0xMado 

58 posts

0xMado  banner
0xMado 

0xMado 

@0x1334

GetCurrentLocation() __ cr0 Katılım Nisan 2022
133 Takip Edilen19 Takipçiler
Sabitlenmiş Tweet
0xMado 
0xMado @0x1334·
I just published MorphKatz -a polymorphic PE rewriter that breaks byte-pattern detection without changing semantics medium.com/p/morphkatz-a-…
English
0
0
0
48
vx-underground
vx-underground@vxunderground·
Installing a KERNEL MODE anti-cheat and BE A VICTIM? No thanks. As an ALPHA MALE, I install random games off Steam that are free and become a victim of RANSOMWARE and EXTORTION
UwU Underground@uwu_underground

Saw ppl sayin they would never install kernel anti-cheat on their gaming rig again today 2 replies later same guy talks bout runnin OpenClaw Bro rejected kernel cheats, then installed a supply-chain Ouija board because automated copy-paste curl 'felt safer than Vanguard' CSTP

English
20
70
1.5K
76.9K
0xMado 
0xMado @0x1334·
@joshterrill Symmetric encryption AES-128 CBC, but the interesting part is the key derivation that done in initWithAccountsSecrets , so the books are decrypted in chunks not all at once per acc+device as a DRM style.. insanely clean RE work. Respect
English
1
0
44
3.4K
Josh Terrill
Josh Terrill@joshterrill·
I broke Kindle's DRM protection tonight through a mix of static and dynamic analysis. AES key is derived from accountSecrets, kindle device ID, and voucher path. Book is decrypted in parts using OpenSSL from Ion blobs and then decompressed with LZMA.
Josh Terrill tweet media
English
25
229
2.3K
84.8K
S_Teach
S_Teach@STeach404·
@vxunderground So to sum it up, no software is truly uncrackable, it's more about how annoying it is.
English
1
0
1
643
vx-underground
vx-underground@vxunderground·
I had some people DM me and tag me on this post to determine if it's malware or "slop". Using the software requires providing billing information prior to downloading the trial. I got mildly annoyed by this and contacted support. I requested access to the binary without needing to provide billing information. Their support team was ... actually very, very, very polite and nice. I was kind of taken back by how polite they were. They provided me the software with a 60 day trial. I can't tell if they know I do malware development and reverse engineering because (usually) places are hesitant to just give me the stuff like this on a platter. I would feel bad if I was hyper-critical of this product because of how polite the person running this profile is, they're just a chill dude. To be direct: - Is this malware? No. - Is this slop? Probably not, no. - Does this actually improve FPS? Yes, unironically. However, it is very important you realize this software is changing the voltage and clock speed on your machine (among other things). They're achieving this in a legitimate way by working with AMD and Intel with actual SDK (Software Development Kit) documentation. This product went to great lengths to secure its source code. It has junk code insertion, in-memory patching (stubs), junk variables, control flow obfuscation, and it also does device finger-printing to ensure you don't steal their product. All of this was performed using professional anti-reverse engineering products. It was a real pain in my balls to deal with. I got mildly irritated at several points. Some strings are AES256 encrypted and decrypted when needed (run-time lazy loading) making static-analysis even more difficult. Despite all of this, none of it is malicious. They just don't want nerds stealing their stuff. At first glance however it does use methods similar to malware to avoid reverse engineering. The application UI is also incredibly heavy. It is using the latest and great .NET UI stuff to make it look super cool and gamer-like. It launches from HyperTune.exe which then loads the actual (super obfuscated) HyperTune.dll using HOSTFXR (Google it). The obfuscation tools they used disassembled and fractionated the application entry point (and subsequent functionality) down into 1,618 other functions (see attached image) The only saving grace was the visibility into it's dependencies and other 3rd party libraries it uses (Realm for local settings savings, Sentry for logging errors, SimpleInjector for handling classes they use, etc). I won't go into full details on how their product actually works, I would feel bad because of support dude being a chill dude, but here is my main criticism: - Loading of kernel-mode drivers from vendors for overclocking. They load AMD and Intel drivers based on your hardware profile on your machine. However, the driver configuration settings are set to AUTOSTART. Hence, once you use this software these kernel-mode components will auto-start even if HyperTune is not running. Additionally, uninstalling HyperTune will not uninstall these kernel-mode components. These kernel-mode components come by default with the installer in a directory called /3p/ but move to SYSTEM32 after installation (as they should be). - For reasons I do not understand, HyperTune modifies HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU ... it disables automatic updates from Windows. I don't know why. My presumption is this could prevent potential driver conflicts, but if not managed correctly this exposes users to security vulnerabilities. Did they actually spend $1,000,000 developing this? With a full development team, infrastructure they're using (Sentry, VERCEL, enterprise and professional anti-reverse engineering tools, etc) ...maybe...?
vx-underground tweet media
HYPERTUNE@hypertune_

75% of gamers are limited by their FPS. We spent $1,000,000 to even those odds.

