BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: CODASM - Hiding Payloads in Plain .text\n   When: Sa
 turday\, Aug 10\, 12:00 - 13:45 PDT\n   Where: LVCC West/Floor 3/W305 - [1
 ]Map\n\n   Description:\n\n   CODASM aims to decrease a stageless payload'
 s Shannon entropy\, which\n   was found to be a simple but annoying detect
 ion vector used by EDRs.\n   It's a Python program that processes arbitrar
 y binary inputs and\n   produces a C program consisting of two parts: a bu
 ffer holding\n   generated x86-64 ASM instructions with the original paylo
 ad encoded\n   into it\, and a set of functions that can decode the ASM at
  runtime.\n   The buffer is designed to be compiled into the final payload
 's .text\n   section\, thus it looks like regular (if not functional) code
  to AVs\,\n   EDRs and analysts. This encoding effectively decreases the p
 ayload's\n   Shannon entropy but comes with a significant increase in outp
 ut size.\n   The demo will cover usage of the tool and dissection/reverse\
 n   engineering of the resulting payload.\n\n   SpeakerBio:  Moritz Laurin
  Thomas\, Senior Red Team Security Consultant\n   at NVISO ARES\n\n   Mori
 tz is a senior red team security consultant at NVISO ARES\n   (Adversarial
  Risk Emulation & Simulation). He focuses on research &\n   development in
  red teaming to support\, enhance and extend the team’s\n   capabilities
  in red team engagements of all sorts. Before joining the\n   offensive se
 curity community\, Moritz worked on a voluntary basis as a\n   technical m
 alware analyst for a well-known internet forum with focus\n   on evading d
 etections and building custom exploits. When he isn’t\n   infiltrating n
 etworks or exfiltrating data\, he is usually knees deep\n   in research an
 d development\, dissecting binaries and developing new\n   tools.\n\n   '\
 n\n   1. #LVCCW_Level3_South\n\n\n
DTEND:20240810T204500Z
DTSTART:20240810T190000Z
LOCATION:DL - LVCC West/Floor 3/W305
SUMMARY:CODASM - Hiding Payloads in Plain .text
END:VEVENT
END:VCALENDAR