Duncan Ogilvie 🍍 @mrexodia Twitter profile | Pikagi

Pikagi

Duncan Ogilvie 🍍

@mrexodia

5,678

Followers

240

Following

65

Media

1,105

Statuses

Reverse engineer, creator of @x64dbg and 100+ other projects. Love binary analysis and Windows internals. Dreaming about doing open source full time...

Poland

https://t.co/WYps6a6YVb

Joined January 2011

Don't wanna be here? Send us removal request.

Pinned Tweet

@mrexodia

Duncan Ogilvie 🍍

11 months

Gave a guest lecture "Windows Internals Crash Course" at the Ruhr-Universität Bochum today. No novel research, but might be interesting for people getting into started. Thanks to @mr_phrazer for the invite!

Tweet card media

Windows Internals Crash Course

Guest lecture about Windows Internals (aimed at total beginners), given at the Ruhr-Universität Bochum. Slides: https://mrexodia.github.io/files/wicc-2023-sl...

www.youtube.com

3

162

466

Last Seen Profiles

@Pubonthepark

@JaphMarcos

@lisaduffywriter

@Comp4SB

@seatoggi

@LenaLucy_vtuber

@VineethRed29670

@TheDailyCougar

@130Point

@BinorRaja

@Clark10x

@useteller

@pengen_stw

@Firststarlog

@Chandni45018401

@Stockholm_Uni

@siba_inuo0

@malsh3aib

@jazzywrestling

@WhatADdoing

@so8FS9cKIGEsIaG

@kmusical2006

@SAFRAN

@jeunepalmier

@miwiamundertale

@manmanmanAvax

@ecostr_ru

@MelanieVid22514

@abxsid

@Rides2128

@HCS

@arizonein

@tia_rescue

@jandakembangstw

@Spacedout_Beats

@BrennaJoGeorge

@mrexodia

Duncan Ogilvie 🍍

5 months

The RAD Debugger was released today by @ryanjfleury . Looks really cool and Linux support would be awesome!

Tweet media one

8

113

614

@mrexodia

Duncan Ogilvie 🍍

3 months

Looks like you can debug x86 malware on the Apple M1 Pro using ! 🥳

Tweet media one

5

74

366

@mrexodia

Duncan Ogilvie 🍍

3 months

Wrote a little tool to generate a proxy for DLL hijacking. ASM stubs are often used for this purpose, but with some trickery you can use forwards with absolute paths! #infosec #redteam #Memes

Tweet card media

GitHub - mrexodia/perfect-dll-proxy: Perfect DLL Proxying using forwards with absolute paths.

Perfect DLL Proxying using forwards with absolute paths. - mrexodia/perfect-dll-proxy

2

93

348

@mrexodia

Duncan Ogilvie 🍍

2 months

@lauriewired At least they got out of vim…

0

0

189

@mrexodia

Duncan Ogilvie 🍍

1 year

Read an article from @TrendMicro about using x32dbg as a lolbin 💀. You can do the same with WinDbg 😎🔥. #cybersecurity #redteam #advanced #infosec #hacker #ransomware #windbg #debugger #pentest #malware #edr #bypass #newtechniquebro @Sophos @msftsecurity

Tweet media one

Tweet media two

5

54

182

@mrexodia

Duncan Ogilvie 🍍

5 months

Great series of blog posts by @justuspolzin that makes Mixed Boolean-Arithmetic obfuscation very accessible: . There is even a web interface available to play with!

Tweet media one

2

45

181

@mrexodia

Duncan Ogilvie 🍍

2 years

Awesome blog series!

Reverse Engineering Dark Souls 3 Networking (#1 - Connection)

Breaking down and investigating how Dark Souls 3 communicates with its online services.

0

64

177

@mrexodia

Duncan Ogilvie 🍍

3 years

Wrote a simple prototype sandbox last night to emulate code in minidumps: It has a basic framework to implement missing syscalls in python and it could be useful for extracting malware configuration. @unicorn_engine #infosec #Emotet #config

GitHub - mrexodia/dumpulator: An easy-to-use library for emulating memory dumps. Useful for malware...

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing). - mrexodia/dumpulator

0

50

171

@mrexodia

Duncan Ogilvie 🍍

2 years

Just released JitMagic v1.0: A simple tool that allows you to have multiple Just-In-Time debuggers at once.

