<?xml version="1.0" encoding="UTF-8"?><rss version="0.92">
<channel>
	<title>thatsBroken</title>
	<link>http://thatsbroken.com</link>
	<description>Breaking things that go beep since 1996</description>
	<lastBuildDate>Wed, 08 Sep 2010 21:02:03 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	<!-- generator="WordPress/3.0.1" -->

	<item>
		<title>BinNavi 3.0 + VirtualKD = Kernel Debugging Goodness</title>
		<description><![CDATA[** UPDATE: New Annotated video will be available in in 30min *** ** UPDATE 2 : New Annotated video available (if vimeo ever finishes encoding&#8230;) *** Kernel Tracing HTTP.SYS with BinNavi 3.0 from jeremy Richards on Vimeo. The fine folks over at Zynamics were nice enough to lend me a copy of BinNavi 3.0 and [...]]]></description>
		<link>http://thatsbroken.com/?p=333</link>
			</item>
	<item>
		<title>VMWare ESXi 3.5/4.0 Information Disclosure (Vulnerability?)</title>
		<description><![CDATA[Let me start out by saying that ESX and ESXi both have the ability to allow management from a defined IP address or IP mask.  In addition, they both allow you to set a management interface and bind the management interface to only allow connections from an administrative subnet.  This is just security best practice [...]]]></description>
		<link>http://thatsbroken.com/?p=320</link>
			</item>
	<item>
		<title>Reversing the iPhone Device Service (AppleMobileDeviceService.exe)</title>
		<description><![CDATA[UPDATE: ***** ACCESS VIOLATION ***** AppleMobileDeviceService.exe:0040fe9a mov eax,[eax] from thread 276 caused acces s violation when attempting to read from 0x6b736643 CONTEXT DUMP EIP: 0040fe9a mov eax,[eax] EAX: 6b736643 (1802724931) -&#62; N/A EBX: 003c3ee8 (   3948264) -&#62; A&#62;&#60;XAAAC (heap) ECX: 00420498 (   4326552) -&#62; H&#62;&#60; (AppleMobileDeviceService.exe.data) EDX: 00000000 (         0) -&#62; N/A EDI: 0078fc04 (   [...]]]></description>
		<link>http://thatsbroken.com/?p=296</link>
			</item>
	<item>
		<title>LOL @ Apple</title>
		<description><![CDATA[I&#8217;m writing up a proper post about reverse engineering your target to properly identify snapshot and restore points but I had to quickly share something I found in the binary:]]></description>
		<link>http://thatsbroken.com/?p=291</link>
			</item>
	<item>
		<title>In Memory Fuzzing</title>
		<description><![CDATA[In memory fuzzing is a form off process instrumentation that allows the analyst to bypass parsers, network limitations, encryption and data marshaling steps to deal directly with a functions inputs and test its integrity. The upsides: It&#8217;s faster to get to your target function than creating mini-clients or modifying file formats (or generating 1.5 TB [...]]]></description>
		<link>http://thatsbroken.com/?p=282</link>
			</item>
	<item>
		<title>MS10-012 Remote Unauthenticated Vulnerability Check.</title>
		<description><![CDATA[You don&#8217;t get this often&#8230; the advisory released by the vulnerability researcher includes a ton of PoC code that can be used to, among other things, detect the MS10-012 patch without authentication. The script connects to a target over TCP 445 and sends it a negotiation request.  The response is parsed for the 8byte challenge [...]]]></description>
		<link>http://thatsbroken.com/?p=269</link>
			</item>
	<item>
		<title>PAIMEIPeek.py vs AppleMobileDeviceService.exe</title>
		<description><![CDATA[I notice that anyone with a computer that has itunes + iphone gets a nifty little service called AppleMobileDeviceService.exe. I also noticed that it listens on a TCP port and it runs as SYSTEM. Before anyone gets super excited, I&#8217;m not going to drop a 0day in this post. I&#8217;m simply going to show you [...]]]></description>
		<link>http://thatsbroken.com/?p=263</link>
			</item>
	<item>
		<title>MS10-012 and TurboDiff 1.0.1b2</title>
		<description><![CDATA[The vulnerability researcher responsible for part of MS10-012, Hernan Ochoa, from Hexale / Core Security and author of UHooker will be releasing an advisory on the Weak NTLM Entropy. I am hoping his post goes into detail and he provides some kind of proof of conecpt. Keep an eye on thatsBroken for a breakdown and [...]]]></description>
		<link>http://thatsbroken.com/?p=248</link>
			</item>
	<item>
		<title>Adding a hook to the PAIMEIpeek UI</title>
		<description><![CDATA[Hey all, I&#8217;m working on fuzzing an Apple service and I needed PAIMEIPeek to track send() as well as recv()&#8230; since recv() function tracing is already in PAIMEIpeek.py adding support for send() was pretty damn simple. update: paimei/console/modules/PAIMEIpeek.py and paimei/console/modules/_PAIMEIpeek/PeekOptionsDlg.py The new options window: I&#8217;ll continue fuzzing this project using a more advanced technique called [...]]]></description>
		<link>http://thatsbroken.com/?p=235</link>
			</item>
	<item>
		<title>PaiMei:  Fixing PAIMEIpeek.py</title>
		<description><![CDATA[If you&#8217;ve spent any time playing with PaiMei&#8217;s PEEK! Module you&#8217;ve no doubt run into bugs. PEEK! has the ability to track and print to screen the registers and stack when calls to recv() and recvfrom() are made. When these functions return EAX holds the buffer length of the recieved packet&#8230; unless there is a [...]]]></description>
		<link>http://thatsbroken.com/?p=227</link>
			</item>
</channel>
</rss>
