5 posts in archive

REVEN Tainting and APIs for automation

07 Apr 2020 by Louis - Tutorial Automation - Demo Reven API

This demo focuses on 2 areas: The REVEN data flow tainting feature that makes it easy to follow data across processes using IPC or local network communications The REVEN Python API to automate analysis tasks, used here for data tainting. The example is based on the application Tokio chat with...

Recording a Crash with REVEN Project Manager

24 Mar 2020 by Mathieu - Tutorial - Demo Reven Scenario recording

In this video, we will have a look at the Project Manager UI, which is the tool REVEN provides to enable users to manage virtual machines and scenarios. As far as scenarios are concerned, the Project Manager allows to record scenarios and generate data resources for the RE analysis. We...

Analyzing CVE-2018-8653 with REVEN: Use-after-Free in Internet Explorer Scripting Engine

10 Mar 2020 by Luc - Technical - Use After Free UaF Reverse Engineering Garbage Collector Memory Management CVE Demo Reven

In this post we will have a look at the proof of concept for CVE-2018-8653 that comes from a very interesting blog post from Philippe Laulheret et al. at MacAfee Labs. To summarize, the vulnerability exploits various seemingly innocent behaviors in Internet Explorer’s scripting engine (jscript.dll) to trigger a use-after-free...

Tetrane launches REVEN Professional Edition

04 Feb 2020 by Marc and Benoit - Reven - Reven Announcement Releases

Tetrane launches REVEN Professional Edition! You were many to request and wait for a lighter, more accessible, more affordable version of REVEN. Here it is! REVEN Professional Edition democratizes full-system timeless analysis for vulnerability and malware analysis. Now, it is directly available for purchase on TETRANE website REVEN Professional Edition...

Analysis of CVE-2019-0708, a.k.a. BlueKeep, with REVEN: Another point of view

22 Jan 2020 by Luc - Technical - Use-after-free UaF Reverse Engineering Garbage Collector Memory Management CVE Demo Reven

Bluekeep (CVE-2019-0708) is a security vulnerability that was discovered in Microsoft’s Remote Desktop Protocol, which allows remote code execution. At least one analysis already describes precisely this vulnerability with a specific approach. This blog post aims to demonstrate how REVEN can be used to analyze the crash, the root cause...