Tetrane's BLOG
Full visibility of a Windows Kernel Bug with Timeless Analysis (CVE-2018-8410)
One of the situations where REVEN (aka Tetrane) really shines is digging into undocumented kernel mechanisms, especially in cases where WinDBG abstracts information away from the user. In the following video, we will analyze a reference counting bug in the Windows Kernel (CVE-2018-8410 published by Google Project Zero) and try...
Updated Analysis of PatchGuard on Microsoft Windows 10 RS4
Since Windows 64b, PatchGuard has been of great interest in Windows security. In this white-paper, you will access our research done using REVEN v2. For most iterations of its development, several people have analyzed its main mechanisms and internals which, many times, led to a functional bypass. Researchers seem to...
Analysis of VLC Exploit Arbitrary Code Execution (CVE-2018-11529)
This is the analysis of VLC Exploit Arbitrary Code Execution (CVE-2018-11529) done REVEN v2. It leverages our timeless analysis technology and several key features:
Data Tainting
Memory History
Backtrace
etc.
Analyzing CVE-2015-0350 with REVEN
In this article we will show how we analyzed and tamper the PoC for CVE-2015-0350, an Adobe Flash vulnerability located in the parsing of JPEG-XR images, with the help of timeless analysis. With REVEN v1.5.0, from an input file causing a crash, we analyze the vulnerability by instantly time-traveling to...
Reversing DirtyC0W
Everybody keeps in mind the Dirtyc0w Linux kernel bug. For those who don’t, take some time to refresh your memory here. The kernel race condition is triggered from user-space and can easily lead a random local user to write into any root owned file. In this article, we will demonstrate...
Unfolding obfuscated code with Reven (part 2)
Last time, by abstracting the runtime effect of the first virtual machine, we have reduced the challenge to a simpler but semantically equivalent program. Its control flow graph has a unique entry point as the basic block starting at 0x402048, whereas ones at 0x4023d4 and at 0x40266e are exit points...
Reversing Windows 7 BSoD display
In this post we’ll try to reverse Windows 7 BSoD using REVEN Axion in order to generate an image from memory and port accesses. Find which video mode is used As a first step, we will need to know which [video mode][wiki-output-caps] is used by the BSoD. To achieve this...
Unfolding obfuscated code with Reven (part 1, full write-up)
In this article, we present a reverse engineering task performed using Reven. This is the full write-up corresponding to a first overview published in October. The binary examined here is F4b_XOR_W4kfu, the challenge scoring the highest number of points over all categories (cryptography, exploit, reverse engineering, etc.) in Grehack 2015’s...
Unfolding obfuscated code (part 1)
01 Oct 2016
by
tdta, Fred, Mathieu, Benoit
-
Technical
-
Reverse Engineering
Deobfuscation
ctf
Reven
This article is the first one in a series of two. We present an overview of some reverse engineering capabilities of REVEN-Axion, applied to a publicly available challenge, namely F4b_XOR_W4kfu, the most valued at Grehack 2015’s CTF contest (500 points). A more detailed write-up will be published soon for those interested....
Making your own REVEN Axion plugin step by step
In this article we will shed light on REVEN Axion’s customisation possibilities by describing step by step how to create a simple plugin. Percent plugin in action on push edi. We will walk you through: The specification of our plugin The basics of plugin API for REVEN Axion The implementation...
Older Posts