Security Research and Reverse Engineering
Machines, Networks, Security, and Reversing
Research
-
Banished to the Shadow Realm: Mutation of the Volume Shadow Copy for anti-forensics
Exploring file-level changes to Windows Volume Shadow Copies with a Rust proof of concept and their implications for digital forensics.
-
USNJMon: Monitoring NTFS File Changes for Threat Hunting
A proof-of-concept Rust utility that turns NTFS USN Journal changes into Windows event logs for digital forensics and threat hunting.
-
I am Chroot! Host File Read in angr
A host-file read in angr's chroot SimProcedure, its impact on symbolic execution, and the fix to keep guest paths within the simulated filesystem.
-
Pickle Surprise: Pickle deserialization RCE in oauth2client
A look at pickle deserialization in oauth2client's Flask integration, its reliance on session signing keys, and lessons for downstream users.
-
TLS Callback Evasion in angr
A pointer-width bug in angr's CLE loader misread 64-bit TLS callback addresses. Here's the root cause, fix, and regression test.