Jan 30, 2023
This is very interesting. Russia is sending combat robots to Ukraine for testing. It will be interesting to see how they perform, their capabilities and limitations.
-
-
-
Bypassing (some) EDR stack trace based detections
First part of this series explains the trick used to bypass EDR.
https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/Essentially, call an ntdll function that takes a callback as an argument, rather than calling the API wrappers. To ensure the stack is clean, the ntdll function is executed in another thread. Now the code has no dodgy parent from some weird memory region.
0xdarkvortex.dev/hiding-in-plai…
For a load of other tricks from a bygone era, check out an article I wrote for Phrack twenty years ago. We had to release it anonymously because myself and the other co-author worked for companies that produced HIPS products. Jamey Butler wrote the shellcode included in the article. We’d agreed that everyone would be anonymous, but things didn’t work out like that.
https://github.com/grugq/grugq.github.com/blob/master/docs/phrack-62-05.txt-
-
Features: - support for HiDPI displays - support for Zlib-compressed sections used on AMI-based boards for AMD CPUs - several small fixes
