neonprimetime security , just trying to help

 Notes just for me learning CPPEH_RECORD = exception handling __guard_check_icall_fptr = control flow guard _initterm = creation function po...

In C++ XorTesting.exe has XorTesting.cpp which looks like int main(int argc, char * argv[]) {     if ((argc == 3 && strl...

not optimized for shortness does not remove null (00) characters -------- using data -------- section .text  global _start _start: ...

So I was reviewing an executable in x32dbg and came across this call Now I'm just learning, so I can't claim to fully u...

Here's how I understand the GetModuleFileName windows api. It takes 3 parameters, the size of the size of the buffer of where to store t...

Here's how I understand the SetErrorMode windows api. It takes one parameter, the mode which is a bunch of bitwise flags that can be set...

Here's how I understand the GetcommandLine windows api. It takes no parameters, it simply outputs the command that was used to start thi...

Here's how I understand the GetStartupInfo windows api. As a parameter it takes 1 value which is a pass by reference variable that will ...

In this hybrid analysis sample https://www.hybrid-analysis.com/sample/775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a?en...

Intel Assembly Basics 6 16-bit segment registers 1.) CS #code segment 2.) DS #data segment 3.) SS #stack segment 4.) ES #extra segm...

Intel Assembly Basics EIP # instruction pointer, points to next instruction, goal of most attacks is to control this More about neonprim...

Intel Assembly Basics 8 general purpose registers 1.) EAX #can also access hi/lo order 8 bits (AH/AL) 2.) EBX #can also access hi/lo or...

Intel Assembly Basics return 0; Could be represented by this leave xor eax, eax ret Which have lower level cpu OpCodes of these valu...

Intel Assembly Basics return 0; Could be represented by this leave # destroys the stack frame xor eax, eax # sets 0 to the eax regist...

Take this c program that does nothing but exit. #include<stdlib.h> void main(){   exit(0); } Let's say you run this comman...

Recall I previously blogged about the MS15-034 DoS vulnerability that could blue screen a Windows Server with a simple HTTP request. Mike ...