PASTIS For The Win!

In this blog post we present PASTIS, a Python framework for ensemble fuzzing, developed at Quarkslab.

more ...

Introducing TritonDSE: A framework for dynamic symbolic execution in Python

We present TritonDSE, a new tool by Quarkslab. TritonDSE is a Python library, built on top of Triton, that provides easy and customizable Dynamic Symbolic Execution capabilities for binary programs.

more ...

Android greybox fuzzing with AFL++ Frida mode

This article is about greybox fuzzing of userland targets that can be encountered in Android using AFL++ and its Frida mode. We also discuss how to target JNI functions, to test the native features invoked by Java code.

more ...

A gentle introduction to Microsoft OMI and how to crash it

This article provides a brief overview of how Microsoft Open Management Infrastructure (OMI) works, as well as two vulnerabilities that the Quarkslab Cloud team identified through fuzzing techniques.

more ...

Our Pwn2Own journey against time and randomness (part 1)

A journey into the Pwn2Own contest. Part 1: Netgear RAX30 router WAN vulnerabilities

more ...

Audit of Falco, the open-source cloud-native runtime security

Falco's maintainers, with support from Cloud Native Computing Foundation, engaged with Quarkslab to perform an audit of Falco, an open-source cloud-native runtime security tool. The goal of the audit was to assist the Falco maintainers to increase their security posture using static and dynamic analysis (fuzzing in particular) and was organized by Open Source Technology Improvement Fund, Inc.

more ...

Vulnerabilities in the TPM 2.0 reference implementation code

In this blog post we discuss the details of two vulnerabilities we discovered in the Trusted Platform Module (TPM) 2.0 reference implementation code. These two vulnerabilities, an out-of-bounds write (CVE-2023-1017) and an out-of-bounds read (CVE-2023-1018), affected several TPM 2.0 software implementations (such as the ones used by virtualization software) as well as a number of hardware TPMs.

more ...

Dark Phoenix: a new White-box Cryptanalysis Open Source Tool

We are releasing a new cryptanalysis tool based on a known paper but without known open source public implementation so far.

more ...

Post-Exploitation: Abusing the KeePass Plugin Cache

This blog post presents a post-exploitation approach to inject code into KeePass without process injection. It is performed by abusing the cache resulting from the compilation of PLGX plugin.

more ...

Digging into the OCI Image Specification

The OCI Image Specification is the core concept behind container images. However, not much is known about it even though container technologies are becoming more and more popular. In this blogpost we will demystify it and look into its internals.

more ...