Maisons-Laffitte, France
Joined November 2009
- Tweets56
- Following158
- Followers7.9K
- Likes838
🚀You can now search for malware families, releases, techniques, and code snippets, including archives on Malware Gallery: malwaregallery.com
#InfoSec #Malware #DFIR
People copying nicknames is just a sign of how inspiring someone is. It can surely cause trouble, but I believe it is the highest form of flattery.
I would even say that you were among the very few "countable on one hand" who were most impactful at that time. You inspired so many young developers, including myself.
Because, you are a true legend! Many people, especially younger generations, are unaware that you are a pioneer in infosec and malware research. Numerous concepts they now take for granted were pushed to light by innovators like you in the late 1990s and 2000s.
We may not be talking about the same thing. I'm not referring to PowerShell for executing payloads; rather, I'm describing an indirect memory write technique.
New code snippet added that demonstrates the principle of indirectly copying a buffer to another memory region using the Windows APIs ReadProcessMemory (Example 1) or ReadFile (Example 2): unprotect.it/snippet/indirec…
Has anyone ever seen or used this evasion technique? I have been using it for many years and still find it effective (particularly with macro's), so I was surprised to see it continue to work so I decided to document it on Unprotect : unprotect.it/technique/indir… Feedback appreciated!
More exactly Delphi/Lazarus for the Server, MASM for the loader. The loader then loads pieces of shellcodes per feature (a technique called Func-In at that time)
