Aggregator

不争眼前长短，要谋来日方长。再艰难的日子也要努力的生活，保持身体健康、磨练坚韧心智，未来一定无限美好。

虽然 fcitx5-configtool 内可以为 fcitx5-pinyin 导入搜狗词库，但它并不能批量导入词库，因而特此写一篇教程记录下我研究出的批量导入搜狗词库的方案。

一、背景 二、整体框架 三、SO保护壳分析 四、DEX保护壳分析 五、Native原理分析 六、总结 一、背景 最近朋友让我帮忙对他们银行APP进行黑盒分析,检测其安全性，探未知程序漏洞与安全性测试，提升业务整体安全能力，我拿到APP后进行安装抓包后发现都是加密传输的，用JEB进行反编译找数据组合的

2021年的科幻出版物分析报告出炉啦，依然是从图书

2021年的科幻出版物分析报告出炉啦，依然是从图书

Summary ***Updated 04/08/2022*** The Spring-Projects team has released a blog in an effort to clear up confusion about the alleged deserialization RCE vulnerability. There are, however, vulnerabilities that have been patched and a Yara rule has been published. Please see the latest recommendations. Threat Type Vulnerability Overview ***UPDATE #5, April 8, 2022*** A report from Chinese cybersecurity firm, Qihoo 360, has reported on the first confirmed case(s) of Spring4Shell being leveraged to gain access a

壳整体是指令抽取加方法native化二者结合，所有被抽走的指令还原后dump出来也能分析出80%左右的代码，其它被native化的用JNItrace配合分析，所以用该加固方案客户端代码安全性一般。

0x00 前言太久没有整活了可以说是十分懈怠了。现在整活的门槛也越来越高，去年群友还只是每天rce就很开心了

他们告诉开发者如果部署SDK可每个月赚取 100 到 10000 美元甚至更多，这取决于它可以提供多少活跃用户。

Summary According to multiple sources an OpenSSL vulnerability in some Palo Alto appliances could be exploited to trigger a denial of service (DOS) condition. This vulnerability has been patched in OpenSSL but not all Palo Alto appliances. Threat Type Vulnerability Overview X-Force is tracking the disclosure of an OpenSSL vulnerability in some Palo Alto appliances that if exploited could lead to a denial of service (DOS) condition. In early March of 2022, updates were released by OpenSSL to address CVE-20

本文介绍了SurFree，这是一种基于几何原理的对抗攻击算法，可以在最苛刻的条件下，即基于黑盒决策的攻击，仅仅依赖最终的分类标签来大幅减少查询花销。

Porting part 2's ChakraCore exploit to Microsoft Edge while defeating ASLR, DEP, CFG, ACG, CIG, and other mitigations.

一套基于反向代理的流程化、模板化水坑攻击，全程只使用前端，做到受害者无感知使用的技术

MAC 的Nox模拟器依赖virtualbox模拟，一直卡在99%，因为nox只是个封装调用，实际上还是virtualbox,virtualbox单独启动报错： virtualbox也是最新版 报错信息如下： Kernel driver not installed (rc=-1908) Make s

Conti is a notorious ransomware group that targets high-revenue organizations. They were first detected in 2020, and appear to be based in Russia. It is believed that the group is the successor to Ryuk ransomware group. According to Chainalysis, The ransomware group was the highest grossing of all ransomware groups in 2021, with an estimated revenue of at least 180 million dollars.

Microsoft is excited to announce the addition of Exchange on-premises, SharePoint on-premises, and Skype for Business on-premises to the Applications and On-Premises Servers Bounty Program. Through this expanded program, we encourage researchers to discover and report high-impact security vulnerabilities to help protect customers. We offer awards up to $26,000 USD for eligible submissions.

本文是以一个虚拟的大型互联网公司的视角对DevSecOps体系构建的总结和思考。

分享一首伟人的七律，上海的朋友们加油。坚信人民和党“敢教日月换新天”的革命浪漫主义情怀不会消失，上海必胜！ 《到韶山》 别梦依稀咒逝川，故园三十二年前。 红旗卷起农奴戟，黑手高悬霸主鞭。 为有牺牲多壮志，敢教日月换新天。 喜看稻菽千重浪，遍地英雄下夕烟。