Tweet media one

0

54

167

@mrexodia

Duncan Ogilvie 🍍

24 days

Excited to share I'll be conducting a workshop 'LLVM for Reverse Engineers' at @x33fcon next month! More information:

Tweet media one

3

30

158

@mrexodia

Duncan Ogilvie 🍍

5 months

@x64dbg will now display potential NTSTATUS codes in the info box when selecting an instruction!

Tweet media one

3

34

151

@mrexodia

Duncan Ogilvie 🍍

3 years

VMProtect 2 - Part Two, Complete Static Analysis by @_xeroxz

1

57

148

@mrexodia

Duncan Ogilvie 🍍

3 years

Ever wanted to debug IDA Pro python scripts in PyCharm? Just rename ida64.exe to python.exe and you can attach!

Tweet media one

1

18

147

@mrexodia

Duncan Ogilvie 🍍

9 months

A snapshotting, coverage-guided fuzzer for software (UEFI, Kernel, firmware, BIOS) built on SIMICS: Very interesting to see an example of the SIMICS API being used. If you're not familiar you can check out this free course on it:

Tweet card media

GitHub - intel/tsffs: A snapshotting, coverage-guided fuzzer for software (UEFI, Kernel, firmware,...

A snapshotting, coverage-guided fuzzer for software (UEFI, Kernel, firmware, BIOS) built on SIMICS - intel/tsffs

1

41

138

@mrexodia

Duncan Ogilvie 🍍

5 months

@HexRaysSA Unfortunately it looks like IDA doesn’t support the RISCV64 architecture I was decompiling in that screenshot 😔

8

3

139

@mrexodia

Duncan Ogilvie 🍍

6 years

Today I wrote some simple go tools to perform a Man-in-the-middle (MITM) attack on an IMAP server because I forgot my password. See #infosec #ios Using @corednsio and @emersion_fr 's great go-imap library!

Tweet card media

GitHub - mrexodia/haxxmap: Some simple go tools to perform a Man-in-the-middle (MITM) attack on...

Some simple go tools to perform a Man-in-the-middle (MITM) attack on your IMAP server in case you forgot your password. - mrexodia/haxxmap

2

59

103

@mrexodia

Duncan Ogilvie 🍍

2 years

Time Travel Debugging IDA plugin:

Tweet card media

GitHub - airbus-cert/ttddbg: Time Travel Debugging IDA plugin

Time Travel Debugging IDA plugin. Contribute to airbus-cert/ttddbg development by creating an account on GitHub.

1

37

104

@mrexodia

Duncan Ogilvie 🍍

14 days

Looking forward to it!

@lauriewired

LaurieWired

14 days

Excited to announce a very special guest for the next stream, creator of x64dbg himself @mrexodia ! Check it out 10AM PST this Saturday, and bring your questions!

Tweet media one

2

27

277

0

7

98

@mrexodia

Duncan Ogilvie 🍍

8 years

unlinker - A program for extracting functions from a PE file for later reuse

Tweet card media

GitHub - jonwil/unlinker: Unlinker is a tool that can rip functions out of Visual C++ compiled...

Unlinker is a tool that can rip functions out of Visual C++ compiled binaries and produce Visual C++ COFF object files - jonwil/unlinker

0

66

94

@mrexodia

Duncan Ogilvie 🍍

3 years

Finally got around to polishing my AppInitHook framework: . I have successfully used it for years to reverse engineer and customize random applications, take a look!

Tweet card media

GitHub - mrexodia/AppInitHook: Global user-mode hooking framework, based on AppInit_DLLs. The goal...

Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary process. - mrexodia/AppInitHook

0

42

98

@mrexodia

Duncan Ogilvie 🍍

2 years

A few days ago I had a discussion with #ChatGPT about how to structure a reverse engineering course. One of the suggested topics was to teach people the "CREATE methodology". With a bit of probing I was able to generate this paper: Interesting stuff!

Tweet card media

CREATE: A methodology for reverse engineering complex software systems - HackMD

# CREATE: A methodology for reverse engineering complex software systems _Note: All the content of

4

26

94

@mrexodia

Duncan Ogilvie 🍍

5 months

Super great tool by @podalirius_ : To recursively download PDBs for all executables in the current directory: `pdbdownload -d . -S .`

Tweet card media

GitHub - p0dalirius/pdbdownload: A Python script to download PDB files associated with a Portable...

