/explore
|
You are here 
|
toddcullumresearch.com | ||
| | | | |
keyj.emphy.de
|
|
| | | | | [AI summary] The article discusses the process of creating ultra-small Windows executables by optimizing the PE (Portable Executable) format. KeyJ, the author, details various techniques such as removing sections, collapsing headers, and using hash-based import lookups to minimize the executable size. The article also includes comments from readers discussing the challenges and successes of these optimizations, as well as the importance of compatibility across different Windows versions. The final executable size is reduced to around 268 bytes, and the author acknowledges the trade-offs between size and compatibility. | |
| | | | |
www.forrest-orr.net
|
|
| | | | | IntroductionWith fileless malware becoming a ubiquitous feature of most modern Red Teams, knowledge in the domain of memory stealth and detection is becoming an increasingly valuable skill to add to both an attacker and defender's arsenal. I've written this text with the intention of further improving the skill of the reader as relating to the topic of memory stealth on Windows both when designing and defending against such malware. First by introducing my open source memory scanner tool Moneta | |
| | | | |
oldboy21.github.io
|
|
| | | | | Reflective DLL After some time spent on implementing a Reflective DLL and its beloved Loader/Injector I thought that it could have been a very great first topic for what it might become a long-ish series of blog posts about security, but mostly struggles and C(++). First reason is that I felt like I was struggling a bit finding resources that would really take the topic as a whole and explain any single step, and the reasoning behind it. | |
| | | | |
gpfault.net
|
|
| | | [AI summary] The text provides an in-depth exploration of various x86-64 instruction set architectures, focusing on arithmetic operations (ADD, SUB, MUL, SMUL, DIV, SDIV), logical operations (AND, OR, XOR, NOT), and control flow instructions. It details the implementation of these instructions in the QBX virtual machine, emphasizing how they emulate real x86-64 instructions while managing the flags register and handling different operand sizes (8-bit and 16-bit). The text also discusses the nuances of flag handling, register operations, and macro-based code generation to streamline instruction implementation. | ||
