The Evil Bit Blog

Any future posts will be posted here: https://theevilbit.github.io/

Just for fun I started to dig into how could I write a piece of software to detect rubber ducky style attacks on macOS. While I was readin...

Introduction I run into plenty of debates about whether IT certifications are good or bad, what are those people who hold those capable o...

I uploaded all of the materials and files to my latest DSE bypass workshop, which I held at Defcon, hack.lu and Hacktivity to my Github pag...

The contents of this post might be very well known to many people, but for me it was new and honestly, also a bit shocking so I thought I w...

This post is a follow up of my previous post:  https://theevilbit.blogspot.hu/2017/11/turning-cve-2017-14961-ikarus-antivirus.html . I reali...

Another week passed, another update. Not sure how long I can keep up with this frequency :) https://github.com/theevilbit/kex/ Fixed:...

I made a larger update to my kex library again. Token stealing is not the only way in kernel exploitation, suggest to read the following: ...

There are 9 exploitable kernel vulnerabilities discovered in IKARUS anti.virus <2.6.18 discovered by @ParvezGHH . You can read more abou...

I started to dig into the topic of abusing GDI objects for Windows kernel exploitation about two weeks ago, and finally get to the PALETTEs...