Occasionally... 😃🤳🏻🪞🎒🛫
#MirrorPic #Casual
#Airport #Restroom
#Photoshoot #Packed
#Classic #Reflection

london underground doing its best job pretending its the Tokyo subway #packed

[Paper of the day][#17] Are you a #malware #researcher? Let's discuss the best practices to analyze malware. How do you define dataset size? How do you define #sandbox timeouts? How do you compare multiple different #antivirus (#AVs) labels? Should we include or exclude #packed samples from tests? Can online and offline traces be compared? Is detection rate all that matters? What are the most common malware sample sources for experiments? This and much more in this paper.

Academic paper: https://www.sciencedirect.com/science/article/pii/S0167404821001115
Archived version: https://secret.inf.ufpr.br/papers/marcus_challenges.pdf

[Paper of the day][#12] We all know that #malware can be #packed. But do you know how a #packer run in your system? I mean, do you know what happens in the CPU when a packed malware runs? In this paper, we explain the architectural events associated to #Self-Modifying Code (#SMC) execution. We show how cache is invalidated, the role of cache coherence protocol, the invalidation of the #trace #cache at the #CPU #decoder level, and the #pipeline stalls caused by instruction rewriting. We show how cache instrumentation and #Hardware #Performance Counters (#HPC) can be used to detect these events, working as detection trigger. We also show how to write SMC code using #cache #flushes to bypass eventual protection. Lots of good material on CPU internals.

Academic paper: https://link.springer.com/article/10.1007/s11416-020-00348-w
Archived version: https://secret.inf.ufpr.br/papers/SMC_marcus.pdf
SMC samples and CTF challenge: https://github.com/marcusbotacin/Self-Modifying-Code

Lunch Planning! Every meal is only 1 gram of protein. 🍎 #PKU #Lunch #packed #diet #metabolic #geneticcondition