Follow

Subscribe to nixhacker - The Reverser's Space

Get the latest posts delivered right to your inbox

Great! Check your inbox and click the link to confirm your subscription

Please enter a valid email address!
Log in Sign up

Shubham Dubey

Shubham Dubey

Besides being a Linux & Open source advocate, I spent most of my time in working on low level security stuff(Reversing, Rootkits, Bios, negative rings etc).

India https://www.linkedin.com/in/shubham0d/

Peeling Back the Layers: Understanding Windows components Architecture through SAC/EMS Reversing

Windows OS

Peeling Back the Layers: Understanding Windows components Architecture through SAC/EMS Reversing

In this article, we will be exploring the inner workings of how SAC operates! This will also give you a better understanding of the low-level components of Windows implementation details, and what you can look forward to after reversing them.

By Shubham Dubey 6 Sep 2024

Setting up EMS ( Emergency Management Services) SAC in Windows running inside Hyper-v

Windows OS

Setting up EMS ( Emergency Management Services) SAC in Windows running inside Hyper-v

In this article I will walk you though the process of setting up EMS (Emergency Management Services) for a system running in Hyper-V Virtual machine. We will also look into the features that EMS SAC provides.

By Shubham Dubey 8 May 2024

Remote Kernel Debugging Windows virtual machine (Generation 2) using Serial COM running inside Hyper-v

Windows OS

Remote Kernel Debugging Windows virtual machine (Generation 2) using Serial COM running inside Hyper-v

This article is a step by step guide to attach windbg to remote windows kernel running inside generation 2 Hyper-V.

By Shubham Dubey 27 Apr 2024

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 4

Exploit Development

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 4

This article series is a technical dive into the evaluation of these memory corruption mitigations. This part is focus on memory error detection tools introduced over years.

By Shubham Dubey 7 Jan 2024

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 3

Exploit Development

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 3

This article series is a technical dive into the evaluation of these memory corruption mitigations. This part is focus on mitigations that second generation, mostly introduced after 2010.

By Shubham Dubey 7 Jan 2024

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 2

Exploit Development

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 2

This article series is a technical dive into the evaluation of these memory corruption mitigations. This part is focus of mitigations that first generation, introduced before 2010 mostly.

By Shubham Dubey 7 Jan 2024

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 1

Exploit Development

Nostalgic memory - An attempt to understand the evolution of memory corruption mitigations - Part 1

Arbitrary Code execution due to memory corruption is there since the years and still a major thing. Over the year, new protective measures have been introduced periodically to mitigate these attacks.This article series is a technical dive into the evaluation of these memory corruption mitigations.

By Shubham Dubey 7 Jan 2024

Summary of linux kernel security protections and associated attacks

Linux

Summary of linux kernel security protections and associated attacks

Linux kernel goes through rapid changes frequently. Unlike other platforms, Linux security features are not advertised enough and are limited to mail threads. Since Linux is getting more popular, it's important to be aware about protections it provides against sophisticated attacks targeting kernel.

By Shubham Dubey 1 Jan 2023

Uncovering the security protections in MAC - XProtect and MRT

Uncovering the security protections in MAC - XProtect and MRT

In the second part of the series I will discuss on XProtect and MRT working and limitations for both the setups. This will give you an idea how robust Macos default malware detection solution is.

By Shubham Dubey 22 Feb 2022

Uncovering the security protections in MacOS - Gatekeeper

Uncovering the security protections in MacOS - Gatekeeper

In this series, I will be uncovering the internals of MacOS security protections. In this part I will be focus on Gatekeeper.

By Shubham Dubey 22 Feb 2022

Hooking or Monitoring System calls in linux using ftrace

Rootkits

Hooking or Monitoring System calls in linux using ftrace

In this post we will see how can you use ftrace to hook linux system calls. For learning purpose, we will create a kernel module that will make any target file immutable in system.

By Shubham Dubey 24 Sep 2021

Remote debugging windows kernel driver(without symbols) using windbg

Reverse engineering

Remote debugging windows kernel driver(without symbols) using windbg

In this post we are going to learn few tips and tricks to debug a Windows kernel driver without symbols in windbg.

By Shubham Dubey 2 Jul 2021

Firmware security 3: Digging into System management mode (SMM)

Firmware

Firmware security 3: Digging into System management mode (SMM)

In the third part of the series we are going to discuss System management mode (SMM) and it's security. Moreover, We will try to interact with the SMM from our linux system.

By Shubham Dubey 20 Mar 2021

Firmware security 1: Playing with PCI device memory

Firmware

Firmware security 1: Playing with PCI device memory

In this part of the series we will go through the basic of PCI devices and their memory. We will be developing linux kernel driver and using chipsec to analyze the data practically.

By Shubham Dubey 14 Nov 2020

Impact of x64 calling convention in format string exploitation

Exploit Development

Impact of x64 calling convention in format string exploitation

In this post I will try to give you a brief on how format string exploitation can differ in 64 bit architecture due to different calling convention in 64 bit.

By Shubham Dubey 20 Oct 2020