not_a9

7 ms·

1.
by not_a9 6d ago
Visual Studio does have a really nice C++ debugger - one would imagine the C++ debugging capabilities should translate to Rust.
2.
by not_a9 6d ago
> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg ZwMapViewOfSection 2072 80F 001612B0 ZwMapViewOfSection 2073 810 00163160 ZwMapViewOfSectionEx
3.
by not_a9 10d ago
Given the cost of openweight frontier models like Kimi I’m fairly sure the token prices actually make some money.
4.
by not_a9 16d ago
> This has nothing to do with ntdll at all. I can only wonder where `NtMapViewOfSection` could be exported from...
5.
by not_a9 20d ago
I wonder how they handle merging upstream clanked stuff.
6.
by not_a9 22d ago
I guess Hex-Rays and Vector35 must be hallucinating their effects for, say, reverse engineering. OFC rev isn't be all and end all of computing but the effect LLMs had on security research and adjacent spaces (say, CTF) is interesting
7.
by not_a9 22d ago
In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/d... . > If the call to this function occurs in user mode, you should use the name &
8.
by not_a9 24d ago
Memories break Fable 5 for me as well in chatbot. I ask Opus a lot of sec related stuff and now if I even type “hello” in chat it gets insta-downgraded to Opus 5.
9.
by not_a9 24d ago
Assuming you want to preserve the same functionality of drivers, how would giving the userspace RGB controller driver the same set of tools (usually fun things like physical memory RW) change anything?
10.
by not_a9 24d ago
Microsoft did break backwards compatibility with some drivers (packed stuff that relied on being able to write to executable sections, for instance) w/ HVCI and then with some other stuff (for instance, drivers using push+ret for obfus
11.
by not_a9 24d ago
Technically the hardware threshold is sort of real for making virtualization based security usable and useful.
12.
by not_a9 26d ago
https://x.com/_can1357/status/2090360068529111530 Should be pretty difficult to ignore
13.
by not_a9 29d ago
The significantly increased capabilities of cheats if you can read/write memory and the dogshit that AI-oriented anticheat approaches continue producing (look at VACnet, though I am sure there are other companies producing better thing
14.
by not_a9 1mo ago
While I’m not sure if this is a bot (where did vidya enter the convo?), game hacking on both cheat and anticheat side has genuinely deep Windows internals knowledge (admittedly somewhat lopsided, but deep nonetheless)
15.
by not_a9 1mo ago
OK, but is that fun for people who don’t wanna clankermaxx? In addition this does not address the paytowin aspect of clankermaxxed CTFs
16.
by not_a9 1mo ago
The talk about DEFCON CTF this year on Twitter seems to imply having LLMs allowed in CTF (or, at least, allowing autoslopping without significant restrictions) kinda kills the game. There’s a ton of sentiment about CTF being effectively dea
17.
by not_a9 1mo ago
Safeguards don’t really trigger for CTF stuff. I’m sure most people are on the subscription plans instead of suffering through API pricing
18.
by not_a9 1mo ago
To the best of my knowledge: doesn’t the current build of Claude Code use the Rust port of Bun?
19.
by not_a9 1mo ago
Generally binary rewriters will add a new section for the rewritten code/other stuff that needs regeneration (relocations, exception info, the like)
20.
by not_a9 1mo ago
To add to this, the obfuscation used for their anticheat seems to be… kinda bad? Worse than Epic’s virtualizer/Griffin probably https://k0mkc.hatenablog.com/entry/2026/08/06/032440 Mind you, odds ar
21.
by not_a9 1mo ago
back.engineering folks seem to imply that Denuvo is another case of virtualization based obfuscator being vulnerable to a symbolic execution/optimization approach. > As AI assisted static deobfuscation continues to improve we will s
22.
by not_a9 2mo ago
Out of idle curiosity: can NASM emit Windows unwind information? For the matter, can any assembler do so automatically?
23.
Static Devirtualization of Tencent VM(back.engineering)
3 points by not_a9 2mo ago|0 comments
24.
by not_a9 2mo ago
The service where Counter-Strike actually gets played competitively, FaceIT, does not work on Linux.
25.
by not_a9 2mo ago
Kinda offtopic, but I was somewhat surprised by Assembly having an “exclusive AI partner” this year.
26.
by not_a9 2mo ago
Throw a lawn dart at the contents of https://vx-underground.org/Archive/Driver%20Collection/Bulk%... all drivers download, load the resulting driver and try to get into Fortnite or something. It'll probably g
27.
by not_a9 2mo ago
Sandboxie/WinFSP/KVM guest drivers for Windows are open source too I’m sure there are more open source examples. A newer one is https://github.com/namazso/PawnIO/tree/master I guess?
28.
by not_a9 2mo ago
If anti-cheats actively whitelisted drivers playing competitive video games would be impossible for people using any rarer HW/utilities. Vulnerable drivers are generally blacklisted when found. Getting your driver signed seems like a p
29.
Implementing SEH in Rust and why you shouldn't do it(engineering.zeroitlab.com)
3 points by not_a9 2mo ago|0 comments
30.
by not_a9 2mo ago
Reversing for the most part, though lately I’ve been doing some code obfuscation/binary rewriting stuff. Fable will switch to Opus instantly on these and I’m unsure how this will perform. I suppose the only way to find out is to test.

More ›