Another iBoot/SecureROM loader for IDA Pro
Pinned Tweet
Follow
Click to Follow matteyeux
matteyeux
@matteyeux
Display Secure (TZ2)Joined April 2011
matteyeux’s Tweets
Hypervisor-Enforced Kernel Integrity, powered by KVM!
This is a new implementation that leverages hardware virtualization, and especially MBEC, to harden a Linux guest kernel.
Please reach out if you want to contribute to this project!
RFC: lore.kernel.org/all/2023050515
27
67
Disk encryption is critical in securing your data when you lose your device or an attacker gets physical access. But we found that if you don't use a BitLocker passphrase on an AMD system (before Windows even comes up), your data is not adequately secured:
4
75
153
Show this thread
#Diaphora CVE-2023-28231. As explained in the linked blog from , the fix checks that the number of relay forward messages in "ProcessRelayForwardMessage()" is not bigger or equal than 32 (0x20), as shown in the following pseudo-code diffing:
zerodayinitiative.com/blog/2023/5/1/
20
58
Two years ago the SolarWinds hack made history as the boldest, most sophisticated supply chain hack ever pulled off. I dug into the detailed story about the ingenious way the hackers pulled it off - and then got caught - in this tale for WIRED magazine
9
258
630
Show this thread
«The Road to Zero»
How to develop your own zero day vulnerabilities for XNU faisalmemon.github.io/the-road-to-ze
2
36
91
In the spotlight today is the Time Travel Debugging plugin (ttddbg), developed by Simon Garrelou ( ) and Sylvain Peyrefitte. Learn what makes this plugin so useful 🌐 hex-rays.com/blog/plugin-fo
#IDAPro #IDAPython #IDAPlugin #ttddbg
read image description
ALT
1
16
43
Someone needs to stop the web devs
121
492
3,975
Show this thread
4
268
349
Put out a blog post on some reversing I've been doing on the side of the AMD Platform Security Processor / PSP. Part 1 is an overview of the design and memory-mapped I/O (MMIO), part 2 will be on the Crypto Co-Processor MMIO.
11
81
319
Worth stressing, as LockBit macOS sample though *compiled* for macOS really isn't (yet) designed for macOS.
1. Unsigned (won't easily run on macOS)
2. Doesn't appear to take into account TCC/SIP, so won't be able to encrypt much of anything
So (in current form) macOS impact: ~0
Quote Tweet
“Cisco Talos researcher Azim Khodjibaev told BleepingComputer that based on their research, the encryptors were meant as a test and were never intended for deployment in live cyberattacks.” twitter.com/BleepinCompute…
2
43
122
Show this thread
NEW REPORT: SWEET QUADREAMS: A first look at #spyware vendor QuaDream’s spy tools, victims and customers.
We identified traces of suspected exploit deployed against iOS versions 14.4 and 14.4.2 and possibly other versions as zero-day vulnerability.
7
193
217
Show this thread
linux virtual memory fun fact of the day:
after a fork+exec to run a subshell, a parent process will page fault on every first write to every single writable page in its address space
13
85
561
Show this thread
New video: 3CX SmoothOperator analysis of ffmpeg with Binary Ninja
🦔📹
#MalwareAnalysisForHedgehogs #3CX #SmoothOperator
27
48
Eight years later and I stil stumble upon gems in the Hacking Team leak.
This one is... * chef's kiss *
1
7
36
Looks like my plugin is in the top 5 this month 👀
Quote Tweet
It looks like #Gepetto, developed by @JusticeRage is taking the lead for downloads in March! Publish your plugin in our Repository, and let’s see if it will make it to the top 
plugins.hex-rays.com//?utm_source=S
#IDAPlugin #PluginRoundup #IDAPro #IDAPython
plugins.hex-rays.com//?utm_source=S
#IDAPlugin #PluginRoundup #IDAPro #IDAPython
read image description
ALT
1
7
Our team published a post about the #3cx supply chain attack. We describe the Windows & the MacOS backdoors. The timeline: the GitHub repo on December 7 & the infrastructure in November... Few months later a malicious update was sent to the customers :
2
52
121
I'd like to publicly introduce BinSync, a cross-decompiler collaboration tool and suite. With BinSync, you can finally share reversing data, like Types, across all your favorite decompilers (IDA, Binja, Ghidra, angr) on-the-fly. github.com/binsync/binsync. See thread for demos.
