Rodrigo Rubira Branco (BSDaemon)

Navigation

News
Projects
Docs
Pictures
Advisories
Exploits (49)
LSM
Books
Movies
Blog
Fun
Shellcodes
About
Future

Friends

RISE Security
Priv8Security
M00
DSR
RFDS Labs
THC
Hack in The Box Conference
Troopers
Hackito
uCon Conference
Metasploit Project

I'm member of RISE Security

"There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies."
-- C.A.R. Hoare

"I have always wished for my computer to be as easy to use as my telephone; my wish has come true because I can no longer figure out how to use my telephone."
-- Bjarne Stroustrup

I'm one of the organizers of the Hackers 2 Hackers Conference, in Brazil... this is the 21 edition: http://www.h2hc.com.br

Docs

Here is a list of latest papers I released, some of them in Portuguese and some of them with English versions:

Article Name: The Lie behind the defense in-depth Date: 01/24/2014 (Portuguese-only)
Article Name: Exploiting a real heap overflow (solaris case) (Portuguese version) Click here for the English version
Article Name: Extending distorm instructions (Portuguese version) Click here for the English version
Article Name: How to really learn security? (Portuguese only)
Article Name: Code Security: Open x Closed Source (Portuguese only)
Presentation Name: Exploitation Notes (English only)

Paper: Streamed Analysis of Network Files to avoid False Positivies and to Detect Client-side Attacks - International Journal of Communication Networks and Information Security - Written with my advisor Celso Hirata

My talk at Troopers Conference 2010 about Fuzzers and Debuggers Integration

Document about IPS technologies, focusing on the different challenges and not in products (Brazilian portuguese online) - local copy

I gave some talks in 2008 and 2009 regarding advanced payloads... They are very similar, with minor changes or fixes:
- FrHack 2009
- Troopers 2009
- Hack in the Box Dubai 2009
- uCon 2008

Hacking the Cell Broadband Engine Architecture - SPE software exploitation article for phrack

Anti-Forense article written with Filipe Balestra for hakin9 magazine

Linux kernel patch to support hardware watchpoints in mcp-ppc - Here is the original email

I wrote an overview about Troopers conference and Hack In The Box... See it here

My presentation in Troopers2008 about Kernel Protection (with code samples) are now online

My Cell Architecture presentation at Hack in the box Dubai in 2008

My article to Phrack about System Management Mode hacks, including the library SMM

Ekoparty 2007 Presentation about Kernel Intrusion Detection

H2HC III Presentation about Syscall Proxying || Pivoting - with Filipe Balestra, my big friend

H2HC IV Presentation about Kernel Intrusion Detection - Integrity Protection

You shot the sherif brazilian conference - Talk about Kernel Intrusion Detection System (containing the talks at VNSecurity, Xcon, HITB Dubai/Malaysia)

I give an interview to Cezar Taurion (manager of new technologies at IBM) - Portuguese only Mirrored here

Paper accepted in OLS 2007 about "Ltrace Internals"

Presentation for Hack In The Box Conference in Malaysia about Anti-forensics (my portion is about kernel war and using SMM to put a new kind of rootkit in a system)

Presentation for XCon Conference in China about Kernel Integrity Protection - a deeper analysis also enfocusing other platforms and how to generate the SMI's

Presentation for VNSecurity Conference in Vietnam about Kernel Integrity Protection - a deeper analysis

Presentation for Hack In The Box Conference in Dubai about Kernel Integrity Protection

An article written together with my friend Lucio Correa (IBM LTC Linux on Cell Kernel Developer) about Polymorphic Shellcodes

Article: "Linux System Auditing by Example" by Emily Ratliff - I have helped with some code samples

I have been accepted to present at Defcon www.defcon.org. Unfortunately, i cant go to las vegas, because i havent submitted a presentation related to my work, so ill put all presentation materials here: http://www.kernelhacking.com/rodrigo/defcon

Presentation about IDS Evasion and how SCMorphism works

Long time ago i have written this small text explain how to do some things with GnuPG - Portuguese only

Interesting article (and sample) about how to code a kernel thread to act as udp server... i have helped to implement the kernel as a client too

I'm a co-mainteiner of the TLDP book: Linux Kernel Module Programming Guide The TLDP page is here (many weeks can pass without a change in sourceforge CVS be reflected into the tldp page): http://www.tldp.org/LDP/lkmpg

Phearless Zine has published an article (written by BaCkSpAcE) called Advanced Shellcoding referencing my HowItWorks document (part of the SCMorphism Software) - Serbian/Croatian language

Some of my lessons about Operation Systems at the University (bacharel degree) - portuguese only:
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Presentation
- Challenge
- Exercises
- Home-work
- Home-work
- Home-work
- Fork sample
- Pipe sample
- Setuid sample
- User scheduler sample
- Syscall sample

- A lot of manpages of suid binaries are missing, so, I write then (IBM work):
- artswrapper.8.gz
- cons.saver.8.gz
- fileshareset.8.gz
- kcheckpass.8.gz
- kgrantpty.7.gz
- killpgrp.8.gz
- kpac_dhcp_helper.7.gz
- ncplogin.1.gz
- ncpmap.1.gz
- ncsa_auth.8.gz
- userisdnctl.8.gz
- wrapper.8.gz

- Patch to compile gcc-2.95.3 under solaris 2.9 running in a UltraSparc 10 machine

- Patch for squid-3.0-PRE3 to add md5 authentication without salts - Tks to Ramon de Carvalho to help on that issue - The Squid bugzilla entry

- Patch for squid-3.0-PRE3-20060608 that correct some compilation problems - The Squid bugzilla entry

- Excelent article about the Extinction of the real Hackers - by fx@phenoelit.de

- Patch for sarg 2.2.1 to test memory allocation (when it fails, sarg segfault without messages)

- If you use 2.4 kernels and would like to compile kernel modules using gcc 4.x, apply the follow patch into your kernel-headers tree/include/asm (for x86 only) to compile without problems

- Study about Polymorphic Attacks (course conclusion of my Bacharel degree)

- Presentation about the problems (Security-related problems) when you are using Linux as a corporate Desktop

- FAQ about Saints (and Kernel)

- Lecture about Backdoors x Application Firewalls - Presented into H2HC 2 Conference

- Text about how to install (and fix) TCPDump @hpux platforms - Really old job

- .br Translation of TCPDump Manual - Really old job

- Lecture about Kernel Hacking - FestSol Presentation

- Lecture about Kernel Hacking - Linux Chix Presentation

- Paper/Lecture about Polymorphism x Sandbox, SCMorphism x Checkpoint - English Only

- Lecture about Polymorphic Attacks - Hackers 2 Hackers Conference (www.h2hc.com.br) Presentation - Portuguese Version

- Lecture about Polymorphic Attacks - Hackers 2 Hackers Conference (www.h2hc.com.br) Presentation - English Version

- Lecture about Intrusion Detection Evasion Techniques - Portuguese Only

- Lecture about Software Analysis - Portuguese only

- Lecture about Intrusion Detection - Portuguese only

- Lecture about LDAP - Portuguese only

- Lecture about Information Security - Portuguese Only

- Lecture about Intrusion Detection - Portuguese Only

- Lecture about Intrusion Detection x Intrusion Prevention - Portuguese Only

- Lecture about Firewalls - Portuguese Only

- Introduction to Linux Administration - Portuguese Only

- Text about buffer overflows - Thanks to chroot- - Portuguese Only

- Text about privacy - Portuguese Only

- Text about shellcodes - Thanks to FoxTrot- - Portuguese Only

:: copyleft 2004-2024 - Rodrigo Rubira Branco (BSDaemon) ::