A Python script to download PDB files associated with a Portable Executable (PE) - p0dalirius/pdbdownload

3

37

93

@mrexodia

Duncan Ogilvie 🍍

10 months

Finally got around to implementing an automatically generated single-header version of the phnt library by @SystemInformer . Include it and you can start using native functions.

Tweet card media

GitHub - mrexodia/phnt-single-header: Single header version of System Informer's phnt library.

Single header version of System Informer's phnt library. - mrexodia/phnt-single-header

4

33

92

@mrexodia

Duncan Ogilvie 🍍

2 months

Link to the paper for those interested:

@0xkarmacoma

karma

2 months

you: symbolic execution is slow me:

Tweet media one

3

7

75

3

15

84

@mrexodia

Duncan Ogilvie 🍍

4 months

IDA Swift, anyone? (I didn't make this)

Tweet media one

4

9

82

@mrexodia

Duncan Ogilvie 🍍

2 years

Very cool! The author of OllyDbg implemented a similar (but different) algorithm in 2001 for backwards disassembly, check it out:

@dougallj

Dougall

2 years

New blog post: "Parallelising Huffman decoding and x86 disassembly by synchronising non-self-synchronising prefix codes"

Tweet media one

6

56

276

2

27

80

@mrexodia

Duncan Ogilvie 🍍

6 months

Tweet card media

GitHub - thesecretclub/riscy-business: RISC-V Virtual Machine

RISC-V Virtual Machine. Contribute to thesecretclub/riscy-business development by creating an account on GitHub.

@the_secret_club

secret club

@the_secret_club

6 months

RISC-Y Business: Raging against the reduced machine by @mrexodia oopsmishap

0

39

109

2

22

78

@mrexodia

Duncan Ogilvie 🍍

1 year

Published a simple Windows kernel driver template using #cmkr . Suggestions are welcome!

Tweet card media

GitHub - build-cpp/wdk_template: Windows kernel driver template for cmkr (with testsigning).

Windows kernel driver template for cmkr (with testsigning). - build-cpp/wdk_template

0

15

75

@mrexodia

Duncan Ogilvie 🍍

5 months

Ghidra seems to be having a stroke...

Tweet media one

1

6

73

@mrexodia

Duncan Ogilvie 🍍

8 years

Database of a complete X86/X64 instruction set - #infosec perhaps interesting for @capstone_engine ?

Tweet card media

GitHub - asmjit/asmdb: Instructions database and utilities for X86/X64 and ARM (THUMB/A32/A64)...

Instructions database and utilities for X86/X64 and ARM (THUMB/A32/A64) architectures. - asmjit/asmdb

0

55

72

@mrexodia

Duncan Ogilvie 🍍

5 months

Looks like Binary Ninja has this too now!

Tweet card media

Binary Ninja - C++ Template Simplification in Binary Ninja

Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

@m417z

Michael Maltsev

1 year

Ever needed to debug code with heavily templated C++ symbols, hundreds of characters in length? This new @x64dbg Symbol tl;dr plugin was designed to help with that by showing you a tl;dr with the important parts.

Tweet media one

3

75

266

1

3

73

@mrexodia

Duncan Ogilvie 🍍

1 year

I’ve been playing with this last week and it has a lot of potential to (finally) replace @unicorn_engine with something rigorous!

@0xor0ne

0xor0ne

1 year

Icicle is a multi architecture emulation framework designed for firmware fuzzing. Nice research work Paper: github repo (pre-release): #fuzzing #firmware #infosec #cybersecurity

Tweet media one

Tweet media two

Tweet media three

Tweet media four

1

99

342

2

13

70

@mrexodia

Duncan Ogilvie 🍍

2 months

If you think syscalls are hard, take a look at this:

1

13

68

@mrexodia

Duncan Ogilvie 🍍

2 months

GitHub repo:

Tweet card media

GitHub - agra-uni-bremen/BinSym: Symbolic execution for RISC-V machine code based on the formal...

Symbolic execution for RISC-V machine code based on the formal LibRISCV ISA model - agra-uni-bremen/BinSym

@_ringzer0

ringzerø.training && @[email protected]

2 months

BinSym: Binary-Level Symbolic Execution using Formal Descriptions of Instruction Semantics

0

13

56

0

16

66

@mrexodia

Duncan Ogilvie 🍍

9 years

Just implemented the snowman #decompiler in #x64dbg http://t.co/o5gEiw4Z1V

Tweet media one

1

43

64

@mrexodia

Duncan Ogilvie 🍍

10 months

Looks nice! Any performance numbers or comparison with ? I did some experiments with in the past and was only able to squeeze about ~350k instructions/second out of Ghidra's C++ implementation ()

Tweet card media

Improve Pcode emulator performance and reduce memory fragmentation by mrexodia · Pull Request #5325...

