Borderline − Don't hate the player, hate the game.

These are troubled times indeed. If you’ve been using the Internet for a while, you must have noticed that the general climate has been steadily declining. In fact, it feels like we have grown quite used to our weekly offense-fest. It is speculated that social media platforms are engineered in a way that encourages them: nothing generates more “engagements” than an inflammatory post that the audience will retweet in feverish, self-righteous anger. The mainstream media certainly doesn’t seem to mind, as this provides a constant stream of highly clickable opinion pieces. As for the participants of those heated debates, they get to go to bed feeling vindicated, feeling like they’ve done their part fighting whatever hateful ideology they helped repeal that day. So, what’s the harm?

A few days ago, Kaspersky published a blog post regarding a likely false flag in the wiper component of OlympicDestroyer. The attempt is based on an undocumented, lesser-known PE header called the RICH header. I don’t want to go into too much details regarding its layout, as many other sources have done a great job documenting it.

Today's article is going to be a short one. Many of you may have read @ropnop's great post on upgrading plain shells to interactive TTYs. While the commands given in the article can solve usability problems, they provide no help on the transport level where several things can go wrong:

For some reason, articles about process injection techniques seem to be popular these days, and I thought it was the perfect opportunity to write something I have had in mind for a long time. As some of you may know, I maintain Manalyze, a static analyzer for PE executables. One key part of this program is obviously its parser, as writing PE parsers is notoriously hard. For this reason, I took great pains to make sure this part of Manalyze could be reused in other projects. A solid documentation exists but examples go a long way and they were sorely missing.