Super Sheep (@[email protected])
1.1K posts
Super Sheep (@[email protected])
@Qutluch
When these frail shadows we inhabit now have quit the stage, we'll meet and raise a glass again together in Valhalla.
Ireland Katılım Temmuz 2010
3K Takip Edilen443 Takipçiler
The Kildare Amateur Radio Club in Ireland is doing a special event station for this weekend and St Patrick's Day.
kildarearc.com/2026/02/02/ei0…
I'll be posting the current club operator's frequency here as people change around. If people are interested in chasing. #hamradio
English
Last year I got my HAM radio license and I've been really enjoying the hobby. For this weekend and St. Patrick's Day I'm going to be posting HAM radio information.
English
@allthingsida I've been using idasql through Claude Code for a few weeks now and it's amazing. For validation I use windbg-agent, also from Elias, and have Claude validate its own findings from a TTD trace file. Incredible power up in my RE arsenal.
English
In this scenario, I let loose idasql+Codex CLI on a malicious C++ EXE and let it tell me how it works, write a report, find embedded keys, IOCs, rebuild the sources, etc.
Basically just vibe RE. Barely touched IDA UI, only to verify and navigate a bit.
allthingsida@allthingsida
In this scenario, I started Copilot CLI in autopilot mode, and prompted it with the "/idasql" skill and pointed it at an exe nearby and asked it to decompile it cleanly back to source code, build it and test it. Around 10 minutes later, I got back the full source code. It boils down to the harness, the underlying model, and the instructions, skills, prompting and associated tooling. Pick your tool. The same experiment should be possible with bnsql.
English
Super Sheep (@[email protected]) retweetledi
“A nice, quiet Christmas. No unusual incidents or people turning up.”
English
Super Sheep (@[email protected]) retweetledi
#ESETresearch discovered unique toolset, we named QuietEnvelope, targeting the MailGates email protection system of Taiwanese company OpenFind. The toolset was uploaded in anarchive, named spam_log.7z, to VirusTotal from Taiwan 🇹🇼. It contains Perl scripts, three stealthy passive backdoors, an argument runner, and miscellaneous files. 1/7
English
Super Sheep (@[email protected]) retweetledi
Super Sheep (@[email protected]) retweetledi
Having read this now what's going on here is actually a lot more interesting than ordinary process injection. The PRC group here is bypassing FreeBSD's application control mechanism by abusing built-in functionality (Lolbins) to read and execute raw binary shellcode from disk. 🤨
Dino A. Dai Zovi@dinodaizovi
This is an interesting case study because it concretely shows that you have to go further than allowlisting known/trusted executables, they also need runtime memory integrity protection/guarantees: cloud.google.com/blog/topics/th… Ideally, page-level integrity like iOS in your vm impl.
English
Super Sheep (@[email protected]) retweetledi
(LLVM) implementation of APT41's Scatterbrain obfuscator for adversary emulation (validation, limitations, and suggests evasion improvements suggestions)
retooling.io/blog/my-emulat…
Credits @DrCh40s, @t0nvi (Retooling)
#malware #cybersecurity
English
Super Sheep (@[email protected]) retweetledi
Support us on Patreon 💕
Tools
- x64dbg (x64dbg.com)
- IDA (hex-rays.com/ida-free)
- VMPDump (github.com/0xnobody/vmpdu…)
Additional Learning Resources
- Sandbox Tricks For Faster Reversing (youtube.com/watch?v=rDQmh1…)
- MSVC Entry Point and Security Init Cookie (patreon.com/posts/why-is-p…)
- Unpacking VMP - Full Series (patreon.com/collection/155…)
Original packed sample:
8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0
(malshare.com/sample.php?act…)
Clean unpacked payload (fixed OEP):
ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7
(malshare.com/sample.php?act…)
YouTube
English
Super Sheep (@[email protected]) retweetledi
Cracking the Crackers
Reversing the TNT team macOS crack library to understand if there is malware due to patching of pro-Ukraine support messages. With deobfuscators and dumper tools pushed to Github.
Have fun :-]
reverse.put.as/2025/03/13/cra…
English
Super Sheep (@[email protected]) retweetledi
Linux may offer a wider range of distributions, but the level of stability and performance we’ve experienced with #FreeBSD has been unmatched.dzone.com/articles/why-w…
English
@UK_Daniel_Card I feel like if you put this on top of the open source synapse from Vertex you'd make a huge impact to community tooling for CTI modelling.
English