Before this change I got ~150k instructions/second, after ~380k (2.5x). The main bottleneck was caused by separate allocations of the VarnodeData and PcodeOpRaw objects, but there was also an unnec...

@0xor0ne

0xor0ne

10 months

Ghidralligator is a tool by @AirbusCyber to emulate Ghidra p-code for fuzzing with AFL++ Github Repo: #ghidra #fuzzing #infosec

Tweet media one

Tweet media two

Tweet media three

Tweet media four

2

136

405

0

11

58

@mrexodia

Duncan Ogilvie 🍍

1 year

📸

Tweet media one

4

0

60

@mrexodia

Duncan Ogilvie 🍍

3 months

Looking forward to it🔥

@bsidesprg

Security BSides Prague

3 months

"Exciting update 🚀 Originally, #workshops weren't in our plan, but we couldn't resist the chance to offer this. Thrilled that @mrexodia author of @x64dbg will host a session on #LLVM for reverse engineers. Don't miss out on this unique opportunity! #bsidesprg2024 #SecurityBSdies

Tweet media one

0

12

31

1

5

59

@mrexodia

Duncan Ogilvie 🍍

1 year

The talk from @ShitSecure at @x33fcon had @x64dbg screenshots, reach out and merch will be provided!

Tweet media one

3

4

56

@mrexodia

Duncan Ogilvie 🍍

1 year

Finally a new emulator with a permissive license!

@JustineTunney

Justine Tunney

1 year

My dream has finally come true. I've been working on a 160kb virtual machine named Blink. It's now capable of emulating programs as complex as GCC and Qemu. We can now vendor Linux toolchain binaries in our build configs and have them run across platforms.

Tweet media one

42

481

3K

0

10

53

@mrexodia

Duncan Ogilvie 🍍

2 years

Cool library to add a GDB server to your @unicorn_engine project

Tweet card media

GitHub - bet4it/udbserver: Unicorn Emulator Debug Server - Written in Rust, with bindings for C,...

Unicorn Emulator Debug Server - Written in Rust, with bindings for C, Go, Java and Python - bet4it/udbserver

0

15

51

@mrexodia

Duncan Ogilvie 🍍

1 year

Oh I didn’t know it was published yet 😅 Thanks a lot to @GoogleOSS for the bonus and @stevemk14ebr for the nomination!

@fearless0

fearless 🏴󠁧󠁢󠁳󠁣󠁴󠁿🇮🇪

1 year

Congrats to Duncan ( @mrexodia ) and x64dbg for being on the first group of winners for the Google Open Source Peer Bonus Program: #x64dbg

0

4

21

5

7

50

@mrexodia

Duncan Ogilvie 🍍

10 months

Awesome! For dumpulator I also wrote some code to “properly” parse the phnt headers and convert it to JSON, might be helpful:

@m417z

Michael Maltsev

10 months

It's common knowledge that the best source for Windows native API definitions is the collection of System Informer (formerly Process Hacker) phnt headers. Surprisingly, there were no online docs for them, so I created a simple website:

Tweet media one

10

192

579

1

7

49

@mrexodia

Duncan Ogilvie 🍍

1 year

Interesting video from Robert Yates on how to solve @HexRaysSA 's recent CTF challenge using SENinja ()

Tweet card media

Solving the Hex-Rays CTF using path driven symbolic execution.

Here I demonstrate how to solve the CTF using a binary ninja plugin called SENinja. Note that this version of the plugin shown in the video is part of a non-...

www.youtube.com

1

18

47

@mrexodia

Duncan Ogilvie 🍍

2 months

The manuals:

@MicroarchClub

Microarch Club

2 months

Making Sense of x86 Microarchitecture @mattgodbolt outlines useful resources for gaining a deeper understanding of x86 microarchitecture, such as Agner Fog's optimization manuals, and explains how his own investigations led to attribution in the Spectre and Meltdown attacks.

