https://emanuelecozzi.net/ Recent content on Emanuele Cozzi Hugo -- gohugo.io en-us invano@me.com (Emanuele Cozzi) invano@me.com (Emanuele Cozzi) Tue, 19 Mar 2019 15:34:59 +0000 https://emanuelecozzi.net/honey/ Tue, 19 Mar 2019 15:34:59 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/honey/ ╔ Live stats from a dumb honeypot running for _ days ║ ╠═ Total attacks: ___ ║ ╠═ Recently dropped samples: ║    ║ ║    ╠═ ___ @ ___ - ___ ║    ║ ║    ╠═ ___ @ ___ - ___ https://emanuelecozzi.net/posts/ctf/flareon-2018-challenge-12-subleq-rssb-writeup/ Sun, 23 Sep 2018 15:13:13 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/ctf/flareon-2018-challenge-12-subleq-rssb-writeup/ After explaining my solution for the last challenge of Flare-On 2018, I want to move one and analyze the details of the second stage. I will entirely focus on two OISC machines: Subleq1 and RSSB2. Take it as a personal training to tackle these processors and a way to get rid of the curiosity I wasn't able to eliminate when I firstly scored this challenge. https://emanuelecozzi.net/posts/ctf/flareon-2018-challenge-12-cat-grep-writeup/ Fri, 21 Sep 2018 22:47:20 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/ctf/flareon-2018-challenge-12-cat-grep-writeup/ New year, new Flare-On. This year edition somehow pushed us to the world of VMs reversing. First with challenge 10 built on top of the Intel VMX instruction set, later with challenge 12. The last challenge was quite crazy as usual, but it kind of intrigued me a lot. https://emanuelecozzi.net/posts/ctf/csaw18-quals-1337-writeup/ Tue, 18 Sep 2018 22:21:11 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/ctf/csaw18-quals-1337-writeup/ The NOPS team couldn't miss CSAW CTF 2018 qualification round. We scored 6th in Europe and 17th worldwide. I mostly focused on reversing with kvm, rev 500, and 1337 initially rev 300, later upgraded to rev 500. Today an Eurecom former student sent me an email asking how I solved 1337. https://emanuelecozzi.net/posts/recon18-modern-linux-malware-exposed/ Mon, 25 Jun 2018 22:39:09 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/recon18-modern-linux-malware-exposed/ This month I gave a talk at Recon Montreal 2018 about Linux malware and how we analyze them. This is an in-depth follow up of the Oakland paper Understanding Linux Malware more focused on the practical and technical aspects of the work (and malware). https://emanuelecozzi.net/posts/understanding-linux-malware-paper/ Mon, 25 Jun 2018 22:10:25 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/understanding-linux-malware-paper/ My research work on Linux malware was accepted at IEEE Security & Privacy 2018, San Francisco. Abstract—For the past two decades, the security community has been fighting malicious programs for Windows-based operating systems. However, the recent surge in adoption of embedded devices and the IoT revolution are rapidly changing the malware landscape. https://emanuelecozzi.net/posts/ctf/csaw17-kws2-heap-overflow-slub/ Wed, 24 Jan 2018 21:37:30 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/ctf/csaw17-kws2-heap-overflow-slub/ TL;DR CSAW17 finals - kws2 write-up is here. During the last three years of CTF games I did nothing but reverse engineering challenges. Started as a solo-player with pure reversing competitions, I ended up playing in a cool team with great guys. https://emanuelecozzi.net/posts/ctf/how-to-fly-with-radare2/ Fri, 11 Nov 2016 19:00:00 +0200 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/posts/ctf/how-to-fly-with-radare2/ Instead of writing an usual writeup on how I solved The Wall (rev200) during HackTheVote2016, I'd rather put more emphasis on how I solved this chall by using radare2 only. No need to introduce radare2 if you are reading this post. https://emanuelecozzi.net/about/ Mon, 01 Jan 0001 00:00:00 +0000 invano@me.com (Emanuele Cozzi) https://emanuelecozzi.net/about/ Hey! I'm Emanuele, PhD student at the Software and System Security group of EURECOM (France). My research interests are on exploring new static and dynamic analysis techniques for binary analysis, with particular emphasis on malware analysis. This is my public (lazy) whiteboard where I share mostly technical stuff about security, reverse engineering, malware analysis, ctfs, and so on.