Reverse Engineering Articles

Another OllyDbg Anti-Debug Trick

January 2, 2012 by waliedassar

0 replies
5.5k views

It is similar to, but different from the one i disclosed in the previous post. The previous one occurs when OllyDbg tries to grab .sym files, but this one occurs when OllyDbg tries to grab .udd files. Similar to .sym files, .udd files are grabbed for all loaded modules, including dynamically loaded ones, which gives us the chance to use this buffer overflow as an anti-debug method. To exploit this buffer overflow, all you have to do is create a .dll with length of 0x102 bytes and then LoadLibrary it. N.B. ollydbg.exe must reside in a directory with length of 0x29 bytes or more, e.g. "D:\Documents and Settings\Administrator\Desktop\odbg110". Further details: http://…

Last reply by waliedassar, January 2, 2012

A New Anti-Olly Trick

December 31, 2011 by waliedassar

0 replies
4.9k views

It is a buffer overflow in ollydbg v1.10. It occurs when olly tries to find the .sym file for the being-loaded module. POC: />http://ollytlscatch.googlecode.com/files/trick.exe />https://docs.google.com/document/d/1T5LPY3qDkxmR1XVgxnsKW42lggS5iSjtQwFXOtNfqMM/edit Further details: />http://waleedassar.blogspot.com/2011/12/new-ollydbg-anti-debug-trick.html />http://www.virustotal.com/file-scan/report.html?id=97f2c22d3fde1db56aaef4e555e32927d0a0087e7e92d369093ac5ac749e83d9-1324964958

Last reply by waliedassar, December 31, 2011

Exploring new lands on Intel CPUs (SINIT code execution hijacking)...

December 11, 2011 by Teddy Rogers

0 replies
6.1k views

This makes for interesting reading... Exploring new lands on Intel CPUs (SINIT code execution hijacking) />http://www.invisiblethingslab.com/resources/2011/Attacking_Intel_TXT_via_SINIT_hijacking.pdf/>http://theinvisiblethings.blogspot.com/2011/12/exploring-new-lands-on-intel-cpus-sinit.html Ted.

Last reply by Teddy Rogers, December 11, 2011

Education

December 4, 2011 by xsk

0 replies
10.2k views

If you're someone who already has a reasonable grasp of reverse engineering and malware analysis, I need your help. I need you to help train more people like yourself. More likely than not you're "self-taught". Except, when you were teaching yourself you were probably actually relying in large part on the help of others. They freely posted zines, articles, and blog entries. They and answered questions in forums, email lists, and in person. Eventually, once you were confident enough to believe you would be right more often than wrong, you might have tried to pay it forward and share your knowledge back to others. If so, you're the type of person who is needed. We need peop…

Last reply by xsk, December 4, 2011

unpacking custom packers

October 12, 2011 by abhijit mohanta

5 replies
8.1k views

http://dreamofareverseengineer.blogspot.com/2011/10/unpacking-custom-packers.html

Last reply by icr, November 13, 2011

UIC Reversing FTP v3.0

December 29, 2010 by sirp

4 replies
5.5k views

/----------------------------\ | * UIC Reversing FTP v3.0 * | | | | -=[ Zero_G ]=- | \----------------------------/ ** Welcome to the UIC Reversing FTP v2.0! ** Here you will find everything you need for your reversing pleasure! :-) If you want to share something with the community, feel free to put it in the "_UPLOAD_" folder (write permission enabled) ... I will reorganize data every week! -=[Zero_G]=- zerorev.net

Last reply by kinhvaf, November 8, 2011

XBox 360 Reset Glitch Hack...

August 29, 2011 by Teddy Rogers

4 replies
6.5k views

XBox 360 Reset Glitch Hack >http://www.youtube.com/watch?v=JyYdL4L6vwE&feature=player_embedded Download Links: http://www.libxenon....h_hack_v1.0.rar http://libxenon.org/...146.0;attach=61 Ted.

Last reply by The Dark, November 2, 2011

[crackme] Crackmes.de Collection 2011

June 10, 2011 by HellRaider

5 replies
10.2k views

Well after the disappointing take down of Crackmes.de I took it upon myself to mirror the crackmes (thanks for the inspiration @darelgrif) as well as the solutions that were on that site. Please find the following linked zip that contains almost 1000 crackme’s for all levels. Please enjoy and mirror/spread. Author : Malware Ninja Author website : http://crackmes.de/ Download : http://tuts4you.com/request.php?3152

Last reply by Redstarx, October 8, 2011

interesting collection of security related topics

October 4, 2011 by deepzero

1 reply
4.2k views

to be found here: http://shell-storm.org/papers/index.php?lg=englishVery interesting papers, focusing mainly on application security / exploitation.

Last reply by cipher, October 5, 2011

"Shatter"ing the Windows Message Passing Architecture and Secu

October 2, 2011 by Killboy

0 replies
5.1k views

It's a bit of a tacky title but the talk is very nice. Starts with a pretty good intro to how handles work inside the windows subsystem and how sessions and desktops come into all of this. />http://www.archive.org/details/Shattering_the_Windows_Message_Passing_Architecture_and_Security_Model

Last reply by Killboy, October 2, 2011

CloudCrack...

June 10, 2011 by Teddy Rogers

2 replies
5.9k views

GoVirtual® CloudCrack />http://www.govirtual.tv/CloudCrack.php Ted.

Last reply by mudlord, September 28, 2011

A lot of computer science information

September 21, 2011 by sirp

0 replies
4.4k views

SERSC is an international center for supporting distinguished scholars and students who are researching various areas of Science and Technology. SERSC wishes to provide good chances for academic and industry professionals to discuss recent progress in various areas of Science and Technology. SERSC organizes many international conferences, symposia and workshops every year, and provides sponsor or technical support to researchers who wish to organize their own conferences and workshops. SERSC also publishes high quality academic international journals in various areas of Science and Technology. Journal Aims Our Journal provides a chance for academic and industry profession…

Last reply by sirp, September 21, 2011

Public Key Infrastructure (PKI)

March 15, 2011 by CodeExplorer

1 reply
4.5k views

Public Key Infrastructure (PKI) />http://softwarekishorekoney.blogspot.com/2010/05/public-key-infrastructure-pki.html

Last reply by user1, September 20, 2011

ʻpyREticʼ – In memory reverse engineering for obfuscated Python by

September 9, 2011 by CodeExplorer

1 reply
3.9k views

ʻpyREticʼ – In memory reverse engineering for obfuscated Python bytecode />http://www.defcon.org/images/defcon-18/dc-18-presentations/RSmith/DEFCON-18-RSmith-pyREtic.pdf