Surprise, I ported Windows Defender to Linux.
https://github.com/taviso/loadlibrary …
-
-
Replying to @taviso
Can this load PE *executables* if I manually search for/provide symbols? Last time I had to one-off that I used mmap w/ hardcoded offsets...
1 reply 0 retweets 4 likes -
Could be useful for fuzzing and/or reversing windows EXEs too if so.
1 reply 0 retweets 4 likes -
Replying to @marcan42
Yes, that would work - I find the process of porting and making sure all the imports work useful for reversing, get a feel for the flow etc.
1 reply 0 retweets 9 likes -
Replying to @taviso
Nice. My use case at the time was white-box AES; easily defeatable (key extraction) if you can surgically hijack execution.
1 reply 0 retweets 7 likes
Dumb question perhaps: why embed dlmalloc instead of just using the glibc allocator? Isolation against bugs in imported DLL?
12:41 AM - 24 May 2017
0 replies
0 retweets
3 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.