English
38
75
1.7K
143K
0xMado 
0xMado @0x1334·
@vxunderground @vxunderground Solid writeup! That 1618 function sounds like a fun challenge, any chance you can share the sample (or just the DLL) for educational RE practice? Thanks !
English
0
0
0
884
0xMado 
0xMado @0x1334·
@tetsuoai Terry single-handedly built a divine OS (Temple-OS) in a cave while the rest of us were still figuring out pointers 😢
English
0
0
0
47
0xMado 
0xMado @0x1334·
@Proton_Pass D, is the strongest, it would take 10²⁵+ years or more to crack
English
0
0
0
1.4K
Proton Pass
Proton Pass@Proton_Pass·
(If I hadn't shared them) which would be the best password and why? A) WinterMoon88 B) Flame!Rider204 C) J7$kP2!mQx9#L D) Echo-Bicycle-Violet-77&
English
298
15
469
124.7K
Adriksh
Adriksh@Adriksh·
C has automatic resource management, nobody talks about it.
Adriksh tweet media
English
38
36
749
147.8K
0xMado 
0xMado @0x1334·
@5mukx Great breakdown @5mukx Signed arith in kernel pool allocs is still cooking in 2026 , that headerSize + memmove pattern is pure gold.
English
0
0
1
399
0xMado 
0xMado @0x1334·
@NoahKingJr Yeah, just let AI hallucinate your bank's entire backend. What could go wrong besides money vanishing and planes falling?
English
0
0
4
85
Noah
Noah@NoahKingJr·
Name one reason we still need programmers.
English
113
4
45
8.4K
pastaya
pastaya@realpastaya·
GUYS THE C++30 STANDARD LEAKED
pastaya tweet media
English
114
284
3.9K
170K
tetsuo
tetsuo@tetsuoai·
If you code in C and Assembly, everything is open source.
tetsuo tweet media
English
40
115
1.3K
36.7K
0xMado 
0xMado @0x1334·
@vxunderground Your idea works.. Built it in pure C++ , WinRT Graphics.Capture + WinRT OCR. Stealth-captures Slack, Discord, Teams (even minimized/hidden windows) and extracts text silently. Sometimes you need to try silly things 😁 github.com/0xMohammedHass…
English
0
0
1
86
vx-underground
vx-underground@vxunderground·
I've got a really silly idea for malware. Windows 11 now have Windows.Graphics from the Windows Runtime API. You can use it for taking screenshots. It's supposed to be better than the native WINAPI method because something about GPU rendering stuff, I don't know, I can't remember. Anyway Windows 11 also ships with an OCR library from the Windows-something-something in the WinRT as part of their AI stuff. The point being: I think I can take a fancy screenshot of an application, like Slack, Microsoft Teams, or Discord, using WinRT then use WinRT to OCR it into readable and parseable text from C/C++ It is basically a really convoluted way to do keylogging or espionage, or whatever. For extra flavor, use WinRT to upload the OCRd text to a remote host. Why do this instead of WinHTTP or Windows Sockets? Literally no reason other than curiosity. I have no idea how this would appear under the scope of an EDR. Sometimes you need to try silly things.
English
30
28
749
141.6K
0xMado 
0xMado @0x1334·
Built SilentLens , a C++ tool inspired by @vxunderground idea: use WinRT's Windows. .Capture for screenshots + Windows .Media.Ocr for text extraction. Zero GDI, zero Tesseract, zero imports a YARA rule would flag. Full source: github.com/0xMohammedHass…
English
0
0
0
37
0xMado 
0xMado @0x1334·
@vxunderground Not quite. Combining GraphicsCaptureItem, Windows.Media.Ocr, and Windows.Web.Http uses pure WinRT via RoActivateInstance into runtime class DLLs, bypassing many classic Win32 user-mode hooks. However, ETW providers (Graphics-Capture, DwmCore) can still observe it
English
0
0
0
1.2K
0xMado 
0xMado @0x1334·
@NoahKingJr Claude can write a sentence about EFLAGS liveness.. I wrote a per-basic-block dataflow model for it in C++, wired it into a Zydis-based polymorphic PE rewriter, and made it bisect Microsoft Defender's signature anchors over MpCmdRun..
English
0
0
4
969
Noah
Noah@NoahKingJr·
TELL ME SOMETHING YOU CAN DO THAT CLAUDE CANNOT
English
3.1K
71
1.8K
903.1K
0xMado 
0xMado @0x1334·
@vxunderground Their decision to normalize AI-generated vibe coding into production without clearly stated safeguards is a risky move that undermines sound security and engineering discipline .. even for a company like Coinbase..
English
0
0
0
196
vx-underground
vx-underground@vxunderground·
CEO of Coinbase sends out catastrophic message this morning. 1. Laid off over 2,000 people. This message to laid off people was written using AI. 2. Code being pushed to prod is vibe coded. He admits that. That is absolutely terrifying.
Brian Armstrong@brian_armstrong

This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian

English
251
548
9.5K
1M
0xMado 
0xMado @0x1334·
Honest about scope: -> No 3rd-party security audit. No fuzzing. No code signing. Run inside a snapshot-revertable VM. -> No confirmed-malware corpus runs yet. Synthetic samples only. -> x64: /MD and /MT MSVC PEs work past CRT-init. Many other x64 binaries still hang there.
English
0
0
1
31
0xMado 
0xMado @0x1334·
After 6 years of intermittent weekend work since 2019, I'm finally shipping MalEmu v0.7.0-rc.1. It's a Win32-first malware emulator that runs PEs inside Unicorn and auto-maps the runtime trace to MITRE ATT&CK + capa + YARA in one JSON report. #MalwareAnalysis #DFIR
0xMado  tweet media
English
5
0
0
78