PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Windows 8 ate my cookie

blog.quarkslab.com | research | #windows | #reverse-engineering | #debugging | #mitigation | #stack-cookie
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Windows 8's stack-cookie protection investigated: the default cookie is already randomised before a program's entry point, so the authors use kernel debugging to find which loader code sets it.
Published
Collected

Related coverage

research · blog.quarkslab.com
Linux kernel instrumentation from Qemu and Gdb
A tutorial on instrumenting the Linux kernel from QEMU and GDB: using a hypervisor for stealthy analysis, plus GDB scripting and kernel helper tools to monitor syscalls, processes and modules.
research · blog.quarkslab.com
Debugging Windows Isolated User Mode (IUM) Processes
How to debug Windows Isolated User Mode (IUM) processes, aka Trustlets: using Hyper-V's virtual TPM as the target, with background on Virtual Secure Mode and Virtual Trust Levels.
research · blog.quarkslab.com
LLDBagility: practical macOS kernel debugging
Presents LLDBagility, which attaches LLDB to a VirtualBox macOS VM via the Fast Debugging Protocol for kernel breakpoints, watchpoints and pause — no debug kernel or SIP changes needed.
research · blog.quarkslab.com
An overview of macOS kernel debugging
First of two posts on macOS kernel debugging: kernel debugger fundamentals, how debugging is implemented for XNU, and the limitations of current tooling (debug kernel builds, no watchpoints).
research · blog.quarkslab.com
qb-sync v2
qb-sync v2 brings multi-IDB sync to the IDA/WinDbg bridge via a broker/dispatcher design, fixes module detection with IDebugSymbols2, and adds IDA shortcuts to drive WinDbg with automatic rebasing.
research · blog.quarkslab.com
qb-sync
qb-sync is an open source tool to add some helpful glue between IDA Pro and Windbg. Its core feature is to dynamically synchronize IDA's graph windows with Windbg's position.
Back