2

13

89

0

2

46

@mrexodia

Duncan Ogilvie 🍍

1 year

Tweet card media

Building a Minimalistic Virtual Machine

Just over a year ago, I wrote a blog post about a topic that’s very important to me, which is the problem of code rot, of software constantly breaking because of shifting foundations, and the…

pointersgonewild.com

1

9

45

@mrexodia

Duncan Ogilvie 🍍

2 months

Funnily enough the author of OllyDbg published a specialized tool for this 😂

@lauriewired

LaurieWired

2 months

A colleague once told me "one weird trick" to save disk space. Simply print the file in a good OCR font and delete the file. It'll take zero disk space. Later you can scan it back in and OCR it.

Tweet media one

40

115

2K

1

5

41

@mrexodia

Duncan Ogilvie 🍍

5 months

riscvm now passes the #RISCV test suite ✅ and runs transpiled Windows code with STL containers 🥳

Tweet media one

Tweet media two

0

4

40

@mrexodia

Duncan Ogilvie 🍍

4 years

Since NtLua from @_can1357 and NtPhp there has been an insatiable desire for more scripting languages in the kernel, so here is lisp in the kernel!

Tweet media one

1

5

41

@mrexodia

Duncan Ogilvie 🍍

2 years

Finally found this tool to visualize academic paper references again!

Tweet card media

Connected Papers | Find and explore academic papers

A unique, visual tool to help researchers and applied scientists find and explore papers relevant to their field of work.

www.connectedpapers.com

2

9

37

@mrexodia

Duncan Ogilvie 🍍

2 years

Finally an interesting tool I worked on was make public by @gamingatdenuvo ! It’s very useful to cross-reference your application’s logs with the memory usage of the process tree.

Tweet card media

Introducing Onlooker & Cutelooker

Simple memory profiler for Windows.

denuvosoftwaresolutions.github.io

3

16

36

@mrexodia

Duncan Ogilvie 🍍

2 years

There is also an easter egg that nobody has found so far 🥚

@herrcore

herrcore

2 years

The little Easter eggs (pun intended) in #x64dbg always make me chuckle 😄 Also, a good time to remind everyone that x64dbg is developed by one person in their free time 💖 If you use it professionally, support free software

Tweet media one

2

19

94

2

5

30

@mrexodia

Duncan Ogilvie 🍍

7 months

@HexRaysSA Wouldn’t it be more user-friendly to say “The function <name/address> is too big (128k, max 64k), would you like to decompile it anyway?” Yes/No I find myself trying random numbers for the setting too, because the error doesn’t indicate how big the function actually is…

3

0

29

@mrexodia

Duncan Ogilvie 🍍

2 months

@ShitSecure You might like this quick script I wrote over the weekend: You can use forwards to perform DLL hijacking without having to write any stubs. For functions you can also use some MASM that does 'jmp [original_api]' to not have to deal with any parameters.

Tweet card media

GitHub - mrexodia/perfect-dll-proxy: Perfect DLL Proxying using forwards with absolute paths.

Perfect DLL Proxying using forwards with absolute paths. - mrexodia/perfect-dll-proxy

1

6

29

@mrexodia

Duncan Ogilvie 🍍

11 months

@aaaddress1 You could also use the linker flag /emittoolversioninfo:no and save yourself the hassle

2

2

27

@mrexodia

Duncan Ogilvie 🍍

2 months

@Laughing_Mantis @MassageEnvy Been working on @x64dbg for over 10 years now 😅

2

1

27

@mrexodia

Duncan Ogilvie 🍍

8 years

Just implemented #graph overview in @x64dbg !

Tweet media one

2

9

26

@mrexodia

Duncan Ogilvie 🍍

1 year

CS is one of the fields where publishing the dataset+code should give you perfect reproducibility. No clue why it isn’t happening…

@matalaz

Joxean Koret (@[email protected])

1 year

YES. This is the true state of research in binary diffing in academia.

Tweet media one

1

30

119

1

3

26

@mrexodia

Duncan Ogilvie 🍍

11 months

Source code:

Tweet card media

GitHub - bendrissou/gmutator-replication: Replication of Gmutator experiments.

Replication of Gmutator experiments. Contribute to bendrissou/gmutator-replication development by creating an account on GitHub.

