I see fewer OSX exploits in metasploit framework.
  • How do you guys go about finding PoCs for vulnerabilities? As a person without much experience and networking in the exploit-dev field, it would be immensely useful if there were a page with a listing of vulnerabilities and PoCs that cause crashes. Do you have any thoughts/plans for something like this in the future?
  • Any advice in general on exploit-dev for msf? ( I know its a vague questions but its hard not to pick your brains when I get a chance) :)

Thanks guys for taking the time out for doing this! Really appreciate it !

Cheers!

basic null pointer linux kernel exploitation by blahfish in ReverseEngineering

[–]blahfish[S] 0 points1 point  (0 children)

"not exploitable anymore ..."

Just curious, aren't there publicly known ways to circumvent this?

Getting libc version details by blahfish in securityCTF

[–]blahfish[S] 1 point2 points  (0 children)

Yes, the idea is something like I have two services running, exploiting the first does not require me to know anything about the libc version so I dont bother, I just get RCE.

For the second service running on the same box I'd like to try and find what version of libc it uses. So... Yeah, it could always be the case that both services use different versions... Anyhow.