<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[jentle8的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/jentle8</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; jentle8]]></copyright><item><title><![CDATA[Petya 勒索软件分析]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/128839309</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/128839309</guid><author>jentle8</author><pubDate>Wed, 01 Feb 2023 19:42:17 +0800</pubDate><description><![CDATA[勒索软件分析]]></description><category></category></item><item><title><![CDATA[通过BlueNoroff攻击手法发现使用新文件类型绕过MoTW]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/128472977</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/128472977</guid><author>jentle8</author><pubDate>Wed, 28 Dec 2022 19:28:28 +0800</pubDate><description><![CDATA[(MOTW）标志，是一种安全措施，当用户尝试打开从互联网下载的文件时，Windows会通过检查对应的标志显示警告消息，并作出有效限制。例如，当从`internet`获取`Microsoft Office`文件时，]]></description><category></category></item><item><title><![CDATA[剖析Gorgon APT的新变体GuLoader(CloudEyE)对抗技术]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/128015260</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/128015260</guid><author>jentle8</author><pubDate>Thu, 24 Nov 2022 11:42:22 +0800</pubDate><description><![CDATA[GuLoader，或者也被称为 CloudEye，是一个小型 VB5/6 下载器恶意软件。通常，它会从 Google Drive 下载远程访问工具（RAT）和窃取程序，例如 Agent Tesla，Arkei/Vidar，Formbook，Lokibot，Netwire 和 Remcos。]]></description><category></category></item><item><title><![CDATA[软件反调试技术，看这一篇就够了]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/127736370</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/127736370</guid><author>jentle8</author><pubDate>Mon, 07 Nov 2022 18:16:47 +0800</pubDate><description><![CDATA[二进制反调试技术汇总 all in one]]></description><category></category></item><item><title><![CDATA[ida flare_emu模拟执行批量解密字符串（Orchard_Botnet）]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/127657300</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/127657300</guid><author>jentle8</author><pubDate>Wed, 02 Nov 2022 19:29:12 +0800</pubDate><description><![CDATA[使用模拟执行批量解密堆栈字符串 ida flare-emu]]></description><category></category></item><item><title><![CDATA[anti-debug你必须知道的基础篇 All in one]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/127501248</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/127501248</guid><author>jentle8</author><pubDate>Mon, 24 Oct 2022 20:58:35 +0800</pubDate><description><![CDATA[这将是一个进阶的系列，当全部完成的时候笔者会弄成一个git手册供自己以及有需要的人查看。在实际对抗中，可能有些别样的代码的Anti结构似曾相识，或许是一个结构体，或许是一段赋值，但是在找这些结构体的时候经常需要东查西查，所以，here we go~~]]></description><category></category></item><item><title><![CDATA[逆向分析，二进制安全知识库]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/127272327</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/127272327</guid><author>jentle8</author><pubDate>Tue, 11 Oct 2022 21:41:51 +0800</pubDate><description><![CDATA[汇总 二进制安全知识库]]></description><category></category></item><item><title><![CDATA[分析NSIS打包的恶意软件思路和实例]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/127062046</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/127062046</guid><author>jentle8</author><pubDate>Mon, 26 Sep 2022 22:09:27 +0800</pubDate><description><![CDATA[NSIS一般思路]]></description><category></category></item><item><title><![CDATA[PLAY 勒索软件分析]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126943165</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126943165</guid><author>jentle8</author><pubDate>Mon, 19 Sep 2022 22:07:10 +0800</pubDate><description><![CDATA[PLAY勒索软件]]></description><category></category></item><item><title><![CDATA[回调函数注入（Callback Injection）实例汇总]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126787823</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126787823</guid><author>jentle8</author><pubDate>Fri, 09 Sep 2022 18:35:34 +0800</pubDate><description><![CDATA[回调函数注入方式实例all in