@JustasMasiulis Profile picture

Justas Masiulis

@JustasMasiulis

RE | Windows Kernel | @the_secret_club

Similar User
namazso photo

@namazso

Duncan Ogilvie 🍍 photo

@mrexodia

Aidan Khoury photo

@aidankhoury

vmcall photo

@vm_call

IDontCode photo

@_xeroxz

HyperDbg photo

@HyperDbg

Daax photo

@daaximus

Andrea Allievi photo

@aall86

Connor McGarr photo

@33y0re

iPower photo

@iPowerPower

Sinaei photo

@Intel80x86

Satoshi Tanda photo

@standa_t

Petr Beneš photo

@PetrBenes

Can Bölük photo

@_can1357

Adam Niezabitowski photo

@_0xnobody_

Pinned

Happy to release a neat little plugin for IDA Pro! Bitfield and bitflag accesses have been an annoyance that requires another window open and constant fiddling. You can now fix that with just a few key presses! github.com/JustasMasiulis…

Tweet Image 1

Justas Masiulis Reposted

New blog entry: C++ Unwind Metadata: A Hidden Reverse Engineering Bonanza msreverseengineering.com/blog/2024/8/20…

Tweet Image 1

Justas Masiulis Reposted

YOLO in life, not in cryptography. Using Custom hash constructions is risky; here’s why and what standardized methods to use instead. buff.ly/3WTYnXh

Tweet Image 1

🚨 Trying to find the NTDLL base? 🔥 EDRs ♿ hate this ONE WEIRD TRICK! LEARN HOW YOU 🫵 CAN TOO! #shocking #redteamtips #security #redteam

Tweet Image 1

Justas Masiulis Reposted

Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles. It has worked against every version of Patchguard for the last 7 years, without needing any updates! blog.can.ac/2024/06/28/pgc…


Justas Masiulis Reposted

“Previously available to Windows security features only, VBS enclaves are now available to third-party application developers” Very cool. Waiting for more details :)

New blog announcing new security capabilities for Windows 11 at #BUILD microsoft.com/en-us/security…



Justas Masiulis Reposted

CFG in Windows 11 24H2 ynwarcs.github.io/Win11-24H2-CFG


Justas Masiulis Reposted

vanguard 2 now on league of legends, cheating to be deprecated this patch leagueoflegends.com/en-au/news/gam…


Seems like there is malware abusing GitHub attachments to create file links in legitimate repositories. Here's a funny example github.com/microsoft/MSRC… nothing special, but just seemed neat.


Justas Masiulis Reposted

I try an avoid this hellsite, but I did a quick dive into sudo in Windows and here are my initial findings. tiraniddo.dev/2024/02/sudo-o… The main take away is, writing Rust won't save you from logical bugs :)


Has been out for a while, but does anyone know what does MS plan to do with *SyscallProvider* stuff that replaces the *AltSystemCallHandler*? It also seems to not be protected by "classic" PG (only SK based protection)🙈


Justas Masiulis Reposted

My new blog post for @huntandhackett is finally out! 🥳 "The Definitive Guide to Process Cloning/Forking on Windows" 🔥 Technical and design decisions, attack and defense vectors, features and limitations, code samples… The blog covers them all! huntandhackett.com/blog/the-defin…


Justas Masiulis Reposted

Today, we are releasing RPC Investigator, made for exploring RPC clients and servers on Windows. This .NET application builds on the NtApiDotNet platform, adding features that offer a new way to explore RPC blog.trailofbits.com/2023/01/17/rpc…


Justas Masiulis Reposted

Presenting D-Generate , syscall tracing as its supposed to be! raw.githubusercontent.com/jonaslyk/temp/… usage: dg cmd.exe - displays all syscalls done by process with cmd.exe as imagefile. dg 4736 - by pid 4736 dg - just everything example of recording: raw.githubusercontent.com/jonaslyk/nt/ma…

Tweet Image 1

Justas Masiulis Reposted

Improving MBA Deobfuscation using Equality Saturation by @fvrmatteo and @mr_phrazer secret.club/2022/08/08/eqs…


Justas Masiulis Reposted

My full-binary, static type reconstruction toolkit is becoming increasingly robust. Pictured are fully-automated results from RPCRT4/x64, an experiment to see if public PDBs make the problem any easier than the stripped case (answer: not by much). Bootleg private PDBs!

Tweet Image 1
Tweet Image 2
Tweet Image 3
Tweet Image 4

Justas Masiulis Reposted

Been experimenting with Hex-Rays API today and wrote a plugin that simplifies NT Kernel decompilation. So far it can remove instrumentation, lift dynrelocs and RSB flushes. Source code and the binary are below, let me know if you have any feedback! github.com/can1357/NtRays

Tweet Image 1
Tweet Image 2
Tweet Image 3

Justas Masiulis Reposted

So can we get an explanation? PH doesn't allow kernel writes at all and reads are limited to binary images. Or is "responsible disclosure" something that only applies to Microsoft where they get to hound people like @0xAmit on LinkedIn after they mention a bug known for 4 years?


Loading...

Something went wrong.


Something went wrong.