A forum for reverse engineering, OS internals and malware analysis
Searched query: j00ru
... something I used 12 years ago against some Chinese antirootkits and some crapware mainstream antiviruses. For more recent info's you may refer to j00ru series of blogposts where he multiple times crashed Windows using the same principle. Idea is simple, two threads access same memory simultaneously, ...
... need to look: https://doxygen.reactos.org/dir_27871eb6ad510cc2c74bb4ae8f701fd6.html And some of the functions listed here might be useful: https://j00ru.vexillium.org/syscalls/win32k/32/ like NtGdiEngBitBlt, NtGdiBitBlt, NtGdiCreateCompatibleDC, NtGdiCreateCompatibleBitmap, NtGdiCreateSolidBrush ...
I`m test it with NtUserBuildHwndList and NtUserFindWindowEx (indexes from http://j00ru.vexillium.org/syscalls/win32k/64/)
Testing with usermode app that call EnumWindows, FindWindowA.
... example infecting MBR/VBR/NTFS. check these links, for more technical information. A quick insight into the Driver Signature Enforcement http://j00ru.vexillium.org/?p=377 Defeating Windows Driver Signature Enforcement #1: default drivers http://j00ru.vexillium.org/?p=1169 Defeating Windows Driver ...
hi,
An non ended overview of the speakers
http://www.nosuchcon.org/#speakers
Certainly interesting talks about Kernel exploitation by j00ru http://www.kernelmode.info/forum/search ... ords=j00ru and Nikita Tarakanov...
To be continued...
Rgds
... i just take ur code nd try that for windows 7 x32 SP1 whether it is work in windows 7 i have changed the call number of apis as http://j00ru.vexillium.org/win32k_syscalls/.I got an BSOD orelse i can able to register my driver and unable to start service because i got an error like parameter ...
The Shellcoder's handbook Corelan.be exploit writing tutorials Technical blog posts about vulnerabilities (like VUPEN, j00ru work). Introduction To Software Exploits or Exploits 2: Exploitation in the Windows Environment or here You can train yourself on wargames like SmashTheStack ...
A bootkit study and research sample from Poland. The related polish paper http://j00ru.vexillium.org/blog/24_09_09/Bootkit%20vs%20Windows.pdf Blank virus total result https://www.virustotal.com/file/586c2ba8b3c9785e382fa37adb18c9f70d61ead3841c9360d0b20ad15d56353a/analysis/1339870667/ ...
ntapi_64: http://j00ru.vexillium.org/ntapi_64/
Hello
Seen on Twitter: http://j00ru.vexillium.org/ntapi/
Updated with windows 8