PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

QBinDiff: A modular diffing toolkit

blog.quarkslab.com | tool | #reverse-engineering | #program-analysis | #tool | #quarkslab | #binary-diffing | #graph-matching
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab releases QBinDiff, an experimental binary diffing toolkit that models function matching as graph alignment, demonstrated on binaries and on generic non-security graph problems.
Published
Collected

Related coverage

tool · blog.quarkslab.com
From P-Code to GNN: extract binary code semantics
This coverage gives security teams current context for monitoring, validation, and remediation.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
SightHouse: Automated function identification
Quarkslab presents SightHouse, an open-source reverse-engineering tool that retrieves program metadata and identifies functions already known from other libraries, binaries or online source code.
research · blog.quarkslab.com
Quokka: A Fast and Accurate Binary Exporter
Quarkslab open-sources Quokka, a binary exporter that extracts a program's disassembly for offline analysis, letting users write complex analyses without disassembler APIs.
vulnerability · blog.quarkslab.com
Analysis of MS16-104: .URL files Security Feature Bypass (CVE-2016-3353)
CVE-2016-3353, a .URL file security feature bypass in IE 11 fixed by MS16-104: binary diffing ieframe.dll to locate the patch, understanding the InternetShortcut warning logic, and building a PoC.
tool · blog.quarkslab.com
Blue Galaxy Energy: a new White-box Cryptanalysis Open Source Tool
Quarkslab releases Blue Galaxy Energy, an open-source tool implementing the BGE attack against AES white-box implementations, previously lacking any public implementation.
Back