corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08751-cf69-72fa-9cc3-ddf3955355e0

WorstFit: Unveiling Hidden Transformers in Windows ANSI!

blog.orange.tw · published 9 January 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.orange.tw Wayback capture
3blogs citing
First cited
3 Feb 2025
Most recent
24 Mar 2025
Rank this month
not ranked
Links from this post
62
Words captured
7,673

Cited by

Blog
In the post
Date
Wietze Beukema
Bypassing Detections with Command-Line Obfuscation Read at the source ↗
24 Mar 2025
fileformat.info
Links for January 2025 Read at the source ↗
3 Feb 2025
Synacktiv
Le problème Unicode de SQL Server : pourquoi vos données ne sont peut-être pas ce que vous croyez qu'elles sont ? Read at the source ↗
—

Links from this post

Link
Host
https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi
devco.re
https://www.blackhat.com/eu-24/briefings/schedule/index.html
blackhat.com
https://x.com/_splitline_
x.com
https://worst.fit/assets/EU-24-Tsai-WorstFit-Unveiling-Hidden-Transformers-in-Windows-ANSI.pdf
worst.fit
https://en.wikipedia.org/wiki/Mojibake
en.wikipedia.org
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-getenvironmentvariablea
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-getenvironmentvariablew
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-rtlunicodestringtoansistring
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/stringapiset/nf-stringapiset-widechartomultibyte
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/getenv-wgetenv
learn.microsoft.com
https://www.compart.com/en/unicode/U+221E
compart.com
https://en.wikipedia.org/wiki/Windows-1252
en.wikipedia.org
https://worst.fit/mapping/
worst.fit
https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/readme.txt
unicode.org
https://www.blackhat.com/presentations/bh-usa-09/WEBER/BHUSA09-Weber-UnicodeSecurityPreview-SLIDES.pdf
blackhat.com
https://x.com/hasegawayosuke
x.com
https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Hasegawa/BlackHat-japan-08-Hasegawa-Char-Encoding.pdf
blackhat.com
https://www.compart.com/en/unicode/U+00AD
compart.com
https://en.wikipedia.org/wiki/Won_sign
en.wikipedia.org
https://en.wikipedia.org/wiki/Yen_and_yuan_sign
en.wikipedia.org
https://en.wikipedia.org/wiki/Halfwidth_and_Fullwidth_Forms_(Unicode_block
en.wikipedia.org
https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-getcurrentdirectory
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/getcwd?view=msvc-170
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-findfirstfilea
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/findfirst-functions?view=msvc-170
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfullpathnamea
learn.microsoft.com
https://www.compart.com/en/unicode/U+FF0F
compart.com
https://www.compart.com/en/unicode/U+FF3C
compart.com
https://www.compart.com/en/unicode/U+00A5
compart.com
https://www.compart.com/en/unicode/U+20A9
compart.com
https://github.com/mruby/mruby/blob/3.3.0/mrbgems/mruby-dir/src/dir.c
github.com
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/getcwd-wgetcwd?view=msvc-170
learn.microsoft.com
https://peps.python.org/pep-0529/
peps.python.org
https://cuckoosandbox.org/index.html
cuckoosandbox.org
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-getcommandlinea
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/c-language/main-function-and-program-execution?view=msvc-170
learn.microsoft.com
https://www.compart.com/en/unicode/U+FF02
compart.com
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw
learn.microsoft.com
https://daviddeley.com/autohotkey/parameters/parameters.htm
daviddeley.com
https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/cpp/main-function-command-line-args
learn.microsoft.com
https://www.php.net/manual/en/function.escapeshellarg.php
php.net
https://github.com/python/cpython/blob/v3.12.8/Lib/subprocess.py
github.com
https://github.com/Studio-42/elFinder
github.com
https://github.com/Studio-42/elFinder/blob/7544918a2ba656a4fe72a6fc8bb502d39f601cda/php/elFinderVolumeDriver.class.php
github.com
https://worst.fit/worstfit/Arg-Splitting/tar/
worst.fit
https://worst.fit/worstfit/Arg-Splitting/plink/
worst.fit
https://worst.fit/worstfit/Arg-Splitting/SVN/
worst.fit
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49026
msrc.microsoft.com
https://support.microsoft.com/en-us/office/command-line-switches-for-microsoft-office-products-079164cd-4ef5-4178-b235-441737deb3a6
support.microsoft.com
https://en.wikipedia.org/wiki/Backdoor_(computing
en.wikipedia.org
https://curl.se/windows/microsoft.html
curl.se
https://hackerone.com/reports/2550951
hackerone.com
https://strawberryperl.com/
strawberryperl.com
https://www.activestate.com/products/perl/
activestate.com
https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
github.com
https://curl.se/windows/
curl.se
https://nvd.nist.gov/vuln/detail/cve-2024-45720
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-8067
nvd.nist.gov
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/getenv-wgetenv?view=msvc-170
learn.microsoft.com
https://worst.fit/
worst.fit