https://blackwinghq.com/themes/platform--os/Blackwing Intelligence provides high-end security engineering, analysis, and research services for engineering focused organizationsenTue, 15 Oct 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/finding-vulnerability-variants-at-scale/Tue, 15 Oct 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/finding-vulnerability-variants-at-scale/From a JPEG file-format bug in jpeg-recompress to its variants across Chromium, Electron, WINE and more: a method for finding vulnerability variants at scale.https://blackwinghq.com/blog/posts/playing-with-libmalloc/Tue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/playing-with-libmalloc/An introduction to macOS libmalloc in 2024 and heapster, a new tool for exploring the heap, plus a few strange things found along the way.https://blackwinghq.com/research/tools/heapster/Tue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/research/tools/heapster/A tool for exploring the macOS libmalloc heap from LLDB: zones, magazines, free lists and the state of individual allocations, introduced in our libmalloc post.https://blackwinghq.com/research/tools/iboot64binja/Thu, 01 Oct 2020 00:00:00 +0000https://blackwinghq.com/research/tools/iboot64binja/A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is accurate, then restores a set of useful symbols from heuristics, so you start from a mapped, partly labelled image instead of a blob at address zero. Inspired by argp’s iBoot64helper loader for IDA Pro.https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Sun, 04 Aug 2013 00:00:00 +0000https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Turning PostgreSQL's CVE-2013-1899 command-line-flag injection from a denial of service into remote code execution.https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Thu, 07 Aug 2008 00:00:00 +0000https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Apple’s OS X operating system has been gaining in popularity. This presentation details how to manipulate the OS X kernel in order to hide an attacker’s activities and maintain access.https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Sat, 14 Jun 2008 00:00:00 +0000https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Using the Mach interfaces in the OS X kernel to manipulate the kernel from user space, i.e. from shellcode, to alter kernel structures. Example shellcodes are included.https://blackwinghq.com/research/talks/blackjacking/Sat, 05 Aug 2006 00:00:00 +0000https://blackwinghq.com/research/talks/blackjacking/Jesse D’Aguanno demonstrated using the trust relationship between the BlackBerry Enterprise Server infrastructure and the handhelds to bypass perimeter controls and compromise an internal corporate network.