Order of Six Angles

Дорабатываю доклад про анализ малвари, с помощью LLM, а конкретно IDA MCP server, и презентую обновленный доклад на Sysconf (4 октября, Алматы). Стал использовать Cursor, вместо Cline. В режиме Auto, как я понял, он сам выбирает подходящую модель (gemini, claude, gpt). Попробовал анализировать Rust бинарники, очень хороший результат. В них например трудно найти реальную Main функцию, LLM с этим справилась. Также проверил может ли Cursor строить call graph, результат на скрине. Промпт:

построй граф вызова функции sub_140F05ED0, укажи ее Callers. Также укажи Calee каждой функции  и нарисуй диаграмму в формате Mermaid

Также LLM помогают мне деобфусцировать код (как на скрине 2), обфусцированный с помощью Control flow flattening

1.56K views12:23

Order of Six Angles

Деобфусцированный вариант большой control flow flattened функции

1.3K views12:34

Order of Six Angles

How Does the iOS Kernel Copy Memory? (Virtual Memory Internals)

https://www.youtube.com/watch?v=0hxUEaDp1AA

YouTube

How Does the Kernel Copy Memory so Quickly?

Are you a security researcher or reverse engineer?

For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **

*License discounts are only valid for individuals…

1.32K views04:04

Order of Six Angles

С помощью IDA MCP можно даже дебажить

1.46K views06:07

Order of Six Angles

С помощью IDA MCP можно даже дебажить

1.54K views06:10

Order of Six Angles

RIFT is an open-source tool consisting of a set of IDA Pro (supporting versions >=9.0) plugins and Python scripts that aim to assist reverse engineers and other software analysts in annotating library code in Rust malware.

https://github.com/microsoft/RIFT

GitHub

GitHub - microsoft/RIFT: Rust Library Recognition Project for Rust Malware by the MSTIC-MIRAGE Team

Rust Library Recognition Project for Rust Malware by the MSTIC-MIRAGE Team - microsoft/RIFT

2.57K views10:58

Order of Six Angles

An in-depth exploration of the Qualcomm KGSL Faults Subsystem, including patch analysis and vulnerability insights for CVE-2024-38399.

https://streypaws.github.io/posts/Fast-and-Faulty-A-Use-After-Free-in-KGSL-Fault-Handling/

StreyPaws

Fast & Faulty - A Use After Free in KGSL Fault Handling

An in-depth exploration of the Qualcomm KGSL Faults Subsystem, including patch analysis and vulnerability insights for CVE-2024-38399.

1.67K views04:48

Order of Six Angles

This repository contains slides and hands-on materials for Emproof's workshop on firmware reverse engineering, presented at ScapyCon Automotive 2025. The workshop targets a technical audience with minimal security experience and teaches the fundamentals through practical, self-contained tasks.

https://github.com/emproof-com/workshop_firmware_reverse_engineering

GitHub

GitHub - emproof-com/workshop_firmware_reverse_engineering: Workshop on firmware reverse engineering

Workshop on firmware reverse engineering. Contribute to emproof-com/workshop_firmware_reverse_engineering development by creating an account on GitHub.

3.06K views10:42

Order of Six Angles

Кайфую от liquid glass

1.66K views17:13

Order of Six Angles

101 Chrome Exploitation — Part 1: Architecture

https://opzero.ru/en/press/101-chrome-exploitation-part-1-architecture/

Operation Zero EN

101 Chrome Exploitation — Part 1: Architecture - Operation Zero EN

Modern web browsers have evolved from simple document viewers into sophisticated platforms capable of running complex web applications. At the heart of this transformation lies a carefully orchestrated architecture built around three fundamental components:…