Reverse Engineering Articles

Partition of ICorDebug The ICorDebug API (the API for debugging managed apps) is about 70 total interfaces. Here is how I'd group the interfaces together, along with my random comments about how various interfaces fit into the big picture. A quick comment about interface versioning: 1. ICorDebug is a COM-classic unmanaged interface. Most of the interfaces are derived from IUnknown because we wanted to avoid the diamond-inheritance problem when we needed to add version 2 interfaces. I've left the "Derives From" column blank if an interface derives from IUnknown. 2. Version 2 interfaces have the previous interface's name appended with a version number. (eg, "IFoo2") …

Any application-defined hook procedure on my machine />http://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/ />http://msdn.microsoft.com/en-us/magazine/cc188966.aspx NtUserSetWindowsHookEx />http://doxygen.reactos.org/d7/dc3/subsystems_2win32_2win32k_2ntuser_2hook_8c_a7a2024e5452fd898ceddbe31d4699f14.html

Correlating between .NET and native thread in Windbg />http://naveensrinivasan.com/

Injecting Code Into Privileged Win32 Processes />http://mnin.blogspot.com/2007/05/injecting-code-into-privileged-win32.html />http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=auto&tl=en&u=http%3A%2F%2Fwww.reversecore.com%2F74

Increasing the Size of your Stack (.NET Memory Management) />http://www.atalasoft.com/cs/blogs/rickm/archive/2008/04/22/increasing-the-size-of-your-stack-net-memory-management-part-3.aspx

Java and .NET heap overhead />http://stackoverflow.com/questions/520922/java-and-net-heap-overhead />http://en.allexperts.com/q/Java-1046/reduce-garbage-collection-overhead.htm />http://abepralle.wordpress.com/2008/06/05/determining-heap-allocation-overhead/ />http://www.webperformance.com/load_testing/blog/2010/05/load-engine-tuning-jvm-memory-optimization/

Pushing the Limits of Windows: Virtual Memory />http://blogs.technet.com/b/markrussinovich/archive/2008/11/17/3155406.aspx

System calls IMM32.ImmGetDefaultIMEWnd and I think that each process has a IME />http://www.piclist.com/techref/os/win/api/win32/func/src/f47_14.htm />http://www.eggheadcafe.com/searchform.aspx?search=ImmGetDefaultIMEWnd

Secrets of the Application Compatilibity Database (SDB) />http://forum.sysinternals.com/topic18127_post91540.html SO calls shim.dll whil loading process: ntdll!LdrpInitializeProcess+0x1064: 7c9216b1 e829330000 call ntdll!LdrpLoadShimEngine (7c9249df) ntdll!_LdrpInitialize+0x17e: 7c921634 e883040000 call ntdll!LdrpInitializeProcess (7c921abc)

Analyzing local privilege escalations in win32k />http://uninformed.org/?v=10&a=2 />http://www.woodmann.com/forum/archive/index.php/t-13827.html />http://www.woodmann.com/forum/archive/index.php/t-10295.html />http://j00ru.vexillium.org/?p=614 Windows 2000 WIN32K.SYS System Service Calls />http://www.fengyuan.com/article/win32ksyscall.html

A catalog of NTDLL kernel mode to user mode callbacks: />http://www.nynaeve.net/?p=200 Microsoft Windows CreateWindow function callback vulnerability: />http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Microsoft_Windows_CreateWindow_function_callback_vulnerability />http://advdbg.org/forums/3033/ShowPost.aspx />http://hi.baidu.com/adifk/blog/item/6b685495333ba60c7bf480d7.html />http://www.insidewindows.kr/?tag=kiusercallbackdispatcher />http://bbs.pediy.com/showthread.php?t=102940 DllMain: />http://www.koders.com/c/fid6C4D5971CD570CDF5465BE34105B2FA1776085CF.aspx callback table index: />http://www.…

Weird error using the method explained in “loading a dll from memory” article />http://www.computersecurityarticles.info/security/weird-error-using-the-method-explained-in-%E2%80%9Cloading-a-dll-from-memory%E2%80%9D-article/ DetectKernelCallbackTableHook: />http://code.google.com/p/win32-fake-program/updates/list

Archive for the ‘Notes on Windows Internals’ Category />http://www.softwaregeneralist.com/category/notes-on-windows-internals/page/3/