@BBendrissou

Bachir Bendrissou

11 months

I am pleased to announce that I recently published a paper in the 2nd International Fuzzing Workshop in Seattle. The paper is a registered report, and is about exploring a new technique (grammar mutation) to test software programs. Link:

Tweet media one

0

13

71

0

2

24

@mrexodia

Duncan Ogilvie 🍍

2 years

Thanks for giving dumpulator a try! Note that you can take a dump of an empty process and map shellcode in memory yourself to get a nice wrapper around unicorn.

@vinopaljiri

Jiří Vinopal

2 years

"Native function and Assembly Code Invocation" My first @_CPResearch_ post showing tricks and practical usage of #IDA #Appcall , #Dumpulator @mrexodia and pure #Unicorn . Getting the best and full of annotated code snippets🤗

Tweet media one

9

41

138

1

3

23

@mrexodia

Duncan Ogilvie 🍍

5 years

Open source private server for Super Mario Maker, integrated with smmdb and Cemu.

Tweet media one

Tweet media two

0

7

23

@mrexodia

Duncan Ogilvie 🍍

7 years

Analyzing torrent repack malware - #infosec #malware

0

19

21

@mrexodia

Duncan Ogilvie 🍍

1 year

@goatmilkkk @hasherezade If you want a slightly more fleshed out parser for the Nt functions you can look at It uses phnt () and libclang to extract the arguments (+enum values) and outputs everything to JSON.

1

4

23

@mrexodia

Duncan Ogilvie 🍍

2 years

This was a fun one!

@the_secret_club

secret club

@the_secret_club

2 years

Bootkitting Windows Sandbox by @mrexodia @sdoogm

0

67

137

0

3

20

@mrexodia

Duncan Ogilvie 🍍

1 year

Hanging with @rad9800 and @brymko at @x33fcon tomorrow. Come say hi 👋 we’ll be wearing x64dbg shirts

1

4

21

@mrexodia

Duncan Ogilvie 🍍

2 years

I had a lot of fun, thanks a lot! Dumpulator repo:

@herrcore

herrcore

2 years

📺 New Tutorial Video 📺 Join us with special guest @mrexodia for a demo of #Dumpulator a binary #emulator ! 🙌 Easy to use #Python , emulation in 5 lines of code ⚙️ Complete Win32/64 env for emulation (minidump) 👾 One-click #malware config extraction

0

23

86

2

1

21

@mrexodia

Duncan Ogilvie 🍍

2 years

Really great article pushing the state of the art of MBA deobfuscation!

@the_secret_club

secret club

@the_secret_club

2 years

Improving MBA Deobfuscation using Equality Saturation by @fvrmatteo and @mr_phrazer .

1

75

142

0

3

19

@mrexodia

Duncan Ogilvie 🍍

2 years

Congratulations! 🍾

@hasherezade

hasherezade

2 years

Surprise! #PEbear is Open Source now! - please check it out and let me know what do you think!

Tweet media one

44

696

2K

0

2

18

@mrexodia

Duncan Ogilvie 🍍

1 year

@_n1ghtw0lf Also something worth exploring is the C# scripting plugin: And confusingly DbgCmdExec (queues a command asynchronously) causes a race condition in your example. Likely you want DbgCmdExecDirect instead (executed the implementation of the command directly)

Tweet card media

GitHub - x64dbg/DotX64Dbg: x64Dbg plugin that enables C# plugins with hot-loading support and...

x64Dbg plugin that enables C# plugins with hot-loading support and scripting. - x64dbg/DotX64Dbg

1

1

19

@mrexodia

Duncan Ogilvie 🍍

2 years

Very nice! You can probably speed it up by replacing the hardware breakpoint with switching the return address to a stub that does what you need instead. Could also get rid of int3 by replacing it with a regular inline hook.

@x86matthew

x86matthew

2 years

LogNT32 - Trace all ntdll function calls without a pre-defined list of headers Useful for performing a quick analysis of a potentially malicious 32-bit exe, or to get an insight into the inner-workings of Windows API functions!

2

81

229

1

2

18

@mrexodia

Duncan Ogilvie 🍍

3 months

We need more educational projects like this!

@snowyuwa

snowua

3 months

Finally got EagleVM in a somewhat stable place after actually writing some tests. Pretty happy with the current state of the project but there is still a lot I want to add. Looking forward to soon releasing the 1.0 🤠

1

36

92

0

0

18

@mrexodia

Duncan Ogilvie 🍍

4 years

Just finished a very simple utility to automatically check for, download and install the latest version of @r2gui .

