Forums

How to unpack this target? Regards. sean.

Read the last sentence of my previous message again...

Hi guys, I was downloading some text file from internet and when I print it into static control etc then I got that not correctly wrong mixed symbols or letters etc I would like to prevent but how is the questions. By the way, I tried using that IsTextUnicode function but I can only use the RtlIsTextUnicode function and this does crash always inside... invoke RtlIsTextUnicode,addr STRINGBUFFER ,sizeof STRINGBUFFER, IS_TEXT_UNICODE_ASCII16 ....so I don't know about all those specific Text Symbol styles things whatever they called etc but it really sux and I just want to have & use some simple format / fix functions I can run over my textbuffer to make them OK. @adoxa Yes it seems I have to remove those HTML entities from text buffer to format them correctly but how? Is there no ready function already I could use? Otherwise I have to make it myself. How much HTML Entities are there I have to check for? Or what are the most common used? I made this quick function... Remove_HTML_Entities proc uses edi esi ebx _buffer:DWORD invoke szRep,_buffer,_buffer,chr$("&lt;"), chr$("<") invoke szRep,_buffer,_buffer,chr$("&gt;"), chr$(">") invoke szRep,_buffer,_buffer,chr$("&amp;"), chr$('&') invoke szRep,_buffer,_buffer,chr$("&quot;"), chr$('"') invoke szRep,_buffer,_buffer,chr$("&apos;"), chr$("'") invoke szRep,_buffer,_buffer,chr$("&cent;"), chr$("¢") invoke szRep,_buffer,_buffer,chr$("&pound;"),chr$("£") invoke szRep,_buffer,_buffer,chr$("&yen;"), chr$("¥") invoke szRep,_buffer,_buffer,chr$("&euro;"), chr$("€") invoke szRep,_buffer,_buffer,chr$("&copy;"), chr$("©") invoke szRep,_buffer,_buffer,chr$("&reg;"), chr$("®") Ret Remove_HTML_Entities endp ...to remove some of those Entities. Seems to work OK so far but NOW I found another problem. When the entitie &amp; was found and  replaced with & and I do send that string buffer into my static control then the "&" is not displaying!=? Why? When I do messagebox that string buffer then the "&" gets displayed. So why is the & not showing when using it in a string? Also this fails... invoke SendMessage,STATIC_HANDLE,WM_SETTEXT,0,chr$("You & Me") = "You Me" and not "You & Me" Why? Is there any style I have to enable to make it work to display also the "&"? greetz

Hello everyone ! Having been in infosec for a few years now, particularly on the Red Team side, I'm keen to discover new things. I have some basic knowledge of reverse engineering, but nothing too crazy. As I'm about to start a new contract on the Blue Team side, I'd like to practice a bit before starting. So I'd like to know your opinion on an easy malware family to reverse for a beginner. Thank you.

@jackyjask maybe, we do not need it any more. @fjqisba how does this IDA plugin help to analyze the vmprotect virtual machine?     I do not know how to use this. I will be really appreciated if you could explain about it. Many thanks in advance. Regards. sean.

teamrept lives on .i once was a team leader there......

Thank you Teddy

NICE tut if u have more share please

This thing helped me to play Joker's  exe (packaged swf) https://github.com/Aira-Sakuranomiya/CleanFlashInstaller/releases

Yes, you need to install trillix swf decompiler. https://cdn.eltima.com/download/flash_decompiler.exe Regards. sean.