Alexander Hanel alexander-hanel

EDR Reverse Engineering Workspace

Universal workflow for complete reverse engineering of endpoint detection and response (EDR) products. Every EDR dropped into this workspace gets the same systematic treatment: full decompilation, rule extraction, ML model extraction, vulnerability analysis, detection gap analysis, and tradecraft development.

Standardized Folder Structure

When given a new EDR product, create this structure under <product>/:

<product>/

These are simplified examples I came up with to go along with William Woodruff's excellent blog post on x86-64 addressing modes.

All the examples are compiled with GCC -O3 or -Os, which is indicative of what the compiler thinks the best option is in practice.

Base + Index

Use case: Indexing into a byte array (whose address is not fixed)

char f(char buf[], int index)

JMP Deobfuscation Script

Description

This Python script is designed to handle JMP deobfuscation. It will sqash unneeded unconditional jmps and create new blocks, relocates blocks of code, adjusts relative addresses, and aligns blocks with padding.

Inspired by http://hooked-on-mnemonics.blogspot.com/2012/10/simple-deobfuscation-of-code.html

Getting Started

Anti-hype LLM reading list

Goals: Add links that are reasonable and good explanations of how stuff works. No hype and no vendor content if possible. Practical first-hand accounts of models in prod eagerly sought.

Foundational Concepts

Pre-Transformer Models

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

Initial Notes:

The .NET Runtime Event Provider requires setting COMPLUS_ETWEnabled=1 in your process' environment.
CLRConfig will look for configurations in the following places in the following order:
- Look at environment variables (prepending COMPlus_ to the name)
- Look at the framework registry keys (HKCU\Software\Microsoft\.NETFramework
- Look at the framework registry keys HKLM\Software\Microsoft\.NETFramework)
These can be set in the following ways:
- Setting the environment variable COMPlus_:
Windows

IDAPython CTREE

Important links

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

	# api_logger.py

	import logging
	import json
	import requests
	import sys
	import os
	import argparse

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace EtwpTest
	{
	class Program
	{
	static void Main(string[] args)
	{

	""" Extends Ero Carrera's pefile with the functionality for parsing exception tables (SEH support).

	Beginning from version 2021.9.3, this functionality has been integrated into pefile, so you will
	need pefileseh.py only if you use an older version of pefile.

	Only x64 and IA64 architectures are supported.

	Classes defined in this module:
	* StructureWithBitfields
	* ExceptionsDirEntryData