Windows Memory Layout, User-Kernel Address Spaces />http://www.openrce.org/reference_library/files/reference/Windows%20Memory%20Layout,%20User-Kernel%20Address%20Spaces.pdf

.NET-BroadcastEventWindow Error & Workaround />http://social.msdn.microsoft.com/Forums/en/netfxbcl/thread/fb267827-1765-4bd9-ae2f-0abbd5a2ae22 />http://stackoverflow.com/questions/559241/need-help-deciphering-a-c-stack-trace

RT_MANIFEST resource, and ISOLATION_AWARE_ENABLED />http://blogs.msdn.com/b/junfeng/archive/2007/06/26/rt-manifest-resource-and-isolation-aware-enabled.aspx Specifying a Default Activation Context />http://msdn.microsoft.com/en-us/library/aa376607%28v=vs.85%29.aspx />http://www.jose.it-berater.org/smfforum/index.php?topic=2772.new

Speedy C# series - memory optimization />http://robpaveza.net/speedy-c-part-2-optimizing-memory-allocations-pooling-and-reusing-objects />http://www.codeproject.com/KB/cpp/StackShrink.aspx />http://stackoverflow.com/questions/1984186/what-is-private-bytes-virtual-bytes-working-set

The sequence of interactions between CLR loader and fusion during Assembly.Load />http://social.msdn.microsoft.com/forums/en-US/netfxbcl/thread/acac20f6-d70f-405f-9e0e-387078cbb4c3 />http://forum.sysinternals.com/why-some-net-assemblies-are-duplicated-in-memory_topic15279.html Apis used by Framework for mem alocation: />http://etutorials.org/Programming/programming+microsoft+visual+c+sharp+2005/Part+IV+Debugging/Chapter+13+Advanced+Debugging/Memory+Management/ />http://www.ms-news.net/f826/managed-heap-6470585.html />http://www.experts-exchange.com/Programming/Languages/.NET/A_3251-Garbage-Collection-Memory-Management-in-Net.html Garbage Collection: />…

In Denial - Debugging STATUS_ACCESS_DENIED : />http://www.osronline.com/article.cfm?id=459

Kernel-Mode Basics: Windows Linked Lists />http://www.osronline.com/article.cfm?article=499

JavaTM Virtual Machine Tool Interface (JVM TI) The JVMTM tool interface (JVM TI) is a native programming interface for use by tools. It provides both a way to inspect the state and to control the execution of applications running in the JavaTM virtual machine (JVM). JVM TI supports the full breadth of tools that need access to JVM state, including but not limited to: profiling, debugging, monitoring, thread analysis, and coverage analysis tools. Note: JVM TI was introduced at JDKTM 5.0. JVM TI replaces the Java Virtual Machine Profiler Interface (JVMPI) and the Java Virtual Machine Debug Interface (JVMDI) which, as of JDK 6, are no longer provided. JVM TI Refer…

http://www.cs.ucsb.edu/~nomed/docs/pecoff.html awesome stuff, each part nicely explained. I am making a packer based on this . If this has been posted before sorry, didn't see anything.

How Malware Defends Itself Using TLS Callback Functions Malware authors employ numerous and creative techniques to protect their executables from reverse-engineering. The arsenal includes an anti-debugging technique called TLS callback. The approach is not new, yet it is not widely understood by malware analysts, so I'd like to describe in this note. (Thanks to Christian Wojner from CERt.at for his insights regarding this topic!) What is TLS? According to Microsoft, Thread Local Storage (TLS) is a mechanism that allows Microsoft Windows to define data objects that are not automatic (stack) variables, yet are "local to each individual thread that runs the code. Thus,…

Hello, I found a book two days ago and I think its suitable for this section. This book is for someone who wants to start crack softwares in linux I mean this book is kind of preface of RCE in the linux If you want to go more in depth, I suggest read third chapter of security warrior. published by O’Reilly Yet this is a good book Reverse Engineering Linux.pdf

Peering Inside the PE: A Tour of the Win32 Portable Executable File Format The format of an operating system's executable file is in many ways a mirror of the operating system. Although studying an executable file format isn't usually high on most programmers' list of things to do, a great deal of knowledge can be gleaned this way. In this article, I'll give a tour of the Portable Executable (PE) file format that Microsoft has designed for use by all their Win32®-based systems: Windows NT®, Win32s™, and Windows® 95. The PE format plays a key role in all of Microsoft's operating systems for the foreseeable future, including Windows 2000. If you use Win32s or Windows …