Reverse Engineering

Introduction A bunch of random Human “ideas” in the age of AI.

This Monday Apple’s Security Bulletin finally brought the bad news I had been waiting for a long time (because I’m a very curious person and like to experiment!).

By serendipity I just noticed that this blog 18th birthday was four days ago!

The APT Down leak contained four code signing certificates and the passphrase only for the most recent one.

This weekend two real hackers leaked the results of an hack to a possible APT linked to China and/or North Korea.

I haven’t seen this trick in the wild (and couldn’t find any references) and I’m dumbfounded as to why I didn’t notice it before.

A few weeks ago, Copycat sent me an email asking if I knew anything about the TNT warez group macOS cracks.

Flare-On 2024 is gone and I just made a presentation about the challenge #5 at the local meetup called 0xOpoSec.

I apologize if this information is already known, but I couldn’t find any references about it and I wanted to understand what was going on and share with you because I think there is some value doing it.

Note: the original post was written in 2017 when there weren’t many posts discussing direct attacks to firmware flash.

Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools.

Almost two years ago (when covid was just starting and we all happily ignored it) I wrote a post about implementing x86 hardware breakpoints in lldb.

For quite some time I have wanted to build a site where I could share links to the stuff I read online.

Amnesty International finally dropped the bomb and released a report about FinSpy spyware made by FinFisher Gmbh.

No.

Lately I have been working on a new blog post about running macOS on Ryzen via KVM/QEMU.

Note to original post: This post was originally written back in May 2019 but was removed because of “pressure” from my employer at the time, Apple.

Because I can :-) I was going to write a longer post about this but it is pretty much irrelevant.

These days the de facto debugger in macOS is LLDB.

In 2016 I reversed Apple’s EFI firmware password reset scheme using SCBO files.

Passwords are a modern annoyance and their diversity is something you can’t avoid if you want a minimum amount of account security (don’t forget to turn on those 2FA options, avoiding SMS versions if possible).

I was bored this weekend and decided to take some rust out of my reversing skills before they disappear for good.

Many years ago I had to use gdb for the first time and I absolutely hated it.

Happy New Year and happy ten year anniversary to this blog, which I totally forgot back in October :-/.

This is a guest post by a young and talented Portuguese exploiter, Federico Bento.

American fuzzy lop aka AFL is one of the easiest and best fuzzers out there and should be part of your development cycle if you care at least one bit about the security of your code.

This page has moved to its own website.

The project has moved to GitHub at https://github.com/gdbinit/gdbinit.

So I finally decided to bite the bullet and migrate from Wordpress to Hugo.

Some time ago a friend received a mysterious USB pen with a note talking about some kind of heavily persistent malware.

EFI Swiss Knife - An IDA plugin to improve (U)EFI reversing

Little Snitch was among the first software packages I tried to reverse and crack when I started using Macs.

My original goal when I started poking around Apple’s EFI implementation was to find a way to reset a MacBook’s firmware password.

The exploit for the bug I presented last March at SyScan360 is today one year old so I decided to release it.

Nothing 😃.

Two days ago El Capitan 10.11.3 was released together with security updates for Yosemite and Mavericks.

Last month Patrick Wardle presented Exposing Gatekeeper at VB2015 Prague.

Finally back home from China and Japan tour, so it’s time to finally release the updated slides about EFI Monsters.

El Capitan is finally released and System Integrity Protection aka SIP aka rootless is finally a reality we must face.

The following is a guest post by noar (@noarfromspace), a long time friend.

I guess my goal for the remaining 2015 of not doing any presentations will not happen.

The suspend/resume vulnerability disclosed a few weeks ago (named Prince Harming by Katie Moussouris) turned out to be a zero day.

If you are a rootkits fan the latest Chaos Communication Congress (CCC) in 2014 brought us two excellent presentations, Thunderstrike by Trammell Hudson and Attacks on UEFI security, inspired by Darth Venami’s misery and Speed Racer by Rafal Wojtczuk and…

The rootpipe vulnerability was finally fully disclosed last week after a couple of months of expectation since its first announcement.

Santa is a binary whitelisting/blacklisting system made by Google Macintosh Operations Team.

The last SyScan is almost here so it’s time to get again into a plane and travel to Singapore.

Hummm this is something that I should have done a long time ago but was always too lazy since there’s not highly critical information here (except some hashes and my PGP key/id).

A few days late but, Happy New Year!

Today a local privilege escalation vulnerability was disclosed in this blog post.

Let me present you another TrustedBSD policy module, this time to control execution of suid enabled binaries.