8 posts in tag Demo
Recording a Crash with REVEN Project Manager
In this video, we will have a look at the Project Manager UI, which is the tool REVEN provides to enable users to manage virtual machines and scenarios. As far as scenarios are concerned, the Project Manager allows to record scenarios and generate data resources for the RE analysis. We...
Analyzing CVE-2018-8653 with REVEN: Use-after-Free in Internet Explorer Scripting Engine
10 Mar 2020
by
Luc
-
Technical
-
Use After Free
UaF
Reverse Engineering
Garbage Collector
Memory Management
CVE
Demo
Reven
In this post we will have a look at the proof of concept for CVE-2018-8653 that comes from a very interesting blog post from Philippe Laulheret et al. at MacAfee Labs. To summarize, the vulnerability exploits various seemingly innocent behaviors in Internet Explorer’s scripting engine (jscript.dll) to trigger a use-after-free...
Analysis of CVE-2019-0708, a.k.a. BlueKeep, with REVEN: Another point of view
22 Jan 2020
by
Luc
-
Technical
-
Use-after-free
UaF
Reverse Engineering
Garbage Collector
Memory Management
CVE
Demo
Reven
Bluekeep (CVE-2019-0708) is a security vulnerability that was discovered in Microsoft’s Remote Desktop Protocol, which allows remote code execution. At least one analysis already describes precisely this vulnerability with a specific approach. This blog post aims to demonstrate how REVEN can be used to analyze the crash, the root cause...
Analyzing an Out-of-Bounds read in a TTF font file
In this post we will analyze some specific points from the proof of concept for CVE-2019-1244, that has been found by Mateusz @j00ru Jurczyk. This vulnerability is a user-mode out-of-bounds read in Microsoft DirectWrite function dwrite.dll!sfac_GetSbitBitmap while processing a TTF font file. Our starting point is a first recording of...
Analysis of the Uroburos malware with REVEN
12 Jun 2019
by
Luc
and Mathieu
-
Technical
-
Reverse Engineering
Malware Analysis
Windows Kernel
Demo
Reven
In this post, we present how Timeless Analysis can be used to analyze a few mechanisms of a Uroburos recent version. We use REVEN and its integration with Volatility and IDA to detect indicators of compromise, analyze the dropping mechanisms and circumvent tricks the malware uses to hide itself. The...
Windows boot from UEFI to kernel
20 May 2019
by
Mathieu
-
Technical
-
Reverse Engineering
Windows Kernel
Windows boot
UEFI
Demo
Reven
Getting full visibility into the Windows 10 OS’ boot mechanisms is challenging. REVEN opens up a new world of possibilities with its timeless analysis technology! We used REVEN to record the Windows OS’ boot process, all the way from before the UEFI firmware transfers control to the boot process, to...
Full visibility of a Windows Kernel Bug with Timeless Analysis (CVE-2018-8410)
One of the situations where REVEN (aka Tetrane) really shines is digging into undocumented kernel mechanisms, especially in cases where WinDBG abstracts information away from the user. In the following video, we will analyze a reference counting bug in the Windows Kernel (CVE-2018-8410 published by Google Project Zero) and try...
Analysis of VLC Exploit Arbitrary Code Execution (CVE-2018-11529)
This is the analysis of VLC Exploit Arbitrary Code Execution (CVE-2018-11529) done REVEN v2. It leverages our timeless analysis technology and several key features:
Data Tainting
Memory History
Backtrace
etc.