Tweet media one

0

3

16

@mrexodia

Duncan Ogilvie 🍍

4 years

Here it is

Tweet card media

GitHub - mrexodia/NtPhp: Ever wanted to execute PHP in your kernel driver? Look no further!

Ever wanted to execute PHP in your kernel driver? Look no further! - mrexodia/NtPhp

@_can1357

Can Bölük

4 years

@0xrepnz Was originally an inside joke, @mrexodia getting PHP running in kernel (NtPhp) and me getting LUA running in kernel (NtLua), so I wouldn't look for any reasoning behind the choice 🤣 (That being said I hate Python and it's "style" so wouldn't touch it anyways .)

0

0

10

5

2

15

@mrexodia

Duncan Ogilvie 🍍

2 years

Very nice, appreciate you using cmkr 😉

@x86mike

mike

2 years

Breaking Aimware, a popular CS:GO cheat, by obfuscating CS:GO's engine.dll module

18

84

352

0

0

15

@mrexodia

Duncan Ogilvie 🍍

11 months

😂

@lauriewired

LaurieWired

11 months

Abusing binaries is fun.

29

80

692

1

0

15

@mrexodia

Duncan Ogilvie 🍍

4 months

Some truly innovative, high quality work as usual 💪

0

0

15

@mrexodia

Duncan Ogilvie 🍍

5 years

Started a new series on my #blog about analyzing keyboard firmware: #infosec

Tweet card media

Analyzing Keyboard Firmware Part 1 - mrexodia's blog

Blog dedicated to (x64dbg) programming, reverse engineering and general hacking.

mrexodia.github.io

0

4

14

@mrexodia

Duncan Ogilvie 🍍

3 years

There better be some @x64dbg used or I might regret my purchase xD

@GuidedHacking

GuidedHacking

3 years

Our game hacking book, Game Hacking Fundamentals, made by @Erarnitox is now available for sale here:

Tweet media one

Tweet media two

Tweet media three

Tweet media four

67

250

1K

1

2

14

@mrexodia

Duncan Ogilvie 🍍

7 years

How @x64dbg could have helped solving the Shabak's Airplane challenge - Task 3: cc @hasherezade

0

9

13

@mrexodia

Duncan Ogilvie 🍍

3 years

Hm, apparently there is also an option to change the process name PyCharm searches for:

Attach to processes where python is embedded, not just python.exe : PY-14181

Hi, currently 'Attach to Process' looks for processes where the executable is python.exe. Some processes have python interpreters embedded in them (e.g. excel.exe using a pyxll addin - www.pyxll.com)...

youtrack.jetbrains.com

1

3

14

@mrexodia

Duncan Ogilvie 🍍

1 year

Spent way too much time today getting Rosetta to work in @ubuntu 's Multipass on the Apple M1 Pro. Might be useful for some:

Tweet card media

GitHub - mrexodia/rosetta-multipass: Use Rosetta to run amd64 binaries on your M1 with Multipass.

Use Rosetta to run amd64 binaries on your M1 with Multipass. - mrexodia/rosetta-multipass

0

6

14

@mrexodia

Duncan Ogilvie 🍍

1 year

Source code:

Tweet card media

GitHub - IBM/TRAIL: Trial Reasoner for AI that Learns

Trial Reasoner for AI that Learns. Contribute to IBM/TRAIL development by creating an account on GitHub.

@Jose_A_Alonso

José A. Alonso

1 year

An ensemble approach for automated theorem proving based on efficient name invariant graph neural representations. ~ Achille Fokoue et als. #ATP #NeuralNetwork

0

2

5

0

3

14

@mrexodia

Duncan Ogilvie 🍍

2 years

Awesome work!

@trailofbits

Trail of Bits

2 years

Magnifier is a UI that helps reverse engineers explore decompiled programs interactively without all the manual note-taking. Read about this excellent work from our intern, @tcode2k16 !

1

26

112

0

1

14

@mrexodia

Duncan Ogilvie 🍍

2 months

This part of the Python ecosystem is very unfortunate… I feel as though technology () is being deprecated, without a proper alternative being part of the language…

@timmisiak

Tim Misiak

2 months

So to get my python tool running I need to install a tool to install a tool to install a tool.

Tweet media one

Tweet media two

Tweet media three

18

2

127

2

0

14

@mrexodia

Duncan Ogilvie 🍍

2 years

Super awesome release, thanks a lot!

