Unpacking the Narrative Part 1: RenEngine Loader
Part 1 - Part 2
Blog by Joren Vrancken
Blog by Joren Vrancken
Latest posts
Unpacking the Narrative Part 2: Batch
Part 1 - Part 2
Substack Domain Takeover
Substack is a popular blogging platform. It allows writers to easily create their own personal blog, with payments, comments, analytics and other advanced features. Substack empowers writers to customize their blogs by adding a custom domain.
Computing Ghidra Function ID Hashes
During reverse engineering, an analyst is trying to answer specific questions about the binary they are analyzing. For example, “how does this malware sample encrypt files?” or “what is the root cause of the authentication bug in this router firmware?”. Often only a small subset of the functions in the binary are relevant to answer these questions and finding the relevant functions is a big part…
Carving ELF Files
Recently, I created a simple tool, Carve Exe, to carve executables from other files (e.g. memory dumps or network traffic). Carving executables from binary blobs is a common task in digital forensics and reverse engineering. For example, when analyzing how a malware sample unpacks and deobfuscates itself.
Using PANDA to search for F.L.I.R.T. signatures during process execution
When a malware analyst gets a new malware sample to analyze, one of the first questions they might have, is what functions are called during the execution of the sample. To solve this problem, we can use any old debugger to walk through the sample manually, but we can also automate and record our analysis with a dynamic analysis framework like PANDA.
Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories
Last year, we published a blog post discussing an attack where a malicious actor hijacks Arch User Repository (AUR) vulnerable packages by registering expired domains.
Hijacking GitHub Repositories by Deleting and Restoring Them
Recently, we encountered an obscure security measure while researching GitHub repositories: the popular repository namespace retirement. This security measure was implemented by GitHub to protect (popular) repositories against repo jacking (i.e. hijacking attacks).
Hijacking AUR Packages by Searching for Expired Domains
The Arch User Repository (AUR) is a software repository for Arch Linux. It differs from the official Arch Linux repositories in that its packages are provided by its users and not officially supported by Arch Linux.
An in-depth guide to GitHub Pages domain takeovers
GitHub Pages is a static content hosting service by GitHub. As it is free and integrates with GitHub repositories, it is a popular for hosting blogs, documentation and the like. By default, GitHub Pages content is hosted on username.github.io, but users can also configure their own domains to host content (e.g. this blog is hosted via GitHub Pages).