weak @weak1337

19 - Student Deutschland Joined October 2020

Tweets

28
Followers

153
Following

36
Likes

61

weak @weak1337

a year ago

🚀Last week, I got a sneak peek at @BackEngineerLab's latest project! Their demo ran in a bin2bin'd Windows kernel —flawlessly, without any stability issues. For those who know, dealing with exceptions, especially in binary obfuscation is quite a pain. Something to look out for!

0 3 12 4K 1

João Vitor(Keowu) @keowu

2 years ago

My new article using HexRays IDA. to deal with obfuscated code. comercial like VmProtect and OpenSource like Alcatraz: keowu.re/posts/Analyzin…

2 78 223 25K 99

secret club @the_secret_club

3 years ago

Improving MBA Deobfuscation using Equality Saturation by @fvrmatteo and @mr_phrazer. secret.club/2022/08/08/eqs…

0 74 139 0 22

weak @weak1337

3 years ago

github.com/weak1337/SkipH…

0 0 4 0 0

VollRagm @vollragm

3 years ago

Have you ever wondered if it was possible to execute code inside of a drivers .data section? Well, I did. I created a PoC that abuses Windows' LargePageDrivers feature to copy shellcode into the beep.sys .data section and execute it. Blog post: vollragm.github.io/posts/abusing-…

2 166 385 0 91

weak @weak1337

4 years ago

Latest reversal of NVIDIAs nvml.dll which allows developers to query DeviceName, UUID and similar values. Communicates directly with NVIDIAs kernel module github.com/weak1337/Nvidi…

0 0 6 0 0

weak @weak1337

4 years ago

Touché

0 0 3 0 0

Download Image

weak @weak1337

4 years ago

Detect @_cheatengine by listening to the global debug output: github.com/weak1337/CEDet…

2 0 8 0 0

Pavel Yosifovich @zodiacon

4 years ago

Finally... Windows Insider Preview WDK build 22557 integrates with VS 2022 microsoft.com/en-us/software…

2 19 53 0 2

weak @weak1337

4 years ago

Deobfuscate ricochet anti cheat github.com/weak1337/ricoc…

0 1 3 0 1

IDontCode @_xeroxz

5 years ago

HMDM (Highly Modular Driver Mapper), is a driver mapper which uses any method of executable kernel memory allocation and arbitrary kernel writes to map unsigned code into the windows kernel. The repo contains a MSREXEC and VDM example. githacks.org/_xeroxz/hmdm

0 48 132 0 21

Download Image

IDontCode @_xeroxz

5 years ago

msrexec is a framework that can be used to elevate all arbitrary MSR writes to kernel execution. Its another project under the VDM namespace and integrates with VDM (and thus PTM). Special thanks to @drewbervisor for pointing out AC bit can be set in UM. githacks.org/_xeroxz/msrexec

3 33 115 0 10

Download Image

secret club @the_secret_club

5 years ago

Hiding execution of unsigned code in system threads by @drewbervisor secret.club/2021/01/12/cal…

2 32 78 0 10

IDontCode @_xeroxz

5 years ago

Driver mapper that does not map a driver into the "kernel", but rather only maps the driver into the current context. This keeps the driver out of the kernels paging tables, generally making it difficult to find :) githacks.org/xerox/nasa-map…