John McIntosh (clearbluejar)@clearbluejar
#Patchdiffing with #ghidra can be more of an art than a science. Ideally, the correlators have done their work, and all the analyst has to do is review the identified changes, additions, and deletions.
014
Posts avec #patchdiffing
#patchdiffing
Les posts publics sur X qui utilisent #patchdiffing.
Hashtags associés
raptor@0xdeaVery well written #Windows #patchdiffing and #nday #exploitation walkthrough ✊ Dissecting and Exploiting TCP/IP RCE #Vulnerability EvilESP (CVE-2022-34718) // by Valentina Palmiotti
05918523K- John McIntosh (clearbluejar)@clearbluejarhello 2024! Hot off the #ghidriff #patchdiffing press we have the January 9, 2024—KB5034122 Windows 10 22H2 x64 kernel update ... 🔥 Side by side view is here: 👀 This month the kernel fixes include CVE-2024-20698 ... as there are not too many changes, perhaps we find the root cause? Take at look this function... 🧐 Hint: It rhymes with "vintager afterglow". Also! This diff is testing out an upcoming ghidriff feature.. check out the new callgraph.
07183K 
CVE-2022-34718 patch diffing, root cause analysis and exploit PoC Writeup by @chompie1337 #windows #patchdiffing #infosec #cybersecurity
24715816.7K- John McIntosh (clearbluejar)@clearbluejarjumping on the CVE-2024-38063 tcpip.sys train...🚂can't resist.. just need to figure out the right packet... 🤓 #patchdiffing #CVE #RE #ghidriff
34415423.7K 
clearseclabs@clearseclabsJoin @clearbluejar @1ns0mn1h4ck 2024 for "Patch Different on *OS". Check out this quick talk teaser video for a quick demo of some of the content! #INSO24 #Insomnihack #patchdiffing #apple005773
OnHexGroup@onhexgroupدر این ویدیو از @LowLevelTweets آسیب پذیری CVE-2024-11477 در 7zip رو بررسی کردن. از بررسی کد شروع شده تا #PatchDiffing و #فازینگ و ... نهایت به چیزی که رسیده: آسیب پذیری قابلیت اکسپلویت شدن رو داره و هکرها در شرایطی میتونن از سیستم قربانی شل بگیرن.OnHexGroup @onhexgroupآسیب پذیری با شناسه CVE-2024-11477 در #7zip اصلاح شده که امکان اجرای کد دلخواه رو به مهاجم میده. آسیبپذیری در Zstandard Decompression و از نوعinteger underflowهستش. نسخه اصلاح شده : 24.07 به بالا توسط ترندمیکرو و در 23 خرداد گزارش شده. آسیب پذیری از چند جهت میتونه مهم باشه:013267- OnHexGroup@onhexgroupآسیب پذیری با شناسه CVE-2024-11477 در #7zip اصلاح شده که امکان اجرای کد دلخواه رو به مهاجم میده. آسیبپذیری در Zstandard Decompression و از نوعinteger underflowهستش. نسخه اصلاح شده : 24.07 به بالا توسط ترندمیکرو و در 23 خرداد گزارش شده. آسیب پذیری از چند جهت میتونه مهم باشه:112471
reverseame@reverseameExploiting Microsoft Kernel Applocker Driver (CVE-2024-38041) #MicrosoftKernelCVE #CyberSecurityServices #PatchDiffing #ExploitationProcess #RootCauseAnalysis015493.6K- John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for May 2025 we have CVE-2025-32701 clfs.sys #exploitedinwild🔥 2 functions modified with relevant changes 🧐 A new flag restricting an IoCreateFileEx call, impacting object ref/deref behavior #UAF 🤔👀
114594.9K 
Join SANS Fellow @Steph3nSims in an hour for this amazing demo #PatchDiffingStephen Sims @Steph3nSimsThe next Off by One Security stream is tomorrow at 11AM Pacific Time. I'll be demonstrating the process of downloading, extracting, and prepping MS patches for diffing. We'll take a look at some patched code.011
The next Off by One Security stream is tomorrow at 11AM Pacific Time. I'll be demonstrating the process of downloading, extracting, and prepping MS patches for diffing. We'll take a look at some patched code.
02882- Bruh! Do you even diff? <= My #rsac2016 talk this year. haha. Stop by the talk if your attending. #patchdiffing066
- John McIntosh (clearbluejar)@clearbluejarghidriff v0.5.1 - usability updates, improved automated testing , and bug fixes 🪲 - github workflows now test a matrix of devcontainers across versions of python, Ghidra, and Java 🔥 #patchdiffing #ghidra #githubactions
05283.1K - John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have October's Windows 11 22H2 kernel Update KB5031354... 👀
08254.6K - John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for April 2024 we have CVE-2024-26219 in HTTP.sys 🔥 MSRC just started publishing CWE info! For this CVE we have a "CWE-476: NULL Pointer Dereference" 👀 See if you can find it 🧐 Hint: "UxLastMdlChunkNullFix"
314344.9K - Thanks @jessefmoore for pointing this project out. Very cool stuff. Couldn’t find a handle for the authors, but well done @safebreach #PatchDiffing01342
- John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have November's Windows 11 22H2 x64 kernel update KB5032190: 🧐 Side by side view is here: 👀
28539.6K - reverseame@reverseameCVE-2024-22263: Spring Cloud Dataflow Arbitrary File Writing #SpringCloudDataflow #ArbitraryFileWriting #PatchDiffing #StaticAnalysis #LabSetup04111.2K
Nipun Jaswal@nipunjaswalDiffing patches for MS Windows 10, its sometimes hard to find downloads This should make it easy.. #patchdiffing #patchtuesday #exploitdev015- clearseclabs@clearseclabs🔍✨ #patchdiffinthedark to step into the light. Latest VR/RE course led by @clearbluejar at #BHUSA. Root cause the latest CVEs with Ghidra. 2 offerings Sat/Sun or Mon/Tue. Early bird rates end May 24. #patchdiffing @BlackHatEvents
0237.3K - Afficher plus de posts
