<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>blog.sat0ri.com</title>
	<atom:link href="http://blog.sat0ri.com/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://blog.sat0ri.com</link>
	<description>sat0ri - sudden enlightenment</description>
	<lastBuildDate>Wed, 01 Sep 2010 09:56:08 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Acrobat Reader *.PDF file Integer Overflow Vulnerability</title>
		<link>http://blog.sat0ri.com/?p=531</link>
		<comments>http://blog.sat0ri.com/?p=531#comments</comments>
		<pubDate>Wed, 01 Sep 2010 08:46:51 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[CVE-2010-2862]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=531</guid>
		<description><![CDATA[Summary A vulnerability has been discovered in Acrobat Reader, which can be exploited by malicious, anonymous individuals to compromise a vulnerable system. The integer overflow in the CoolType.dll module is caused when parsing the &#8220;maxCompositePoints&#8221; field value in the TrueType font&#8217;s Maximum Profile table (maxp), and can be exploited to corrupt memory via a maliciously [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=531</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Command-line Argument Handling in Standard Windows Binaries</title>
		<link>http://blog.sat0ri.com/?p=505</link>
		<comments>http://blog.sat0ri.com/?p=505#comments</comments>
		<pubDate>Wed, 02 Jun 2010 20:06:40 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=505</guid>
		<description><![CDATA[Looking at some of the components present within the %systemroot%\system32 directory can be fun when attempting to identify low-hanging-fruit-vulnerabilities. I made a simple fuzzer that enumerated all executables within a given directory and attempted to execute them with user-defined arguments. A more advanced method also supported by the tool, is to specify the arguments for [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=505</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>WinAsm *.WAP File Buffer Overflow Vulnerability</title>
		<link>http://blog.sat0ri.com/?p=512</link>
		<comments>http://blog.sat0ri.com/?p=512#comments</comments>
		<pubDate>Fri, 28 May 2010 08:55:06 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[WinAsm]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=512</guid>
		<description><![CDATA[Summary A vulnerability has been discovered in WinAsm Studio, which can be exploited by malicious, anonymous individuals to compromise a vulnerable system. The vulnerability is caused as a result of improper bounds checking when reading *.WAP files. This can be exploited to cause a stack-based buffer overflow by tricking a user into opening a maliciously [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=512</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Enter Spy Eye &#8211; The Rise of Another Botnet</title>
		<link>http://blog.sat0ri.com/?p=504</link>
		<comments>http://blog.sat0ri.com/?p=504#comments</comments>
		<pubDate>Thu, 27 May 2010 16:07:28 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Spy Eye]]></category>
		<category><![CDATA[ZBot]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=504</guid>
		<description><![CDATA[Originally posted on opensc.ws the 2nd of January 2010, the Spy Eye information theif appears to be a very promising info-stealer with much functionality, similar to that of the notourius ZBot. Spy Eye, which could originally be purchased for 500 USD, currently costs 1000 USD and contains much functionality including the following: Form-grabbing Password stealing [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=504</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>DNA FAT &#8211; DNA Frequency Analysis Tool</title>
		<link>http://blog.sat0ri.com/?p=53</link>
		<comments>http://blog.sat0ri.com/?p=53#comments</comments>
		<pubDate>Thu, 20 May 2010 18:30:48 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Molecular Biology]]></category>
		<category><![CDATA[Utilities]]></category>
		<category><![CDATA[Staphylococcus Aureus]]></category>
		<category><![CDATA[USA300]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=53</guid>
		<description><![CDATA[DNA-FAT performs a very rapid indexation of the uniqueness and repetitative buildup of fasta format DNA sequences using user assigned window sizes. The two output files contain the following: The number of unique sequences with the preset window size and the number of sequences present, any number of multiple times. Output of the actual sequences [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=53</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Very Capable Win32.Silon Information Thief</title>
		<link>http://blog.sat0ri.com/?p=501</link>
		<comments>http://blog.sat0ri.com/?p=501#comments</comments>
		<pubDate>Wed, 12 May 2010 15:19:00 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Win32/Silon]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=501</guid>
		<description><![CDATA[The Win32.Silon information thief  (hereafter referenced as Silon) is a relitively new information stealer, which surfaced early 2009. It has the ability to steal log-in information and commit financial fraud via many popular online banks. Currently it has been seen it the following two versions (dubbed by CSIS): Win32/Silon.A (SA) Win32/Silon.B (SB) Due to the [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=501</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>WinAsm *.RC File Buffer Overflow Vulnerability</title>
		<link>http://blog.sat0ri.com/?p=481</link>
		<comments>http://blog.sat0ri.com/?p=481#comments</comments>
		<pubDate>Mon, 12 Apr 2010 16:12:11 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[WinAsm]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=481</guid>
		<description><![CDATA[Summary A vulnerability has been discovered in WinAsm Studio, which can be exploited by malicious, anonymous individuals to compromise a vulnerable system. The vulnerability is caused as a result of improper bounds checking when reading *.RC files. This can be exploited to cause a stack-based buffer overflow by tricking a user into opening a maliciously [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=481</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Crimson Editor Dictionary File Buffer Overflow Vulnerability</title>
		<link>http://blog.sat0ri.com/?p=414</link>
		<comments>http://blog.sat0ri.com/?p=414#comments</comments>
		<pubDate>Sat, 03 Apr 2010 19:43:29 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[Crimson Editor]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=414</guid>
		<description><![CDATA[Summary A vulnerability has been discovered in Crimson Editor, which can be exploited by malicious, anonymous individuals to compromise a vulnerable system. The vulnerability is caused as a result of improper bounds checking when reading words from dictionary files. This can be exploited to cause a stack-based buffer overflow by tricking a user into using [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=414</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Crimson Editor Configuration File Buffer Overflow Vulnerability</title>
		<link>http://blog.sat0ri.com/?p=341</link>
		<comments>http://blog.sat0ri.com/?p=341#comments</comments>
		<pubDate>Thu, 18 Mar 2010 20:09:47 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerabilities]]></category>
		<category><![CDATA[Crimson Editor]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=341</guid>
		<description><![CDATA[Summary A vulnerability has been discovered in Crimson Editor, which can be exploited by malicious, anonymous individuals to compromise a vulnerable system. The vulnerability is caused as a result of improper bounds checking when reading configuration files. This can be exploited to cause a stack-based buffer overflow by tricking a user into using a maliciously [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=341</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>RCE Challenge – nine</title>
		<link>http://blog.sat0ri.com/?p=307</link>
		<comments>http://blog.sat0ri.com/?p=307#comments</comments>
		<pubDate>Sun, 20 Dec 2009 05:21:44 +0000</pubDate>
		<dc:creator>sharpe</dc:creator>
				<category><![CDATA[Challenges]]></category>
		<category><![CDATA[Reverse Code Engineering]]></category>
		<category><![CDATA[Reversing]]></category>

		<guid isPermaLink="false">http://blog.sat0ri.com/?p=307</guid>
		<description><![CDATA[My last reverseme was too easy due to the nature of the code de-obfuscation key length and usage. This time I have made some minor changes to precisely this portion of the code. Furthermore, I have added some anti-debugging stuff that I observed in a piece of malware. I hope you enjoy. Here is a [...]]]></description>
		<wfw:commentRss>http://blog.sat0ri.com/?feed=rss2&amp;p=307</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
