home.social

#peb — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #peb, aggregated by home.social.

  1. “Un ami compte voter #PS aux #élections, que faire ?” - Les questions des auditeur.ices
    youtube.com/watch?v=seSIhAV5XkE
    invidio.us/watch?v=seSIhAV5XkE

    Un vrai problème en effet, avec une vraie solution, donnée par #PEB

    #Humour #LaDernière #PlusJamaisPS

  2. Spoiler short video for April's launch of the film: The People's Emergency Briefing from Nati9nal Emergency Briefing held in late November 2025 in Westminster, London.

    m.youtube.com/watch?v=JaI-dHgh

    #new #peb #chrispackham #ecological #emergency #climateemergency

  3. “Un humoriste a-t-il raté sa vie s’il n’a pas eu de plainte ?”- Les questions des VRAIS auditeurs

    loma.ml/display/373ebf56-9269-

  4. Погружаемся в PEB. DLL Spoofing

    В предыдущей статье мы в первом приближении рассмотрели PEB и разобрались, как подменить аргументы командной строки. Продолжая разбираться с PEB, рассмотрим еще один способ повлиять на исполнение программы, и попробуем подменить вызываемую из DLL функцию.

    habr.com/ru/articles/811107/

    #peb #windows #winapi #spoof #malware

  5. // start a second copy of or process in a suspended state so we can set up our callback safely
    if (!CreateProcessA(NULL, file_path, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
    printf("C() failed, error: %d\n", GetLastError());
    }

    // overwrite the g_ptr_table in the child process with the already initialized one
    if (!WriteProcessMemory(pi.hProcess, &g_ptr_table, &g_ptr_table, sizeof(PTR_TABLE), NULL)) {
    printf("Write 1 failed, error: %d\n", GetLastError());
    }

    // ntdll pointer are encoded using the system pointer cookie located at SharedUserData!Cookie
    LPVOID callback_ptr = encode_system_ptr(&LdrGetProcedureAddressCallback);

    // set ntdll!AvrfpAPILookupCallbackRoutine to our encoded callback address
    if (!WriteProcessMemory(pi.hProcess, (LPVOID)(avrfp_address + 8), &callback_ptr, sizeof(ULONG_PTR), NULL)) {
    printf("Write 2 failed, error: %d\n", GetLastError());
    }

    // set ntdll!AvrfpAPILookupCallbacksEnabled to TRUE
    uint8_t bool_true = 1;

    if (!WriteProcessMemory(pi.hProcess, (LPVOID)avrfp_address, &bool_true, 1, NULL)) {
    printf("Write 3 failed, error: %d\n", GetLastError());
    }

    // resume the process
    ResumeThread(pi.hThread);

    DLL proxying and side loading is a fun time :D

    #security #cpp #codeisn'tmine #DLL #peb