@rh0main

Romain THOMAS

2 years

It's a pleasure to announce the release of open-obfuscator: a free and open-source solution for obfuscating Android and iOS applications (Java/Kotlin, C/C++/Objective-C)

Tweet media one

9

194

578

0

1

13

@mrexodia

Duncan Ogilvie 🍍

2 years

Wrote a guide about getting Final Fantasy 14 Cloud Saves to work on Steam Deck #FFXIV

Tweet card media

FFXIV Cloud Saves on Steam Deck

For unknown reasons FFXIV does not automatically synchronize the settings (character settings, gear...

0

3

14

@mrexodia

Duncan Ogilvie 🍍

8 years

Answer: How to unpack kkrunchy executables?

0

4

13

@mrexodia

Duncan Ogilvie 🍍

2 months

@patrickklepek Actually funnily enough a few friends of mine had the idea to do the opposite years ago: detect an ad is playing on the TV and replace it with stuff from a YouTube playlist. Unfortunately HDCP blocked this plan though… 🥲 The difference in audio for TV advertisements actually

0

1

13

@mrexodia

Duncan Ogilvie 🍍

10 months

Cool stuff!

Tweet card media

Flying Though a Microchip

A fly-though of the top layers of an Intel 22-nanometer processor reconstructed from X-ray scans, a technique called ptychographic X-ray computed tomography ...

www.youtube.com

0

1

12

@mrexodia

Duncan Ogilvie 🍍

2 years

@DuchyRE @c3rb3ru5d3d53c Luckily @x64dbg doesn’t trigger DbgUiRemoteBreakIn when attaching, so this isn’t a problem anymore if you use a modern debugger 😉

0

2

13

@mrexodia

Duncan Ogilvie 🍍

1 year

@hasherezade Might be useful to combine it with . This script parses phnt to extract the arguments and it outputs JSON. Would be easy to adapt to your function tracing format.

2

0

12

@mrexodia

Duncan Ogilvie 🍍

5 years

Just finished writing another post in my series on analyzing my keyboard firmware: #infosec #blog

Tweet card media

Analyzing Keyboard Firmware Part 2 - mrexodia's blog

Blog dedicated to (x64dbg) programming, reverse engineering and general hacking.

mrexodia.github.io

0

4

13

@mrexodia

Duncan Ogilvie 🍍

2 years

Congrats on the talk!

@AlexAltea

Alexandro Sanchez

2 years

PlayStation 3 Emulation talk is over! #FOSDEM22 Recording uploaded below, Q&A and slides will be pinned in comments and the video description.

1

44

125

0

0

13

@mrexodia

Duncan Ogilvie 🍍

1 year

@timmisiak I feel that regardless of the language/technology you use for writing extensions, an IDE experience is a must-have. Writing IDAPython scripts is a massive pain without autocomplete/debugging. Something like with VS+hot-loading is beautiful 😍

Tweet card media

GitHub - x64dbg/DotX64Dbg: x64Dbg plugin that enables C# plugins with hot-loading support and...

x64Dbg plugin that enables C# plugins with hot-loading support and scripting. - x64dbg/DotX64Dbg

1

1

13

@mrexodia

Duncan Ogilvie 🍍

8 years

@hasherezade @x64dbg Just added a GUI for that option in Scylla, also integrated in x64dbg!

Tweet card media

Dump (unmapped) PE files with x64dbg...

Demonstrating a feature similar to https://github.com/hasherezade/malware_analysis/tree/master/pe_unmapperDetails: https://github.com/mrexodia/Scylla http://...

www.youtube.com

0

13

12

@mrexodia

Duncan Ogilvie 🍍

4 years

@jonasLyk Why drop a 0-day on Twitter instead of reporting it to Microsoft's bounty program?

6

0

12

@mrexodia

Duncan Ogilvie 🍍

9 years

Working hard on #x64dbg snapshots: http://t.co/mvgJYDKNbu

1

7

11

@mrexodia

Duncan Ogilvie 🍍

3 years

Just refactored a bit and made it work on more function definitions. Why doesn’t IDA do this @ilfak ?

@herrcore

herrcore

3 years

Ever wonder why you can’t just copy paste function definitions into IDA? Well now you can copy paste them into GeoCities style web form and then into IDA … Thanks @mrexodia :give:

1

8

52

0

0

11