Jiří Vinopal's banner
Jiří Vinopal's profile picture

Jiří Vinopal

@vinopaljiri • 10,416 subscribers

Threat Researcher at Check Point @_CPResearch_ All opinions expressed here are mine only. https://t.co/iWvwWF1AnN

Videos

LIVE
1.2k

Anya Rossi

sweetdream.ai

SweetDream.aiSponsored•Livecam
Streaming Now

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

HD live stream
Exclusive private shows
1.2k viewers online

Free preview available • Premium content

Let's Zoom-In to the new start of the week... 🔍 Releasing #IDA Plugin #ZoomAllViews — Ctrl+Scroll font zoom for every IDA view. 💪 Because this should work out of the box. Now it does. 🤓 • Zoom in/out in Disassembly, Pseudocode, Hex View, Strings, Imports, Functions, Structures, and every chooser 😲 • Works across Normal & Debug view widgets — Stack, Registers, Locals, Watch • Row heights scale automatically with font size • Graph/Proximity/Xref views excluded — IDA's native zoom untouched ☝️ • Toggle on/off via menu or Ctrl-Shift-Z • Single file, zero dependencies 🫰 • Compatible IDA 8.x — 9.3+ (PyQt5 / PySide6) 🛠️ #IDAPro #ReverseEngineering #IDAPython #Malware #DFIR Hex-Rays SA
1:39
vinopaljiri's profile picture

Let's Zoom-In to the new start of the week... 🔍 Releasing #IDA Plugin #ZoomAllViews — Ctrl+Scroll font zoom for every IDA view. 💪 Because this should work out of the box. Now it does. 🤓 • Zoom in/out in Disassembly, Pseudocode, Hex View, Strings, Imports, Functions, Structures, and every chooser 😲 • Works across Normal & Debug view widgets — Stack, Registers, Locals, Watch • Row heights scale automatically with font size • Graph/Proximity/Xref views excluded — IDA's native zoom untouched ☝️ • Toggle on/off via menu or Ctrl-Shift-Z • Single file, zero dependencies 🫰 • Compatible IDA 8.x — 9.3+ (PyQt5 / PySide6) 🛠️ #IDAPro #ReverseEngineering #IDAPython #Malware #DFIR Hex-Rays SA

Jiří Vinopal

14,261 Aufrufe • vor 2 Monaten

Inspired by Grzegorz Tworek, I created PoC: EXE-or-DLL-or-ShellCode that can be: Executed as a normal #exe Loaded as #dll + export function can be invoked Run via "rundll32.exe" Executed as #shellcode right from the DOS (MZ) header that works as polyglot stub
0:59
vinopaljiri's profile picture

Inspired by Grzegorz Tworek, I created PoC: EXE-or-DLL-or-ShellCode that can be: Executed as a normal #exe Loaded as #dll + export function can be invoked Run via "rundll32.exe" Executed as #shellcode right from the DOS (MZ) header that works as polyglot stub

Jiří Vinopal

43,489 Aufrufe • vor 1 Jahr

#IDA TIP to load #Windows #Kernel types: [1/2] Windows Kernel types (e.g., EPROCESS, ETHREAD, etc.) are not a part of the built-in IDA TILs (because they are changing across different WIN versions). 1. These types are a part of the "ntoskrnl.exe" debug symbols -> "ntkrnlmp.pdb". 2. IDA supports loading "only types" from arbitrary "pdb" file. 3. One can also use the IDA->File->Load file->PDB file dialog to load specific version of "ntoskrnl.exe" and IDA will proceed with automatic download of appropriate "ntkrnlmp.pdb" applying "only types" (if optional checkbox is selected). 4. See example video...
2:08
vinopaljiri's profile picture

#IDA TIP to load #Windows #Kernel types: [1/2] Windows Kernel types (e.g., EPROCESS, ETHREAD, etc.) are not a part of the built-in IDA TILs (because they are changing across different WIN versions). 1. These types are a part of the "ntoskrnl.exe" debug symbols -> "ntkrnlmp.pdb". 2. IDA supports loading "only types" from arbitrary "pdb" file. 3. One can also use the IDA->File->Load file->PDB file dialog to load specific version of "ntoskrnl.exe" and IDA will proceed with automatic download of appropriate "ntkrnlmp.pdb" applying "only types" (if optional checkbox is selected). 4. See example video...

Jiří Vinopal

21,737 Aufrufe • vor 1 Jahr

Keine weiteren Inhalte verfügbar