John McIntosh (clearbluejar)@clearbluejar
#Patchdiffing with #ghidra can be more of an art than a science. Ideally, the correlators have done their work, and all the analyst has to do is review the identified changes, additions, and deletions.
014
#patchdiffing içeren gönderiler
#patchdiffing
X'te #patchdiffing kullanan herkese açık gönderiler.
İlgili etiketler
- John McIntosh (clearbluejar)@clearbluejarjumping on the CVE-2024-38063 tcpip.sys train...🚂can't resist.. just need to figure out the right packet... 🤓 #patchdiffing #CVE #RE #ghidriff
34415423.7K - John McIntosh (clearbluejar)@clearbluejarghidriff v0.5.1 - usability updates, improved automated testing , and bug fixes 🪲 - github workflows now test a matrix of devcontainers across versions of python, Ghidra, and Java 🔥 #patchdiffing #ghidra #githubactions
05283.1K 
raptor@0xdeaVery well written #Windows #patchdiffing and #nday #exploitation walkthrough ✊ Dissecting and Exploiting TCP/IP RCE #Vulnerability EvilESP (CVE-2022-34718) // by Valentina Palmiotti
05918523K- John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for May 2025 we have CVE-2025-32701 clfs.sys #exploitedinwild🔥 2 functions modified with relevant changes 🧐 A new flag restricting an IoCreateFileEx call, impacting object ref/deref behavior #UAF 🤔👀
114594.9K - John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for April 2024 we have CVE-2024-26219 in HTTP.sys 🔥 MSRC just started publishing CWE info! For this CVE we have a "CWE-476: NULL Pointer Dereference" 👀 See if you can find it 🧐 Hint: "UxLastMdlChunkNullFix"
314344.9K 
clearseclabs@clearseclabs🔍✨ #patchdiffinthedark to step into the light. Latest VR/RE course led by @clearbluejar at #BHUSA. Root cause the latest CVEs with Ghidra. 2 offerings Sat/Sun or Mon/Tue. Early bird rates end May 24. #patchdiffing @BlackHatEvents
0237.3K
CVE-2022-34718 patch diffing, root cause analysis and exploit PoC Writeup by @chompie1337 #windows #patchdiffing #infosec #cybersecurity
24715816.7K
Nipun Jaswal@nipunjaswalDiffing patches for MS Windows 10, its sometimes hard to find downloads This should make it easy.. #patchdiffing #patchtuesday #exploitdev015
reverseame@reverseameCVE-2024-22263: Spring Cloud Dataflow Arbitrary File Writing #SpringCloudDataflow #ArbitraryFileWriting #PatchDiffing #StaticAnalysis #LabSetup04111.2K- John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have November's Windows 11 22H2 x64 kernel update KB5032190: 🧐 Side by side view is here: 👀
28539.6K - John McIntosh (clearbluejar)@clearbluejarhello 2024! Hot off the #ghidriff #patchdiffing press we have the January 9, 2024—KB5034122 Windows 10 22H2 x64 kernel update ... 🔥 Side by side view is here: 👀 This month the kernel fixes include CVE-2024-20698 ... as there are not too many changes, perhaps we find the root cause? Take at look this function... 🧐 Hint: It rhymes with "vintager afterglow". Also! This diff is testing out an upcoming ghidriff feature.. check out the new callgraph.
07183K 
Thanks @jessefmoore for pointing this project out. Very cool stuff. Couldn’t find a handle for the authors, but well done @safebreach #PatchDiffing01342- Bruh! Do you even diff? <= My #rsac2016 talk this year. haha. Stop by the talk if your attending. #patchdiffing066
- John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press, we have the December Windows 11 22H2 x64 kernel security update KB5033375: 🧐 Side-by-side view here:
09344K - John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have October's Windows 11 22H2 kernel Update KB5031354... 👀
08254.6K - clearseclabs@clearseclabsJoin @clearbluejar @1ns0mn1h4ck 2024 for "Patch Different on *OS". Check out this quick talk teaser video for a quick demo of some of the content! #INSO24 #Insomnihack #patchdiffing #apple005773
OnHexGroup@onhexgroupدر این ویدیو از @LowLevelTweets آسیب پذیری CVE-2024-11477 در 7zip رو بررسی کردن. از بررسی کد شروع شده تا #PatchDiffing و #فازینگ و ... نهایت به چیزی که رسیده: آسیب پذیری قابلیت اکسپلویت شدن رو داره و هکرها در شرایطی میتونن از سیستم قربانی شل بگیرن.OnHexGroup @onhexgroupآسیب پذیری با شناسه CVE-2024-11477 در #7zip اصلاح شده که امکان اجرای کد دلخواه رو به مهاجم میده. آسیبپذیری در Zstandard Decompression و از نوعinteger underflowهستش. نسخه اصلاح شده : 24.07 به بالا توسط ترندمیکرو و در 23 خرداد گزارش شده. آسیب پذیری از چند جهت میتونه مهم باشه:013267- OnHexGroup@onhexgroupآسیب پذیری با شناسه CVE-2024-11477 در #7zip اصلاح شده که امکان اجرای کد دلخواه رو به مهاجم میده. آسیبپذیری در Zstandard Decompression و از نوعinteger underflowهستش. نسخه اصلاح شده : 24.07 به بالا توسط ترندمیکرو و در 23 خرداد گزارش شده. آسیب پذیری از چند جهت میتونه مهم باشه:112471
- OnHexGroup@onhexgroupرشتو: در این برنامه قراره در خصوص تکنیک #PatchDiffing روی Patchهای #مایکروسافت صحبت و از دو ابزار #Bindiff و #Diaphora استفاده کنن. همچنین نشون میدن که چطوری #هوش_مصنوعی میتونه این فرایند رو ساده تر کنه. این برنامه ساعت 21:30 شروع میشه. #AI #PatchTuesdayStephen Sims @Steph3nSimsJoin me this Friday at 11AM on the next @offby1security stream where I will diff a Microsoft patch from this year and see how far we get. We'll use tools like BinDiff and Diaphora and look at the process of determining the vulnerability.101217
- Join me this Friday at 11AM on the next @offby1security stream where I will diff a Microsoft patch from this year and see how far we get. We'll use tools like BinDiff and Diaphora and look at the process of determining the vulnerability.017946.4K
- reverseame@reverseameExploiting Microsoft Kernel Applocker Driver (CVE-2024-38041) #MicrosoftKernelCVE #CyberSecurityServices #PatchDiffing #ExploitationProcess #RootCauseAnalysis015493.6K
- Daha fazla gönderi göster