one]]></description><category></category></item><item><title><![CDATA[AV/EDR 免杀逃避技术汇总]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126771022</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126771022</guid><author>jentle8</author><pubDate>Thu, 08 Sep 2022 20:00:32 +0800</pubDate><description><![CDATA[EDR  AV 逃避和免杀方案汇总]]></description><category></category></item><item><title><![CDATA[SmokeLoader 快速分析]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126732768</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126732768</guid><author>jentle8</author><pubDate>Tue, 06 Sep 2022 20:11:53 +0800</pubDate><description><![CDATA[Smoky Spider 犯罪集团的加载器快速分析以及IOC]]></description><category></category></item><item><title><![CDATA[antiVM ida pro插件-快速识别anti-vm行为]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126650273</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126650273</guid><author>jentle8</author><pubDate>Thu, 01 Sep 2022 19:58:02 +0800</pubDate><description><![CDATA[目的是减少分析人员对抗时间。
ida 插件识别反虚拟机反调试等]]></description><category></category></item><item><title><![CDATA[api hash修改ror13 bypass(懒散的黑客~)]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126613094</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126613094</guid><author>jentle8</author><pubDate>Tue, 30 Aug 2022 21:33:04 +0800</pubDate><description><![CDATA[修改 api hash bypass一览]]></description><category></category></item><item><title><![CDATA[从LLVM IR 来看编译器“优化”都在做些什么（release）]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126591242</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126591242</guid><author>jentle8</author><pubDate>Mon, 29 Aug 2022 19:40:59 +0800</pubDate><description><![CDATA[这些东西可以讲很深，但今天只会带大家看些简单的LLVM IR跟 组合语言，并且举一些例子来讲 编译器”优化” 在做些什么。今天的示例会以Rust 为主，因为Rust 编译器的核心是建立在LLVM 之上，所以也支持编译成LLVM IR。虽然如此，就算你完全不了解LLVM 跟Rust 也还是可以读，因为今天会从LLVM 是啥开始讲，而且用到的Rust 语法也超超简单。...]]></description><category></category></item><item><title><![CDATA[dll侧加载手册]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126570275</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126570275</guid><author>jentle8</author><pubDate>Sun, 28 Aug 2022 15:24:49 +0800</pubDate><description><![CDATA[dll sideloading 在恶意软件对抗中并不少用，快速使用和识别可以加速分析过程]]></description><category></category></item><item><title><![CDATA[ETW绕过PoC测试1--关闭你的ProcMon.exe]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126513172</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126513172</guid><author>jentle8</author><pubDate>Wed, 24 Aug 2022 21:36:03 +0800</pubDate><description><![CDATA[ETW 绕过系列1]]></description><category></category></item><item><title><![CDATA[在 Trezor One 上重现故障注入攻击]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126492545</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126492545</guid><author>jentle8</author><pubDate>Tue, 23 Aug 2022 20:44:20 +0800</pubDate><description><![CDATA[这篇文章旨在提供一个路线图和示例，说明如何复制故障注入攻击以及尝试这样做时可能出现的障碍和缺点。此外，通过概述复制其中一种攻击的过程。]]></description><category></category></item><item><title><![CDATA[windows应急响应溯源流程Part1]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/126088449</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/126088449</guid><author>jentle8</author><pubDate>Sun, 31 Jul 2022 18:13:10 +0800</pubDate><description><![CDATA[windows 应急响应溯源Part1]]></description><category></category></item><item><title><![CDATA[[FlareOn4]IgniteMe]]></title><link>https://blog.youkuaiyun.com/jentle8/article/details/105231472</link><guid>https://blog.youkuaiyun.com/jentle8/article/details/105231472</guid><author>jentle8</author><pubDate>Tue, 31 Mar 2020 20:48:33 +0800</pubDate><description><![CDATA[没有壳，也看不出什么语言写的，逆向分析一波：

用writeFile函数伪装起来的printf函数，但是功能一样，
sub_4010F0卵用没有，sub_401050函数是主要判断：

v4返回的是一个定值，动态调试就能出来，v0就是接收函数的整的花里胡哨。
对输入的字符串，最后一个字符xor 0x4,然后之后按位和前一个异或，最后和403000比较，keygen:
byte_403000=[0x...]]></description><category></category></item></channel></rss>