PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

QBDI 0.7.0

blog.quarkslab.com | research | #android | #reverse-engineering | #release | #dynamic-instrumentation | #qbdi | #lief
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

QBDI 0.7.0 adds x86 support; the post walks through a Tencent packer use case where QBDI and LIEF instrument the decoding routine to recover a protected .text section on Android.
Published
Collected

Related coverage

research · blog.quarkslab.com
QBDI vs TritonDSE against a VM: who will be the fastest?
Quarkslab solves a custom-VM CTF challenge twice — with symbolic execution engine TritonDSE and instrumentation framework QBDI — and compares which approach gets to the solution fastest.
research · blog.quarkslab.com
QBDI 0.8.0
QBDI 0.8.0 adds SIMD memory access support, a new InstrRuleCallback for advanced instrumentation, and performance improvements; the notes also cover LLVM 10-related analysis changes.
research · blog.quarkslab.com
Android Native Library Analysis with QBDI
How QBDI's dynamic instrumentation, now with Thumb/Thumb2 and NEON support, helps reverse obfuscated Android JNI libraries, switching between instrumented code and native calls via ExecBrocker.
research · blog.quarkslab.com
LIEF 0.9
LIEF 0.9 release: adds parsing support for Android ART formats (OAT, VDEX, DEX, ART) and JSON serialization for all objects, with a look at upcoming Mach-O improvements.
research · blog.quarkslab.com
Have fun with LIEF and Executable Formats
LIEF 0.8.3: automated testing and packaging, a Dockerlief cross-compile utility, LibFuzzer integration for the ELF/PE/Mach-O parsers, and support for renaming ELF dynamic symbols via PT_DYNAMIC.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back