pyro0ownz pyro0ownz

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.

TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.

Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.

Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t

Introduction

Recently Google made it compulsory that all new apps must be uploaded not as .apk files but as .aab files. Till just recently the tool Buildozer was only able to compile your python applications to .apk but recent changes have allowed us to compile to .aab format. This is an instruction set that can be used to create a release .aab.

What is an AAB

The new .aab format may be a little confusing. .aab stands for app bundles and consists of a bundle of apk's within it. When you upload an aab to the playstore you are basically uploading a bunch of apk. PlayStore then based on the device that is downloading your application will generate the required apk based on that devices architecture and other parameters.

The introduction of .aab doesn't mean that .apk are no longer useful. .aab are only used for releases where as .apk are still used for testing your application and sharing it with others to directly install(not through the store).

> Note: Test your applications

	<#

	DynWin32-ShellcodeProcessHollowing.ps1 performs shellcode based process hollowing using
	dynamically looked up Win32 API calls. The script obtains the methods GetModuleHandle,
	GetProcAddress and CreateProcess by using reflection. Afterwards it utilizes GetModuleHandle
	and GetProcAddress to obtain the addresses of the other required Win32 API calls.

	When all required Win32 API calls are looked up, it starts svchost.exe in a suspended state
	and overwrites the entrypoint with the specified shellcode. Afterwards, the thread is resumed
	and the shellcode is executed enveloped within the trusted svchost.exe process.

	# local port forwarding
	# the target host 192.168.0.100 is running a service on port 8888
	# and you want that service available on the localhost port 7777

	ssh -L 7777:localhost:8888 [email protected]

	# remote port forwarding
	# you are running a service on localhost port 9999
	# and you want that service available on the target host 192.168.0.100 port 12340