Reverse Engineering

Our efforts in Reverse engineering aids in identifying vulnerabilities, understanding threats, and formulating robust defense mechanisms, making it integral to maintaining a secure and resilient digital environment.

Malware Research

Our focus in malware research involves dissecting and understanding the operation of malicious software. By documenting their behavior and impact, we provide crucial insights that aid in devising effective defensive strategies, contributing to a better understanding and stronger defense against emerging cyber threats.

Penetration Testing

We offer penetration testing services, identifying vulnerabilities by simulating real-world attacks on your digital infrastructure. Our process uncovers potential threats, providing actionable insights for improved security measures, ensuring robust defense and resilience for your business operations.

Open-Source

Our involvement in open-source focuses on offensive security techniques and tools. We utilize and contribute to community-driven projects. This collaborative approach promotes innovative solutions, ultimately strengthening defense against evolving cyber threats.

Some of Our Projects


Latest Events

We are excited to announce that our latest tool, PsyloDbg, has been featured in the "Tools & Exploits" section of Bad Sector Labs Blog's Last Week in Security. Stay tuned for more updates and improvements to come from us at PsyloDbg!

2 years, 1 month ago

PsyloDbg is a versatile, user-friendly, and open-source debugger for the Windows platform. It is entirely written in Delphi, and its purpose is to assist malware analysts in their work by providing them with a fast and effective tool. As a result, analysts can save time and improve their response to malware threats.

2 years, 1 month ago

New Unprotect C# Code Snippet added for technique Timestomp.

This tiny code snippet demonstrate the principle of file time stomping.

Steps:

  • Enumerate files in current directory (excluding the target file).
  • Sort enumerated files by modification date.
  • Takes the most recent file and apply its File Creation Date, File Last Modification and File Last Access to our target file.

Additional information:

  • Supports relative target file.
  • If no files lives inside the current directory, then current directory (parent folder) date information are used.
  • If no files lives inside the current directory and current directory is a root path, then timestomp procedure fails.

2 years, 3 months ago

New Unprotect Delphi code snippet added for technique Process Hollowing, RunPE with support of both x86-32 and x86-64 in a single code.

2 years, 5 months ago

New Unprotect Delphi Code Snippet added for technique Checking Mouse Activity

2 years, 5 months ago

New Unprotect Delphi Code Snippet added for technique DLL Injection via CreateRemoteThread and LoadLibrary with both support of x86-32 and x86-64.

2 years, 5 months ago

New Unprotect Delphi Code Snippet added for technique ProcEnvInjection - Remote code injection by abusing process environment strings for both x86-32 and x86-64.

2 years, 5 months ago

New code snippet that demonstrate how Malware authors create self-deleting application. This technique rely on an external command line interpreter process that attempt to delete malware sample when sample process is terminated.

2 years, 5 months ago

  • Streaming performance considerably increased. FPS rate increased by 65% and can be optimised further by tweaking available options.
  • Streaming desktop resolution is now controlled by the viewer.
  • FastResize option was removed.
  • Code optimisation.
  • Windows key is now supported.
  • Virtual Desktop window will show above terminal window.
  • Beta support of LogonUI (Winlogon Protected Desktop).

2 years, 8 months ago

The purpose of this tool is to allow users to run applications with system-level privileges in the context of their current active Windows session, using only the Microsoft Windows Task Scheduler.

Unlike other common tools, this technique does not require any external software or services, and can be easily configured to launch the system terminal and run the desired application within the current session. This allows users to access system-level functionality and interact with the application in real time.

2 years, 9 months ago

  • Invoke-RemoteDesktopServer error fixed during module import.

2 years, 9 months ago

  • Code improvement.
  • Streaming performance increased.
  • X509 Certificate password supported.

2 years, 9 months ago

  • Option to prevent server computer to enter sleep mode.
  • Streaming performance increased by using dirty region detection (motion update). Only the part of Remote Desktop that changed are sent to viewer.
  • Mouse control improved.
  • Keyboard control improved.
  • Code improvement.

2 years, 9 months ago

PowerRunAsAttached is a ported version of RunAsAttached in pure PowerShell.

2 years, 10 months ago

PowerBruteLogon is a ported version of WinBruteLogon in pure PowerShell.

2 years, 10 months ago

  • Application protocol redesigned to be more fast, stable and modular.
  • Session concurrency now supported. Multiple viewers can connect to the same server at the same time.
  • Possibility to shutdown server using CTRL+C
  • Streaming quality is now controlled by the viewer.
  • Desktop image size is now requested server-side.
  • Bug fix in virtual desktop alignement.
  • Timeout implement during protocol negotiations to avoid possible dead locks.
  • Virtual desktop can now be set on top of other windows.
  • Server supports SecureString for authentication password.

2 years, 10 months ago

  • Deprecated TransportMode option removed.
  • Streaming performance improved.
  • Code improvement, release stability is good enough to mark release as stable.

2 years, 10 months ago