2023年5月26日 星期五

Hackerhubb.blogspot.com

Hackerhubb.blogspot.comRelated news
張貼者： 於 沒有留言:

2023年5月25日 星期四

Emulating Shellcodes - Chapter 1

 There are many basic shellcodes that can be emulated from the beginning from the end providing IOC like where is connecting and so on. But what can we do when the emulation get stuck at some point?

The console has many tools to interact with the emulator like it was a debugger but the shellcode really is not being executed so is safer than a debugger.

target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin -vv 


In some shellcodes the emulator emulates millions of instructions without problem, but in this case at instruction number 176 there is a crash, the [esp + 30h] contain an unexpected 0xffffffff.

There are two ways to trace the memory, tracing all memory operations with -m or inspecting specific place with -i which allow to use registers to express the memory location:

target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin  -i 'dword ptr [esp + 0x30]'


Now we know that in position 174 the value 0xffffffff is set.

But we have more control if we set the console at first instruction with -c 1 and set a memory breakpoint on write.




This "dec" instruction changes the zero for the 0xffffffff, and the instruction 90 is what actually is changing the stack value.

Lets trace the eax register to see if its a kind of counter or what is doing.


target/release/scemu -f ~/Downloads/shellcodes_matched/drv_shellcode.bin  --reg eax 


Eax is not a counter, is getting hardcoded values which is probably an API name:


In this case this shellcode depend on previous states and crash also in the debugger because of  register values. this is just an example of how to operate in cases where is not fully emulated.

In next chapter will see how to unpack and dump to disk using the emulator.


More articles
張貼者： 於 沒有留言:

2023年5月19日 星期五

New Reliable Source of Mini PC

Dear Sir/Madam,

Wish you all the best. Glad to see from your site that you are leading supplier of computer products, this is Welson Hu from HYSTOU, a mini pc manufacturer since 2014.

You may get many inquiry from your clients about windows 11 computers, here is one to help you:

Palm-sized Mini PC Intel Core i7-8565U Model M2.

CPU: Intel Core i7-8565U up to 4.60 GHz Processor;
RAM: Dual DDR4 up to 64GB memory;
Storage: m.2 NVME SSD + 2.5 inch SATA SSD/HDD, more than 5TB available;
System: Windows 10, windows 11;
PC dimension: 13.8x12.8x6.1 cm

Would you need some pictures of this smart mini pc to show your clients? Thank you.

Sincerely

Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email:  Sales19@hystou.com  
Skype: live:jacy_182
Cel & WhatsApp:  +86 17727927495
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel

張貼者： 於 沒有留言:

2023年4月14日 星期五

Data processing and industrial control Data processing and industrial control - good partner

Dear Sir/Madam,

Good day! This is Welson Hu from Hystou Technology Co limited, we are manufacturer of Mini PC located in Shenzhen China.

You may be happy to find some more new and reliable computer products to fulfill your product line, and gain more additional market share. Here is one suggestion for you:

Name: Mini Industrial PC
Model: K4-i5-4200U
CPU: Intel Core i5-4200U up to 2.6GHz
RAM: 2xDDR3 memory slot, up to 16GB available
Storage: 1 x mSATA SSD + 1 x 2.5 inch SATA SS/HDD
Support OS: Windows 7,10 and Linux

It's popular in Europe and America, you can find it from Amazon, would you know some of your clients already using this kind mini pc? And how much you may get if you sold it to them?

Don't hesitate to contact us if you need any information, thank you.

Sincerely

Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email:  Sales19@hystou.com  
Skype: live:jacy_182
Cel & WhatsApp:  +86 17727927495
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel

張貼者： 於 沒有留言:

2023年3月28日 星期二

Data processing and industrial control Data processing and industrial control - good partner

Dear Sir/Madam,

Wish you enjoy a great day!

I would like to introduce myself. This is Welson Hu from Hystou Technology Co limited in China.

We are glad to know that you are a major supplier of chip information processing related industries.
 
You may want to find a good partner for data processing and control with superior quality & Reasonable prices. We Hystou has been producing and supplying Mini PC since 2014, we have passed ISO9001, and all our products has CE&RoHS certificate.
 
Here is one of the popular Mini PC:

Name: Fanless Mini Industrial PC H4
CPU:Intel Core i7-8500U /Core i5-8250U ;
RAM: Dual DDR4 260 pin SO-Dimm laptop memory, up to 64GB available;
Storage: 1 x m.2 SSD + 1 x mSATA SSD + 1 x 2.5' SATA SSD/HDD, no capacity limitation;
Graphics: Intel® UHD Graphics 620, 1 x HDMI 2.0 (4K), 2 x DP
 
This product can support uninterrupted work 24 hours a week.Would you need some photos and data of this mini computer for your reference? Thank you.

Sincerely

Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email:  Sales19@hystou.com  
Skype: live:jacy_182
Cel & WhatsApp:  +86 17727927495
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel
張貼者： 於 沒有留言:

2023年2月28日 星期二

HYSTOU Home Theatre PC

張貼者： 於 沒有留言:

2023年1月14日 星期六

HYSTOU Home Theatre PC

Dears Sir/Madam:

Good day! This is Hystou Technology Co Limited from China. We are writing to you to establish long-term trade relations with you.
 
From your company web,we get to know that your company is an influence company in your business.We would like to take this opportunity to introduce our company and products.
 
We are a leading company with many years' experience in  the export business of mini pc. You may also visit our online company introduction, which includes our latest product line.
 
Should any of these items be of interest to you, please let us know. We will be happy to give you a quotation upon receipt of your detailed requirements.We look forward to receiving your enquires soon.

Yours faithfully,
Mr. Welson Hu
Sales || Hystou Technology Co., Limited
Email:    
Skype: live:jacy_182
Cel & WhatsApp:  +86 13316972353
Web:   www.hystou.com
Mini PC -Fanless Desktop - Office Computer - AIO- Industrial Computer&Panel

張貼者： 於 沒有留言:
訂閱： 意見 (Atom)