Teaching Rex another TrustedBSD trick to hide from Volatility Rex the Wonder Dog (here and here) is a proof of concept that uses TrustedBSD framew... 2014-03-18 22:32:11 | 阅读: 35 | 收藏 | reverse.put.as mpc staticmax trustedbsd maxindex

Don’t die GDB, we love you: kgmacros ported to Mavericks. Our lovely GDB has been declared dead with Xcode 5 release. The new king in town is... 2014-02-21 22:31:25 | 阅读: 31 | 收藏 | reverse.put.as mavericks lldb kdp thunderbolt kgmacros

Analysis of CoinThief/A "dropper" There is no such thing as malware in OS X but last week another sample was spotted a... 2014-02-16 19:51:26 | 阅读: 31 | 收藏 | reverse.put.as kango jsrsasign cryptojs nsstring chrome

AppleDoesntGiveAFuckAboutSecurity iTunes Evil Plugin Proof of Concept Oh this one has been into my head for so long that I finally decided to try and crea... 2014-02-15 19:49:37 | 阅读: 35 | 收藏 | reverse.put.as itunes security jeffrey lame

Updated version of Onyx The Black Cat New version available at the github repo, compatible with Mavericks and with a Cocoa... 2014-02-14 19:49:05 | 阅读: 28 | 收藏 | reverse.put.as sysent mavericks cocoa capstone weren

Linux/HackingTeamRDorks.A, a “new” and improved version of Linux/CDorked.A Disclaimer: This malware sample is not in any way related to Hacking Team (as far as... 2014-02-05 19:45:29 | 阅读: 37 | 收藏 | reverse.put.as lib64 tid sshd dssl libcrypto

Breaking OS X signed kernel extensions with a NOP For some reason Apple wants to change external kernel extensions location from /Syst... 2013-11-23 19:44:32 | 阅读: 34 | 收藏 | reverse.put.as kextd mybundleid thekext library sigresult

One small patch for GDB, one giant leap for reversers! One thing that really bothered me for a long time while debugging is the need to cal... 2013-11-08 19:43:41 | 阅读: 30 | 收藏 | reverse.put.as aslr github processes library belongs

Why ESET’s OS X Rootkit Detector is useless... Last week ESET released a Rootkit Detector tool for OS X. I finally gave a look at i... 2013-09-30 19:43:01 | 阅读: 31 | 收藏 | reverse.put.as useless sysent eset slides loaded

SyScan360 Beijing slides Eight days and 10 flights later I am back from SyScan360 in Beijing. It was my first... 2013-09-30 19:42:22 | 阅读: 29 | 收藏 | reverse.put.as beijing speakers usual observing atendees

HiTCON 2013 slides Taipei is definitely one of my favourite cities in the world!I love its “infinite”... 2013-07-30 19:41:43 | 阅读: 33 | 收藏 | reverse.put.as slides hitcon night taipei

Gone in 59 seconds: tips and tricks to bypass AppMinder’s Jailbreak detection There’s a new attempt at jailbreak detection available at http://appminder.nesolabs.... 2013-06-30 19:40:44 | 阅读: 40 | 收藏 | reverse.put.as sn sr jailbreak simulator svc

Another gift: Crackme #1 source code from hell! A reader was asking me some questions related to some stuff I used in my crackme and... 2013-06-11 19:40:06 | 阅读: 30 | 收藏 | reverse.put.as mangler gdbinit crackmes fg cleanups

Clapzok.A: reversing the OS X part of a multiplatform PoC infector I was lucky enough to get my hands on an updated version of interesting multiplatfor... 2013-05-31 19:36:55 | 阅读: 32 | 收藏 | reverse.put.as infect payload pagezero entrypoint memory

Gimmedebugah: how to embedded a Info.plist into arbitrary binaries One of the changes introduced by Mountain Lion was the removal of the old procmod co... 2013-05-28 19:35:57 | 阅读: 32 | 收藏 | reverse.put.as python codesign taskgated mountain lion

The "all" new Onyx The Black Cat! Suffering from post-conference boredom I decided to redo Onyx The Black Cat kernel e... 2013-05-24 19:35:12 | 阅读: 35 | 收藏 | reverse.put.as lion leopard mountain sysctl reenable

NoSuchCon #1 debrief and slides read file error: read notes: is a directory... 2013-05-21 19:34:36 | 阅读: 35 | 收藏 | reverse.put.as slides assumptions dtrace volatility greetings

Hydra, the sample util I am unable to describe! Let me give you a small gift before moving my ass to Paris to attend and present at... 2013-05-13 19:33:58 | 阅读: 37 | 收藏 | reverse.put.as userland paris codesigning nosuchcon suspend

There is an error in my SyScan slides! Today I discovered that my slides contain a (stupid) error!The story begins with Al... 2013-05-08 19:33:17 | 阅读: 33 | 收藏 | reverse.put.as linkedit lion memory formula mountain

SyScan13: Revisiting Mac OS X Rootkits presentation SyScan 2013, 10th anniversary edition is over! It is a great conference and I hope i... 2013-05-07 19:32:27 | 阅读: 37 | 收藏 | reverse.put.as rootkits phrack slides syscan nemo