默默新聞08

2023年5月25日星期四

Emulating Shellcodes - Chapter 1

There are many basic shellcodes that can be emulated from the beginning from the end providing IOC like where is connecting and so on. But what can we do when the emulation get stuck at some point?

The console has many tools to interact with the emulator like it was a debugger but the shellcode really is not being executed so is safer than a debugger.

target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin -vv

In some shellcodes the emulator emulates millions of instructions without problem, but in this case at instruction number 176 there is a crash, the [esp + 30h] contain an unexpected 0xffffffff.

There are two ways to trace the memory, tracing all memory operations with -m or inspecting specific place with -i which allow to use registers to express the memory location:

target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin -i 'dword ptr [esp + 0x30]'

Now we know that in position 174 the value 0xffffffff is set.

But we have more control if we set the console at first instruction with -c 1 and set a memory breakpoint on write.

This "dec" instruction changes the zero for the 0xffffffff, and the instruction 90 is what actually is changing the stack value.

Lets trace the eax register to see if its a kind of counter or what is doing.

target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin --reg eax

Eax is not a counter, is getting hardcoded values which is probably an API name:

In this case this shellcode depend on previous states and crash also in the debugger because of register values. this is just an example of how to operate in cases where is not fully emulated.

In next chapter will see how to unpack and dump to disk using the emulator.

More articles

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2023年5月19日星期五

New Reliable Source of Mini PC

Dear Sir/Madam,

Wish you all the best. Glad to see from your site that you are leading supplier of computer products, this is Welson Hu from HYSTOU, a mini pc manufacturer since 2014.

You may get many inquiry from your clients about windows 11 computers, here is one to help you:

Palm-sized Mini PC Intel Core i7-8565U Model M2.

CPU: Intel Core i7-8565U up to 4.60 GHz Processor;
RAM: Dual DDR4 up to 64GB memory;
Storage: m.2 NVME SSD + 2.5 inch SATA SSD/HDD, more than 5TB available;
System: Windows 10, windows 11;
PC dimension: 13.8x12.8x6.1 cm

Would you need some pictures of this smart mini pc to show your clients? Thank you.

Sincerely

Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email: Sales19@hystou.com
Skype: live:jacy_182
Cel & WhatsApp:  +86 17727927495
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2023年4月14日星期五

Data processing and industrial control Data processing and industrial control - good partner

Dear Sir/Madam,

Good day! This is Welson Hu from Hystou Technology Co limited, we are manufacturer of Mini PC located in Shenzhen China.

You may be happy to find some more new and reliable computer products to fulfill your product line, and gain more additional market share. Here is one suggestion for you:

Name: Mini Industrial PC
Model: K4-i5-4200U
CPU: Intel Core i5-4200U up to 2.6GHz
RAM: 2xDDR3 memory slot, up to 16GB available
Storage: 1 x mSATA SSD + 1 x 2.5 inch SATA SS/HDD
Support OS: Windows 7,10 and Linux

It's popular in Europe and America, you can find it from Amazon, would you know some of your clients already using this kind mini pc? And how much you may get if you sold it to them?

Don't hesitate to contact us if you need any information, thank you.

Sincerely

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2023年3月28日星期二

Data processing and industrial control Data processing and industrial control - good partner

Dear Sir/Madam,

Wish you enjoy a great day!

I would like to introduce myself. This is Welson Hu from Hystou Technology Co limited in China.

We are glad to know that you are a major supplier of chip information processing related industries.

You may want to find a good partner for data processing and control with superior quality & Reasonable prices. We Hystou has been producing and supplying Mini PC since 2014, we have passed ISO9001, and all our products has CE&RoHS certificate.

Here is one of the popular Mini PC:

Name: Fanless Mini Industrial PC H4
CPU:Intel Core i7-8500U /Core i5-8250U ;
RAM: Dual DDR4 260 pin SO-Dimm laptop memory, up to 64GB available;
Storage: 1 x m.2 SSD + 1 x mSATA SSD + 1 x 2.5' SATA SSD/HDD, no capacity limitation;
Graphics: Intel® UHD Graphics 620, 1 x HDMI 2.0 (4K), 2 x DP

This product can support uninterrupted work 24 hours a week.Would you need some photos and data of this mini computer for your reference? Thank you.

Sincerely

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2023年2月28日星期二

HYSTOU Home Theatre PC

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2023年1月14日星期六

HYSTOU Home Theatre PC

Dears Sir/Madam:

Good day! This is Hystou Technology Co Limited from China. We are writing to you to establish long-term trade relations with you.

From your company web,we get to know that your company is an influence company in your business.We would like to take this opportunity to introduce our company and products.

We are a leading company with many years' experience in the export business of mini pc. You may also visit our online company introduction, which includes our latest product line.

Should any of these items be of interest to you, please let us know. We will be happy to give you a quotation upon receipt of your detailed requirements.We look forward to receiving your enquires soon.

Yours faithfully,
Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email:  Sales19@hystou.com
Skype: live:jacy_182
Cel & WhatsApp:  +86 13316972353
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel

歡迎蒞臨：https://ofa588.com/

娛樂推薦：https://www.ofa86.com/

2022年12月19日星期一

Update to New York Times Terms of Sale, Terms of Service and Privacy Policy

Information about latest updates.

Help | View in Browser

Update to New York Times Terms of Sale, Terms of Service and Privacy Policy

Dear Reader,

We are writing to let you know that we have updated our Terms of Sale, Terms of Service and Privacy Policy, which apply to your use of our products and services. Below is a summary of the key changes:

We have updated our Terms of Sale and have made the following key changes:
- made our Terms of Sale easier to understand, including providing more clarity regarding our billing, credit and subscription practices;
- added information regarding our print products and services, including home delivery;
- included information regarding our International edition; and
- provided information about rights available to consumers in certain jurisdictions outside the United States.
We have updated our Terms of Service to add an arbitration clause that covers any disputes relating to our policies, your relationship with us as a subscriber, and your use of our products and services; and
We have updated our Privacy Policy to address new legal requirements, including how to exercise new rights available to some of our users, and to update metrics regarding how we honored the rights of California residents last year. We have also reorganized the policy to make it easier to navigate, and added more detail regarding the information we collect and why, how we use it and how we may share it.

These updates do not apply to our new subsidiary The Athletic, which has its own Terms and Privacy Policy.

We encourage you to review the updated Terms of Sale, Terms of Service and Privacy Policy. By continuing to use our products and services on or after the last updated date on the document in question, you agree to our updated Terms of Sale, Terms of Service and Privacy Policy. These documents will be available to you anytime you need them through the links on our home page.

Note: This is a legal notice, which is why you are receiving it even if you have opted out of New York Times marketing and promotional emails.