diegoalbuquerque

Assembly Language / Reversing / Malware Analysis -resources

⭐Assembly Language

jahed

Live Query JSON with fzf

echo '' | fzf --print-query --preview "cat *.json | jq {q}"

https://paweldu.dev/posts/fzf-live-repl/

https://github.com/junegunn/fzf

cenrak

Product Security Testing

• IDA Pro and Decompilers Website
• Software Security Testing
• Introduction to Risk Analysis
• Introduction to Fuzzing
• The Art Of Software Security Assessment", by Mark Dowd, McDonald, Schuh, 2006
  • *Not on the recommended list, but a useful resource

Crypto

• *Not on the recommended lists, but I think SANS would be better off having students just work on these all day

leongjinqwen

Upload files to AWS

Make sure you already have S3 bucket, access key and secret key before go through this notes.

How to connect to AWS?

Boto3 allows Python developers to write software that makes use of services like Amazon S3 and Amazon EC2.

Step 1: Install boto3 with pip

pip install boto3

reegnz

Implementing a jq REPL with fzf

Update: I created jq-zsh-plugin that does this.

One of my favourite tools of my trade is jq. It essentially enables you to process json streams with the same power that sed, awk and grep provide you with for editing line-based formats (csv, tsv, etc.).

Another one of my favourite tools is fzf.

709924470

// Android native hooks By @709924470
// CC-BY-NC 4.0 
var moduleName = "libmain.so"; // Module name gose here
var hookFunctions = [
    {
        name: "Java_com_example_hellojni_getstr", // Function name goes here
        onEnter: function(args){
            // TODO: your code here
        },
        onLeave: function(ret){

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

johnhw

A complete list of books, articles, blog posts, videos and neat pages that support Data Fundamentals (H), organised by Unit.

Formatting

If the resource is available online (legally) I have included a link to it. Each entry has symbols following it.

• ⨕⨕⨕ indicates difficulty/depth, from ⨕ (easy to pick up intro, no background required) through ⨕⨕⨕⨕⨕ (graduate level textbook, maths heavy, expect equations)
• ⭐ indicates a particularly recommended resource; 🌟 is a very strongly recommended resource and you should look at it.

ricardo2197

0ctf babystack with return-to dl-resolve

In this write-up I will discuss how I managed to solve the challenge "babystack" from 0ctf with a technique called return to dl-resolve. I did not know this kind of return-to attack before the contest. In the following sections a detailed explanation of the entire exploit will be presented.

1. Binary analysis

I downloaded the provided binary babystack and quickly fired up binaryninja alongside with gdb to analyze it. I quickly realized a buffer overflow vulnerability is present within sub_804843b. My first approach was to solve this challenge using a return-to-libc attack by leaking the base address of the library and call system in order to get a shell.
This technique is contingent on:

1. Leaking libc base address
2. Knowing the version of libc to get the offset of system.

However, the version of libc on the remote server was unknown and the ELF did not provide any function that can be us

seanjensengrey

# source:http://reocities.com/SiliconValley/heights/7052/opcode.txt
From: mark@omnifest.uwm.edu (Mark Hopkins)
Newsgroups: alt.lang.asm
Subject: A Summary of the 80486 Opcodes and Instructions

(1) The 80x86 is an Octal Machine
   This is a follow-up and revision of an article posted in alt.lang.asm on
7-5-92 concerning the 80x86 instruction encoding.
 
   The only proper way to understand 80x86 coding is to realize that ALL 80x86