PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Spectre is not a Bug, it is a Feature

blog.quarkslab.com | research | #obfuscation | #spectre | #side-channel | #program-analysis | #quarkslab | #anti-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Turning the Spectre vulnerability into an obfuscation feature: a shadow_memcpy primitive that hides data flow from static and dynamic analysis, enabling opaque predicates and opaque function calls.
Published
Collected

Related coverage

research · blog.quarkslab.com
Defeating AI-Assisted Reverse Engineering (or at Least Trying To)
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.washi.dev
Confusing .NET Debuggers: Proxy Objects
Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
blog · 0xpat.github.io
Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming
Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
BSIM explained once and for all!
Quarkslab finally explains Ghidra's BSIM internals: functions are lifted to normalized P-code, hashed into feature vectors, and compared to find semantically equivalent functions.
Back