tonygo

6 ms·

1. 1.▲
   Compute iOS XNU offset from kernel cache(blog.reversesociety.co)

   34 points by tonygo 5mo ago|0 comments
2. 2.▲
   I found a secret protocol in Predator Spyware – iOS(youtube.com)

   1 points by tonygo 8mo ago|1 comments
3. 3.▲
   by tonygo 8mo ago

   How does mercenary spyware actually control an iPhone? In this video, I reverse engineer the Predator spyware to uncover the secret internal protocol it uses to activate surveillance modules. This is a summary of my technical research publi
4. 4.▲
   Predator iOS Spyware: Build a Surveillance Framework(blog.reversesociety.co)

   2 points by tonygo 8mo ago|0 comments
5. 5.▲
   macOS Ransomware: NotLockBit(sentinelone.com)

   1 points by tonygo 2y ago|0 comments
6. 6.▲
   Ptrace internals: How it prevents debugger attachment(tonygo.netlify.app)

   2 points by tonygo 2y ago|0 comments
7. 7.▲
   by tonygo 2y ago

   I try to transform my C program into a long living one (just adding a sleep). https://github.com/tony-go/antidebug-examples/pull/1 At first, it appears that the follow fork mode works nicely. But at some poin
8. 8.▲
   by tonygo 2y ago

   I tried, but I was not able to determine so far...
9. 9.▲
   by tonygo 2y ago

   Thanks a lot :) I think that I should dig more on ptrace! Maybe a next post?
10. 10.▲
    by tonygo 2y ago

    Hi :) I am not really experienced with ARM haha :) So the way that I approached it was: - how could I remove the call of fork (because I don't want to fork) - how could I patch the register that should contains the result of the fork o
11. 11.▲
    by tonygo 2y ago

    > You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child p
12. 12.▲
    by tonygo 2y ago

    Also it could come from a messy thing in the code.
13. 13.▲
    by tonygo 2y ago

    I tried with LLDB using `settings set target.process.follow-fork-mode child` but for some reasons I feel like it still exit from the parent process. I also tried with a long living process: https://github.com/tony-go/an
14. 14.▲
    by tonygo 2y ago

    > A far more effective actual anti-debugging technique is to have the parent become the debugger of the child, Do you have example of that? I am really curious, thanks for sharing tho :)
15. 15.▲
    Implementing and Detecting Anti-Debugging with Fork()(tonygo.netlify.app)

    58 points by tonygo 2y ago|16 comments
16. 16.▲
    XPC Sniffer for LLDB(github.com)

    3 points by tonygo 2y ago|0 comments