Recent content on Back Engineering Labs
Prerequisite Material https://k0mkc.hatenablog.com/entry/2026/07/29/042406 https://arxiv.org/abs/2603.18355 https://arxiv.org/abs/1909.01752 Legal Disclaimer This work constitutes reverse engineering, decompilation, and de-virtualization performed solely for the purpose of achieving interoperability with ACE-protected software on Linux and Proton environments. Such activities are undertaken in…
Introduction Before reading this article I highly recommend studying the following community research on binary deobfuscation.
Download All Files Here Introduction The integrity of online video games is locked in a perpetual cat-and-mouse battle between anti-cheat developers and cheat engineers. Over the years, we’ve witnessed the rise of increasingly sophisticated evasion tactics, often outpacing those in the antivirus and red-team communities. In this article, we’ll dissect the inner workings of a prominent…
Exploiting a Computer Program 1. Introduction Computer programs take, often transform data, sometimes use it to transform themselves. Other times, the programmer at fault, they can be corrupted by data. If corrupted accidentally, the program may find an untimely end to its execution. But if the flaw is perceived by the skilled eye, the program may turn into an open back door for seizing the entire…
KrakenSvm Project Table of Contents Preamble Purpose & Intentions Support Terminology Overview - KrakenSvm Hypervisor Virtual Machine Control Block (VMCB) - Parts Control Area Save State Area Secure Virtual Machine (SVM) - Semantics Checking Lock/Support Bits Initializing VMCB Setting EFER.SVME Secure Virtual Machine (SVM) - Instruction Set Credit - Special Thanks Reference - Resource I relied on…
Repository: https://git.back.engineering/_xeroxz/Theodosius/ Doxygen: https://docs.back.engineering/theo/ Table Of Contents Credits Introduction and Preamble LLVM IR Level Obfuscation Bin2Bin Obfuscation Linker Level Obfuscation Brief Overview Of Theodosius Decomposition Module Obfuscation Module Recomposition Module Theodosius Internals Recursive Symbol Dependency Check Theodosius Internal Passes…
Source PERSES’ source code can be found here .
Table Of Contents Introduction Hardware Details Notable Components SoC - Hi3520DV300 TDE - Two Dimensional Engine UART - Universal asynchronous receiver-transmitter JTAG - Hardware Debugging Hisilicon Source Code Which can be found here, rehosted on my servers… Bricking The Device & Bus Pirate Flashing SPI NOR Flash Chip (MX25L12835F) Custom UBoot & Custom Kernel System Startup System startup…
Disclaimer Please note that all the code posted from here on is simply heavily beautified pseudo-code. Sorry in advance for the styling inconsistencies you may find in it; I would like to add it represents in no way the original source code of the program. I do not condone using any of the information gathered from this blog post to produce/write/develop cheats for any sort of game protected by…
Source Link Disclaimer This is not an attack on EasyAntiCheat Oy. EasyAntiCheat has done an outstanding job protecting games and will continue to do so for years to come. I gathered this content through private research of EasyAntiCheat’s modules and is not in any way tied to the work of public game hack publishers or other entities. I have no interest in writing cheats, and everything here…
VMProtect 2 Project: github.com/backengineering/vmp2 Table Of Contents Purpose Intentions Definitions VMProtect 2 - Project’s Overview VMHook - Overview VMHook - Example, um-hook VMProfiler - Overview VMProfiler - Virtual Machine Handler Profiling VMProfiler - Virtual Branch Detection Algorithm VMProfiler Qt - Overview VMProfiler CLI - Overview VMEmu - Overview VMEmu - Unicorn Engine, Static…
Download link: VMProtect 2 Reverse Engineering Table Of Contents Credit - Links to Existing Work Preamble - Intentions and Purpose Purpose Intentions Terminology Introduction Obfuscation - Deadstore, Opaque Branching Opaque Branching Obfuscation Example Deadstore Obfuscation Example Overview - VMProtect 2 Virtual Machine Rolling Decryption Native Register Usage Non-Volatile Registers - Registers…
Download link: Voyager Table Of Contents Keywords Abstract Credit Introduction bootmgfw.efi winload.efi BlLdrLoadImage BlImgAllocateImageBuffer Hyper-V Intel - vm exit handler location and hooking Locating Vmexit Handler Hyper-V AMD - vm exit handler location and hooking Locating Vmexit Handler Locating VMCB Hyper-V Payload - Injection, vmexit handler hooking Hyper-V Page Tables - Extended Page…
Download link: Hyperspace Table Of Contents Introduction - Address Spaces Thread Scheduler - Trap Frames and Control Registers DKOM - Direct Kernel Object Manipulation Windows Memory Manager - MiStealPage Example - printf, malloc, etc Limitations - Crashes and Conclusions Introduction - Address Spaces An address space is defined as a region of memory. In this post I will be referring to an address…
Download link: Reverse Injector Table Of Contents Introduction - Virtual Memory & Page Tables TLB - Translation Lookaside Buffer Four Level Page Table Graph Reverse Injector - Merging Address Spaces Remapping PML4 Entries 32bit Processes - Support, Limitations, Information Remapping 32bit Processes VirtualProtect - Page Protections and WinAPI’s Example - Translating Remote Module Base Addresses…
Download link: MSREXEC Table Of Contents Introduction MSREXEC Starter Code WRMSR - Write Model Specific Register MSR - Model Specific Registers KVA Shadowing & KiSystemCall64 IA32_LSTAR With KVA Shadowing Disabled (KiSystemCall64) IA32_LSTAR With KVA Shadowing Enabled (KiSystemCall64Shadow) Thread Scheduler - Interrupts & LSTAR Existing Kernel Preventions SMEP - Supervisor Mode Execution…
Download PDF Version (Best Version) can be downloaded here: PDF Download . You can download the source from the open source repo here: PTM Repo .
Download PDF Version (Best Version) can be downloaded here: PDF Download . You can download the open source repo here: VDM Repo .
Download link: PSKP (Process-Context Specific Kernel Patch) Introduction Applying knowledge obtained from the prior write up of paging tables, one can easily follow along with this write up, if you have not acquainted yourself with paging tables this write up will be nothing but squiggly lines. Refresh your mind of the meaning of the following terms: PML4(E), PDPT(E), PD(E), PT(E), address space,…
Download link: PTM Introduction Virtual memory is probably one of the most interesting topics of modern computer science. Although virtual memory was originally designed back when physical memory was not an abundant resource to allow the use of disk space as ram, it has stuck with us, offering security, modularity, and flexibility. Unlike the rest of the content on my sites which is bound to an…
Download link: physmeme Introduction Physmeme is a driver mapper that works with any form of read and write to physical memory. It is highly modular code that allows a reverse engineer to easily integrate their own vulnerable driver. If you are able to read and write to physical memory you can now map an unsigned driver into your kernel just by coding four functions.
Anti-cheat programmer @ Ubisoft
Compilers, Windows, Obfuscation, x86-64, Hardware Hacking, and everything in-between. CEO & Cofounder of Back Engineering Labs
C/C++ developer & reverse engineer
When there is a will, there is a way
Say only that of which is worth more than silence.