Security Researching and Reverse Engineering
I didn t. But working out why taught me more about RSA than any tutorial ever did, because it forced me to find the exact spot where the security lives and poke it. This post builds RSA from nothing, walks up to that spot, and then documents — with real code, real timings, and a real [ ]
Kill chain overview The lure It started with a well-timed email: Welcome! Your Free 1-Month Trial Has Started, branded as TradingView, landing in my inbox with a friendly nudge to Test Drive the Desktop App. Given my public interest in algo trading, this wasn t random spray, it was a targeted pretext. The email authenticated cleanly: [ ]
RtlRegisterWait is an undocumented Windows API that registers a callback function to be executed by a system managed thread pool when a specified object handle becomes signalled. [crayon-6a81ee0560c52464398295/]
While digging into the ReadDirectoryChanges API, I noticed it supports an asynchronous callback via LPOVERLAPPED_COMPLETION_ROUTINE. Most people use this API to monitor file system changes, but what if we could hijack that callback to execute shellcode? This led me to develop a proof-of-concept (PoC) that turns a mundane filesystem monitoring function into a stealthy shellcode [ ]
After a while, I m publishing a blog post which made me interested. With the recent tweets about the undocumented SystemFunction032 Win32 API function, I decided to quickly have a look at it. The first thing I noted after Googling this function was the source code from ReactOS. Seems like other SystemFunctions from 001 got other [ ]
What is a Callback Function? In simple terms, it’s a function that is called through a function pointer. When we pass a function pointer to the parameter where the callback function is required, once that function pointer is used to call that function it points to it’s said that a call back is made. This [ ]
In my previous article Exploring the MS-DOS Stub I stated that after experimenting, the Windows loader only cares about the e_magic and the e_lfanew members from the _IMAGE_DOS_HEADER. Because the rest of the members of the DOS header is used by MS-DOS to execute the stub program. Check it out if you have not. If [ ]
A long time ago when I got my first computer, I accidentally opened a 32-bit demo with a nice chiptune inside MS-DOS and it worked. I was surprised by how this happens. I was curious to find out how this works behind the scenes. Back in the time I was a little kid and had [ ]
Exploit Developer Student – XDS Course Review I first want to thank eLearnSecurity for creating such a course on this topic of exploit development. I have always been a big fan of the Windows operating system. For the past few years, I have spent a lot of time on Windows reverse engineering, Windows internals and [ ]
PowerShell has gained popularity with SysAdmins and for good reason. It’s on every Windows machine (and now some Linux machines as well), has capabilities to interact with almost every service on every machine on the network, and it’s a command-line utility. For the same exact reasons, PowerShell has also become a favourite method of attackers [ ]