Channel Public Channel

Order of Six Angles

@orderofsixangles

Каналу 7 лет

Youtube канал: https://youtube.com/@orderofsixangles

Github: https://github.com/thatskriptkid

Тематические подборки малвари: https://www.orderofsixangles.com/samples

Пишите в личные сообщения канала

Open in Telegram

Subscribers: 5.41K
Photos: 450
Videos: 31
Links: 2.2K

Showing posts older than #2729 · Back to latest

Older Posts 18 shown

Post #2728 3.39K Oct 1, 2025, 10:42 UTC

This repository contains slides and hands-on materials for Emproof's workshop on firmware reverse engineering, presented at ScapyCon Automotive 2025. The workshop targets a technical audience with minimal security experience and teaches the fundamentals through practical, self-contained tasks.

https://github.com/emproof-com/workshop_firmware_reverse_engineering

GitHub GitHub - emproof-com/workshop_firmware_reverse_engineering: Workshop on firmware reverse engineering Workshop on firmware reverse engineering. Contribute to emproof-com/workshop_firmware_reverse_engineering development by creating an account on GitHub.

Post #2727 1.83K Sep 26, 2025, 04:48 UTC

An in-depth exploration of the Qualcomm KGSL Faults Subsystem, including patch analysis and vulnerability insights for CVE-2024-38399.

https://streypaws.github.io/posts/Fast-and-Faulty-A-Use-After-Free-in-KGSL-Fault-Handling/

StreyPaws Fast & Faulty - A Use After Free in KGSL Fault Handling An in-depth exploration of the Qualcomm KGSL Faults Subsystem, including patch analysis and vulnerability insights for CVE-2024-38399.

Post #2726 2.79K Sep 22, 2025, 10:58 UTC

RIFT is an open-source tool consisting of a set of IDA Pro (supporting versions >=9.0) plugins and Python scripts that aim to assist reverse engineers and other software analysts in annotating library code in Rust malware.

https://github.com/microsoft/RIFT

GitHub GitHub - microsoft/RIFT: Rust Library Recognition Project for Rust Malware by the MSTIC-MIRAGE Team Rust Library Recognition Project for Rust Malware by the MSTIC-MIRAGE Team - microsoft/RIFT

Post #2725 1.69K Sep 22, 2025, 06:10 UTC

Order of Six Angles С помощью IDA MCP можно даже дебажить

Post #2723 1.6K Sep 22, 2025, 06:07 UTC

Order of Six Angles Дорабатываю доклад про анализ малвари, с помощью LLM, а конкретно IDA MCP server, и презентую обновленный доклад на Sysconf (4 октября, Алматы). Стал использовать Cursor, вместо Cline. В режиме Auto, как я понял, он сам выбирает подходящую модель (gemini,…

С помощью IDA MCP можно даже дебажить

Post #2722 1.47K Sep 22, 2025, 04:04 UTC

How Does the iOS Kernel Copy Memory? (Virtual Memory Internals)

https://www.youtube.com/watch?v=0hxUEaDp1AA

YouTube How Does the Kernel Copy Memory so Quickly? Are you a security researcher or reverse engineer? For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing * For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training ** *License discounts are only valid for individuals…

Post #2721 1.46K Sep 19, 2025, 12:34 UTC

Order of Six Angles Дорабатываю доклад про анализ малвари, с помощью LLM, а конкретно IDA MCP server, и презентую обновленный доклад на Sysconf (4 октября, Алматы). Стал использовать Cursor, вместо Cline. В режиме Auto, как я понял, он сам выбирает подходящую модель (gemini,…

Деобфусцированный вариант большой control flow flattened функции

Post #2719 1.76K Sep 19, 2025, 12:23 UTC

Order of Six Angles готовлю доклад для 2600 на тему использования AI для malware analysis/vuln research (в частности MCP серверов) 😀

Дорабатываю доклад про анализ малвари, с помощью LLM, а конкретно IDA MCP server, и презентую обновленный доклад на Sysconf (4 октября, Алматы). Стал использовать Cursor, вместо Cline. В режиме Auto, как я понял, он сам выбирает подходящую модель (gemini, claude, gpt). Попробовал анализировать Rust бинарники, очень хороший результат. В них например трудно найти реальную Main функцию, LLM с этим справилась. Также проверил может ли Cursor строить call graph, результат на скрине. Промпт:

построй граф вызова функции sub_140F05ED0, укажи ее Callers. Также укажи Calee каждой функции  и нарисуй диаграмму в формате Mermaid

Также LLM помогают мне деобфусцировать код (как на скрине 2), обфусцированный с помощью Control flow flattening

Post #2718 1.67K Sep 19, 2025, 03:59 UTC

Harnessing 101: A Beginner's Guide to Fuzzing Harnesses

https://gabe-sherman.github.io/2025-09-17-beginning_harnessing/

Gabriel Sherman Harnessing 101: A Beginner's Guide to Fuzzing Harnesses | Gabriel Sherman As a newcomer to the computer security world working on my first paper, No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses, I inevitably spent countless hours studying, building, and running fuzzing harnesses. This…

Post #2717 2.26K Sep 18, 2025, 06:11 UTC

Binary Exploitation 101

https://r1ru.github.io/categories/binary-exploitation-101/

Post #2716 1.51K Sep 17, 2025, 03:55 UTC

Windows local privilege escalation through the bitpixie vulnerability

https://blog.syss.com/posts/bitpixie/

SySS Tech Blog Windows Local Privilege Escalation through the bitpixie Vulnerability This blog post demonstrates how attackers can circumvent BitLocker drive encryption, how to protect against such attacks, and why acting now might pay off in the near future. The bitpixie vulnerability in Windows Boot Manager is caused by a flaw in the PXE…

Post #2715 1.86K Sep 15, 2025, 04:03 UTC

Reproducing a million-dollar bug: WhatsApp CVE-2019-11932 (with AFL & Frida)

https://www.ibm.com/think/x-force/reproducing-million-dollar-bug-whatsapp-cve-2019-11932-afl-frida

Ibm Reproducing a million-dollar bug: WhatsApp CVE-2019-11932 (with AFL & Frida) | IBM Dive into research on a double-free vulnerability, CVE-2019-11932, in an image processing library used by WhatsApp and a GIF-processing vulnerability affecting Android mobile phones.

Post #2714 1.74K Sep 12, 2025, 12:36 UTC

The Big LLM Architecture Comparison

https://www.youtube.com/watch?v=rNlULI-zGcw

YouTube The Big LLM Architecture Comparison Article: https://magazine.sebastianraschka.com/p/the-big-llm-architecture-comparison Reasoning from scratch book: https://mng.bz/Nwr7 LLMs from Scratch repo: https://github.com/rasbt/LLMs-from-scratch This video covers the most important open-weight LLM…

Post #2713 1.45K Sep 12, 2025, 04:47 UTC

Хорошая статья по обфускации в образцах

https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmasking-poisonplug-obfuscator

Google Cloud Blog ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator | Google Cloud Blog We been tracking multiple espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW malware.

Post #2712 1.36K Sep 10, 2025, 03:09 UTC

Вот это удача

Post #2711 1.97K Sep 8, 2025, 04:01 UTC

This class teaches Bluetooth reconnaisance and device identification, using the Blue2thprinting security tool

https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+BT2222_Blue2thprinting+2025_v1/about

p.ost2.fyi Bluetooth 2222: Bluetooth reconnaissance with Blue2thprinting This class teaches Bluetooth reconnaissance & device identification using the Blue2thprinting software.

Post #2710 1.53K Sep 8, 2025, 03:53 UTC

An unexpected journey into Microsoft Defender's signature World

https://retooling.io/blog/an-unexpected-journey-into-microsoft-defenders-signature-world

Post #2709 1.5K Sep 8, 2025, 03:50 UTC

Hunting for Security Bugs in Code with AI Agents: A Full Walkthrough

https://muellerberndt.medium.com/hunting-for-security-bugs-in-code-with-ai-agents-a-full-walkthrough-a0dc24e1adf0

Medium Hunting for Security Bugs with AI Agents: A Full Walkthrough In my previous article, I introduced Hound, an open-source code auditing tool that models the cognitive and organizational processes of…

Older posts →