Currently completing some pretty cool offensive .NET internals research (redacted for now...)🔥 Call me too excited, but I think this one's legit top-tier 🙃 I am super curious about your opinion → Vote below please 🤔 Quick teaser ➡️ Clean .NET sample vs technique applied, side by side in... the latest #dnSpyEx: ✅ Clean: • Breakpoints fired • Break on Module/Assembly (Dynamic/Reflection) Load fired • Modules visible • Dynamic analysis intact ❌ Real PoC: • Empty module list • No Breakpoints fired • No Assembly/Module load events - ever • ETW (logman, PerfView) → completely silent • .NET profiler API (e.g. dotTrace) → native-only, managed code gone Managed runtime? ➡️ Unaffected (normal execution) Observers? ➡️ Totally deaf .NET PE Dynamic analysis ➡️ Dead, no ETW, no Managed debugger, no .NET profiler! Write-up coming. Am I too excited or does this slap? 👇 #dotnet #CLR #threatresearch #malware #exploitshow more

Jiří Vinopal

10,753 subscribers

Поделиться Скачать