Writing on malware analysis, reverse engineering, and Windows internals.
Fuzzing serisinin ikinci bölümünde gerçek V8 motorunu derledim; a + b gibi basit bir ifadenin TurboFan tarafından nasıl makine koduna çevrildiğini ve ilk güvenlik ipuçlarını adım adım izledim.
İlk aşamalarda olmasa da ilerleyen süreçte Chrome’un açık kaynaklı versiyonu olan Chromium üzerinde çalışmalara devam etme planım bulunuyor.
We specify the path of our file named HEVD.sys, which can be exploited from the DriverPath section. We set Service Start*to Automatic.
In this article, I will give some solutions when writing code for Windows Kernel driver or C++. Especially these are solutions when try to set up VS Studio on VM and start to write codes.
In this article, I will give you information about taking executable files which are inside dump files. If I talk about our scenario, there is a dump file from *s*vchost.exe that look suspicious.
We can also take a look at our malicious file on IDA Pro before proceeding with unpacking. Especially in the process of the unpacking process to make our easier in advance.
According to the published vulnerability, this vulnerability exists in Adobe Flash Player 28.0.0.137 and below. The vulnerability was distributed via malicious Office documents.
As can be understood from my previous articles, I was doing malware analysis. It will take time to deal with the issues encountered in the beginning. So I will explain these experiences.