4
93
270
Show this thread
Replying to
But why would you boot into doom when you can have it in firmware:
1
33
118
4
102
340
Show this thread
Success! used a TOCTOU bug to escalate privileges on Apple macOS. They earn $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OVancouver
GIF
1
48
252
New blogpost by and I! Patch Tuesday -> Exploit Wednesday: Pwning Windows afd.sys in 24 Hours. We reverse engineer a bug + write an exploit using a cool new primitive. We also find out that it's been exploited in the wild (previously unknown).
10
255
664
Couple of bugs I reported to got patched today. The most severe is classified as unauthenticated network RCE! #cve202323415 #cve202323426 Demo:
GIF
12
101
343
Show this thread
Cool, iOS 16.4 beta introduces more adaptations of C++ annotations, such as `intrusive_shared_ptr` (already open source in oss xnu github.com/apple-oss-dist ) For example, see below iOS 16.3 (left) vs iOS 16.4 beta (right):
1
11
47
Disambiguating Arm, Arm ARM, Armv9, ARM9, ARM64, Aarch64, A64, A78, ...
nickdesaulniers.github.io/blog/2023/03/1
7
22
Last year, during USA 2022, we demonstrated an attack to bypass the Secure Boot and Flash Encryption features of the original #ESP32 by corrupting its OTP Data Transfer with an EM glitch!
Read more about it in our latest blog post: raelize.com/blog/espressif
1
22
53
Show this thread
Change your host computer name to make attackers and malware think that they are in a sandbox.
Follow me for more terrible tips
27
158
1,291
Show this thread
16
47
My analysis of Brute Ratel is now up on my blog.
protectedmo.de/brute.html
9
143
426
Show this thread
Part 4 of Lord Of The Ring0 is out!
This part covers and explains different types of kernel callbacks and giving use cases for each one of them.
As a bonus, we will write a mini registry protector driver.
Check it out at: idov31.github.io/2023/02/24/lor
#infosec #CyberSecurity
5
66
175
I have written a brief article explaining how compilation units matching work in #Diaphora:
github.com/joxeankoret/di
2
24
72
Show this thread
My 2c on the #BlackLotus UEFI bootkit (thanks, ):
- "Exploitation Less Likely" is proven wrong, hope for a new DBX revocation list.
- not trusting UEFI CA saves the day yet again.
- having a single NV+BS variable as a gateway to booting whatever is a bad idea.
3
30
90
Show this thread
#ESETResearch analyze first in-the-wild UEFI bootkit bypassing UEFI Secure Boot even on fully updated Windows 11 systems. Its functionality indicates it is the #BlackLotus UEFI bootkit, for sale on hacking forums since at least Oct 6, 2022. welivesecurity.com/2023/03/01/bla 1/11
11
282
469
Show this thread
Make your iOS kernel exploration on 's IDA easier using PPLorer
a plugin to resolve PPL calls to the underlying function.
4
57
146
FaultyUSB: exploiting a TOCTOU race condition bug in recovery to get root on Huawei devices by emulating a malicious USB flash drive
1
127
315
Microsoft is officially supporting Windows 11 on Apple M1 and M2 Macs. A new partnership with Parallels will allow Mac users to officially install Windows 11 as a VM. Details here:
99
508
3,461
I just published a video: The secrets of Apple's Lightning - Part 1 youtube.com/watch?v=p5tMaW
13
181
1,156