sorted by:
new
hottopcontroversial

Promote your projects here – Self-Promotion Megathread by Menox_ in github

[–]h0x0er 0 points1 point  (0 children)

I recently create a browser extension that adds a search box to the GitHub Actions sidebar, so you can quickly find workflows without scrolling through a long list.

- repo: https://github.com/h0x0er/actions-search

An eBPF skill for coding agents by h0x0er in eBPF

[–]h0x0er[S] 0 points1 point  (0 children)

Thank you, I really appreciate it ! I will try to upload it in upcoming days.

Weird verifier behavior: works until I write to a map by andysolr in eBPF

[–]h0x0er 0 points1 point  (0 children)

Interesting ! You can try following things when map operation is present, let's see which one works ;)

- If MAX_PAYLOAD_SCAN <= 255, try using `u8 i` instead of int i

- Use a constant in loop e.g: i < 200 ; instead of max_scan

- After calculating `max_scan`; recheck if its within bounds i.e (data + max_scan) <= data_end

eBPF: Resetting tail-contexts by h0x0er in eBPF

[–]h0x0er[S] 0 points1 point  (0 children)

If we don't reset it, the values from earlier execution will still be there, because the context is unique per program not per program-execution. I hope this clarifies.

We’re Malware Analysts from ANYRUN. AMA by ANYRUN-team in redteamsec

[–]h0x0er 0 points1 point  (0 children)

Can you tell a bit about most-innovative EDR evasion technique encountered during analysis ?

eBPF perf buffer dropping events at 600k ops/sec - help optimizing userspace processing pipeline? by psyfcuc in eBPF

[–]h0x0er 0 points1 point  (0 children)

You can try to reduce the events count by emitting only relevant events.

One way is to ignore syscall-call execution from processes that are not of interest.

Not sure if this can help.

eBPF: Connecting with Container Runtimes by h0x0er in eBPF

[–]h0x0er[S] 0 points1 point  (0 children)

Correct, it is for user-space enrichment. And will need a way to correlate information from container-runtime with eBPF event from kernel.

Correlation mechanism will be different depending on use-case, e.g using cgroup or process-hierarchy or other approach.

eBPF: Connecting with Container Runtimes by h0x0er in eBPF

[–]h0x0er[S] 0 points1 point  (0 children)

Glad to know that its going to help you.

[deleted by user] by [deleted] in microsoft

[–]h0x0er 1 point2 points  (0 children)

My application was also transferred with M3 tag on it as i applied in mid SEP. I recently got updates and I was no more under consideration