Wesley Shields

@wxs

🤖 Security Engineer at Facebook. Interested in malware, protocols and reverse engineering. Retired FreeBSD committer. I also climb on fake rocks.

atarininja.org
Vrijeme pridruživanja: lipanj 2008.
225 fotografija ili videozapisa Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @wxs

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @wxs

  1. Prikvačeni tweet
    6. lip 2015.

    "The popular definition of 'simple' among programmers has moved from 'few moving parts' to 'short invocation' (easy) and this is a problem."

    12 korisnika označava da im se sviđa
    Poništi
  2. prije 21 sat

    Though, to be fair... The original request for some of these features came from Sir Tom of the House of Lancaster (). Credit where credit is due, of course. ;)

    1 proslijeđeni tweet 6 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  3. prije 21 sat

    The reason I'm sharing all this is the PR will (hopefully) be merged for the next release and those of you hunting for this technique can start to leverage the increased functionality.

    1 reply 4 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  4. prije 21 sat

    Since I convert the RVA to a file offset you can even check to see if enough functions are all "xor eax, eax; retn;" - which is pretty dope to be able to do so easily. There are other things this branch lets you do too, but I'll leave that up to you all to come up with. ;) 3/?

    1 reply 1 proslijeđeni tweet 3 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  5. prije 21 sat

    After trying it out he came up with these rules: - which are MUCH nicer to read/write, and the extra features of the branch provide increased functionality. He can compare the compiled dll name (from the export table) to the legitimate one... 2/?

    1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  6. prije 21 sat

    Woke up this morning to a message from about a crazy YARA rule he wrote () to look for DLLs where exported functions are at the same RVA. I suggested he look into testing my pending PR (). 1/?

    9 proslijeđenih tweetova 25 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  7. 3. velj

    If you're one of the places which use the dotnet module (we use it at ) it's worth noting that it will break rules if you're looking for specific user strings. I don't like breaking backwards compatibility but getting parsing correct is important in this case. 2/2

    2 proslijeđena tweeta 2 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  8. 3. velj

    So pointed out some weird user strings in some .NET binaries parsed by YARA. There were occasionally a trailing \x01. Turns out I missed a paragraph in the documentation which caused this bug, but I put up a fix at . 1/2

    1 proslijeđeni tweet 3 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  9. 31. sij

    I spent this week without a laptop, with my family in Disney World. I’m super far behind on most things, but I don’t care. I’ll start digging out as soon as I’m home. Expect some neat projects from me this winter...

    11 korisnika označava da im se sviđa
    Poništi
  10. 24. sij

    So is testing my base64 YARA work and discovered he can't use "base64" as a tag in his rule. This is not specific to base64 as you can't use any keyword as a tag. If you have base64 as a tag, your rule will fail to compile when my work is merged. Heads up!

    5 korisnika označava da im se sviđa
    Poništi
  11. 21. sij

    Listening to On The Metal from yesterday and I suddenly need “f00f on your lambda” in shirt and sticker form. Seriously, there are some amazing stories in all the episodes.

    Poništi
  12. 16. sij

    This report is a good example of confirmation bias and failure of critical analysis. The rule was triggering on strings that were unique to bat2exe which until now was only used by OilRig but is not indicative of malicious behavior. Be rigorous in your analysis!

    Odgovor korisnicima @MalwareRE @ClearskySec
    Both the QUADAGENT "dropper" from the PAL blog and the benign "PowDesk" file from this blog were generated using a publicly available bat2exe tool “Bat To Exe Converter” by Faith Kodak, hence the code reuse and behavioral similarities between the "droppers"
    4 proslijeđena tweeta 11 korisnika označava da im se sviđa
    Poništi
  13. 15. sij

    These were not the first living robot. That distinction belongs to yours truly.

    “Now hold still while I deploy these tiny crawlers on you for a body search for skin issues, they won’t bite....” The future is awesome.
    4 korisnika označavaju da im se sviđa
    Poništi
  14. 12. sij

    Performance management cycles are one of the top things I loathe. I do things I enjoy and am motivated to do, you pay me. That’s what I signed up for, that’s what I want. I don’t want to write down what I accomplished and the impact it had. I want to talk about what I’m proud of.

    So, my thoughts on engineering performance management have always been a bit idiosyncratic, but Matt's tweets today have me reflecting, so... storytime. 1/
    Prikaži ovu nit
    1 reply 1 proslijeđeni tweet 4 korisnika označavaju da im se sviđa
    Poništi
  15. 12. sij

    And now that this is done I will go back to fixing up my base64 work so it can be included in the next release. Sometimes you just have to take a break and do something completely useless but fun.

    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  16. 12. sij

    bf2y: Brainfuck to YARA. Are you a brainfuck coder who is also a YARA user? No? Well, I'm pretty sure nobody on the planet is but I just pushed my bf2y branch () and wrote some notes: . Completely pointless but a fun exercise.

    1 reply 4 proslijeđena tweeta 11 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  17. 10. sij

    Got new laptop and am seriously debating the value of slack. There are a handful of chats on there I mostly lurk in, but people do ping me on there. Migrating my keybase stuff was SO EASY, but do I really want to do the "log in to N slack teams" dance, again?

    5 replies 5 korisnika označava da im se sviđa
    Poništi
  18. 10. sij

    I've tested and it runs "hello world" and "cat" brainfuck programs. It's pretty dope if you're into esoteric languages running on a VM not meant to execute that language. ;)

    2 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  19. 10. sij

    So I have a working bf2y that compiles arbitrary brainfuck programs and executes them on the YARA VM (with 4 extra instructions, I may be able to reduce this down to 2 if I'm clever enough). Tomorrow I shall clean up the code and commit it.

    1 reply 1 proslijeđeni tweet
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  20. 10. sij

    I implemented bf2y again over the last couple of nights. A simple "cat" program works but the more complex "hello world" does not. I know why, and it's due to a massive oversight on my part in the design. The fix requires another YARA instruction, which I don't want to do. :(

    1 reply 1 proslijeđeni tweet 1 korisnik označava da mu se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  21. 8. sij

    If you want to see the base64 modifiers land in YARA, now is your chance to voice your support. If people don't want it, it won't go in. Comment on the pull request () or in the earlier thread and we'll see if people want this or not.

    1 korisnik označava da mu se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi

@wxs još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·