<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>TheXploit &#124; Security Blog</title>
	<atom:link href="http://thexploit.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://thexploit.com</link>
	<description></description>
	<lastBuildDate>Thu, 03 May 2012 04:36:33 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
		<item>
		<title>50 Byte x86_64 OS X setuid execve Null Free Shellcode</title>
		<link>http://thexploit.com/sec/50-byte-x86_64-os-x-setuid-execve-null-free-shellcode/</link>
		<comments>http://thexploit.com/sec/50-byte-x86_64-os-x-setuid-execve-null-free-shellcode/#comments</comments>
		<pubDate>Fri, 13 Apr 2012 04:32:07 +0000</pubDate>
		<dc:creator>Dustin Schultz</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Security Development]]></category>
		<category><![CDATA[shellcode]]></category>

		<guid isPermaLink="false">https://secure.thexploit.com/?p=1527</guid>
		<description><![CDATA[More smaller shellcode, this time, tested and verified working on OSX 10.7.
Shellcode
Source

; File: setuid_shell_x86_64.asm
; Author: Dustin Schultz - TheXploit.com
BITS 64

section .text
global start

start:
mov r8b, 0x02                   ; Unix class system calls = 2
shl r8, 24                  [...]]]></description>
		<wfw:commentRss>http://thexploit.com/sec/50-byte-x86_64-os-x-setuid-execve-null-free-shellcode/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Finding the syscall implementations in OS X</title>
		<link>http://thexploit.com/secdev/finding-the-syscall-implementations-in-os-x/</link>
		<comments>http://thexploit.com/secdev/finding-the-syscall-implementations-in-os-x/#comments</comments>
		<pubDate>Thu, 05 Apr 2012 04:14:44 +0000</pubDate>
		<dc:creator>Dustin Schultz</dc:creator>
				<category><![CDATA[Security Development]]></category>

		<guid isPermaLink="false">https://secure.thexploit.com/?p=1519</guid>
		<description><![CDATA[This is mainly just a little note for myself. Sometimes when I&#8217;m writing shellcode, I&#8217;m interested in how OS X implements the syscalls internally. It&#8217;s easy to find out with a command like this:

dustin@sholtz:~$ otool -tv /usr/lib/system/libsystem_kernel.dylib &#124; grep -A10  [...]]]></description>
		<wfw:commentRss>http://thexploit.com/secdev/finding-the-syscall-implementations-in-os-x/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Execve Syscall on OSX 10.7</title>
		<link>http://thexploit.com/secdev/execve-syscall-on-osx-10-7/</link>
		<comments>http://thexploit.com/secdev/execve-syscall-on-osx-10-7/#comments</comments>
		<pubDate>Thu, 05 Apr 2012 04:06:29 +0000</pubDate>
		<dc:creator>Dustin Schultz</dc:creator>
				<category><![CDATA[Security Development]]></category>

		<guid isPermaLink="false">https://secure.thexploit.com/?p=1512</guid>
		<description><![CDATA[I&#8217;m getting some strange behavior with shellcode that used to work on OS X 10.6. I noticed that if I don&#8217;t link with the &#8220;-static&#8221; option, I get a segfault.
With static:

dustin@sholtz:~$ nasm -f macho64 shell.s
dustin@sholtz:~$ ld -static -arch x86_64 shell.o
dustin@sholtz:~$  [...]]]></description>
		<wfw:commentRss>http://thexploit.com/secdev/execve-syscall-on-osx-10-7/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Book Review: Practical Malware Analysis</title>
		<link>http://thexploit.com/reviews/book-review-practical-malware-analysis/</link>
		<comments>http://thexploit.com/reviews/book-review-practical-malware-analysis/#comments</comments>
		<pubDate>Tue, 03 Apr 2012 04:19:46 +0000</pubDate>
		<dc:creator>Dustin Schultz</dc:creator>
				<category><![CDATA[Reviews]]></category>
		<category><![CDATA[book review]]></category>

		<guid isPermaLink="false">https://secure.thexploit.com/?p=1472</guid>
		<description><![CDATA[I&#8217;ve been dying to get this review out for a while now. There&#8217;s so much good and deep content in this book, that reading it on nights after work and weekends took longer than expected! I&#8217;ll tell you now that if you&#8217;re into computers and computer security, this book won&#8217;t let you down. This book is  [...]]]></description>
		<wfw:commentRss>http://thexploit.com/reviews/book-review-practical-malware-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Half way through Practical Malware Analysis</title>
		<link>http://thexploit.com/reviews/half-way-through-practical-malware-analysis/</link>
		<comments>http://thexploit.com/reviews/half-way-through-practical-malware-analysis/#comments</comments>
		<pubDate>Fri, 16 Mar 2012 04:24:44 +0000</pubDate>
		<dc:creator>Dustin Schultz</dc:creator>
				<category><![CDATA[Reviews]]></category>

		<guid isPermaLink="false">https://secure.thexploit.com/?p=1468</guid>
		<description><![CDATA[I&#8217;m about half way through Practical Malware Analysis and let me just say &#8230; this book is awesome! Quote me on this: I guarantee this book will go down in history as one of the best in its class. Look out for my full review!
]]></description>
		<wfw:commentRss>http://thexploit.com/reviews/half-way-through-practical-malware-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Minified using apc
Page Caching using apc
Database Caching using apc
Object Caching 542/590 objects using apc

Served from: thexploit.com @ 2012-05-17 21:01:34 -->
