Jump to content
Tuts 4 You

Leaderboard

  1. kao

    kao

    Full Member+


    • Points

      28

    • Content Count

      2,322


  2. TobitoFatito

    TobitoFatito

    Full Member


    • Points

      20

    • Content Count

      34


  3. CodeExplorer

    CodeExplorer

    Moderator


    • Points

      17

    • Content Count

      3,106


  4. whoknows

    whoknows

    Full Member


    • Points

      14

    • Content Count

      519



Popular Content

Showing content with the highest reputation since 06/08/2020 in all areas

  1. 13 points
    awesome_msil_Out.exe Approach: 1. Necrobit is a jit protection, so we use Simple MSIL Decryptor by CodeCracker , and it shall be ran on NetBox 2. Code virtualization is a relatively new feature of .net reactor, added in version 6.2.0.0. Here is the approach i took (i did this about 6 months ago so my memory is kinda rusty ) : (Click spoiler to see hidden contents)
  2. 6 points
    I am referring to threads and posts like these: If a solution is selectively provided only to the OP by PM then it defeats the whole purpose of the Crackme/Unpackme section. In such cases, the solution provider should not even be acknowledged unless they provide working steps for everyone to learn from. This forum is a learning platform and if solution providers are expected to share the methodologies that they used for the solution. Here is yet another thread where the posts from the solution providers who gave vague steps was approved: Basically another thread containing "show-off" posts by the solution poster. Nothing practical provided and no proper steps were shown. I mean, take this for example (from this post): EXAMPLE 2 Basically useless. It's like saying that to climb the Himalayas one needs will-power, good training, a lof of good mountaineering tools, food packs etc and that one has to read up a lot of good manuals and practice on smaller mountains first... Only posts in the Challenges section which detail proper steps which are actually reproducible should be approved by the mods. OR... ALL POSTS there should be approved from anyone. Why just approve the "show-off" posts? Are we expected to "beg" the solution poster via PM for the steps? I am quite sure that my post may get deleted, since any posts which speak the truth seem to get selective get deleted these days, but nevertheless I wanted to bring up this point! Another example of an approved post where NO STEPS were provided:
  3. 4 points
    In my opinion that solution will be acceptable only if the tool used is public.
  4. 4 points
    This is really the key point that probably should be the requirement for a post to be accepted. A solution should be reproducible, not a list of private tools that are used. Private tools are, as their name implies, private, and by definition that means it is everything but reproducible (unless this tool is shared with the reader of the solution). The only person benefiting from such a reply is the respondent themselves in the form of an ego boost. Not very productive if you'd ask me.
  5. 4 points
    It's a really good question. The answer really depends. Let me give you few recent examples. Example #1: Extreme Coders names the tools and explains HOW to solve the crackme. A lot of effort is required but all the tools can be found via Google. So I have zero issues with the solution. Example #2: Prab names the tools but no explanation is given. "x86 retranslater" definitely cannot be found not on Google. "Clean control flow" tells the obvious thing but it doesn't explain HOW to do that. What's the point of such solution? The only thing reader will learn from this is that he needs a magic wand that he can't have.
  6. 4 points
    View File Reactor v6.3 Try to unpack or alternatively provide a serial. Protections used: Necrobit Antitampering Antidebug Obfuscation Code Virtualization + Shield with SNK Submitter whoknows Submitted 06/10/2020 Category UnPackMe (.NET)  
  7. 2 points
    https://www.bleepingcomputer.com/news/security/net-core-vulnerability-lets-attackers-evade-malware-detection/ bonus medium.com/pcmag-access/former-intel-engineer-explains-why-apple-switched-to-arm-deba86e560b1 Hard Disk Hacking (2013) - spritesmods.com/?art=hddhack&page=1
  8. 2 points
    you shouldn't be using WD in first place.
  9. 2 points
    Pawning 40 CTFs simultaneously
  10. 2 points
    My work machine has normally running MS Teams (2GB right there..), Outlook (250MB), Chrome with 40+ tabs (6+GB), Visual Studio, 1-2 VMware Guests and IDA. Would I expect it to magically work with 8GB of RAM? F*ck no! Sure, you can find a tool that hacks around and maybe reduces the symptoms. But it doesn't fix the problem. The actual problem is that your machine is severely under-powered for that sort of a workload. Another 8GB of RAM would be a proper way to solve those issues. And it costs ~40EUR - which is less than 1-2 hours of your time you probably spent googling for such "tool".
  11. 2 points
    https://docs.microsoft.com/en-us/dotnet/api/system.string.concat Get the next 50 elements and concat them, then repeat. If you want to add a delimiter for every text use Join instead. https://docs.microsoft.com/en-us/dotnet/api/system.string.join?view=netcore-3.1#System_String_Join_System_String_System_String___ You should consider taking a programming course.
  12. 2 points
    I was facing the Same thing from long time. Here I've raised my Voice - that It makes no sense to upload Cleaned file or saying that I used de4dot modded Private bla bla bla. Some People are like, Read the Assembly language or see de4dot or VM and you will know. Oh Ghosh does it make any sense? No there's a no sense of saying this. Consider, Someone ask me How to Decrypt the encrypted Password? So Should I answer him Remember the Table of 2 to 30 or learn Counting and Alphabet. It's make no sense. Mostly Comments are like "I use My Private Tools" "I used modded de4dot" I used "Lamp of Aladdin" I used "Poseidon Trident 🔱" OH God, If You can't share or can't atleast explain little bit manual stuff, Then the Solution is utter nonsense and useless. I also think, We should allow solutions which actually are descriptive.
  13. 2 points
    Thanks to "Extreme Coders", I've never programmed in python before, but after reading all your public material and following the recommended steps in this thread I've been able to desofuscate the code. If they tell you how to do it you will understand it, but if they guide you and you have to discover how to do it you will learn martisor_unpacked.py
  14. 2 points
    Not necessary to unpack to get the key. Key: Steps :
  15. 1 point
    Hello guys. Your forum is great and very helpful! Thanks for your work! I am a beginner in reverse engineering with some basic knowledge of C++. I wanted to create a small offset patch in c++. I found a simple template on how to do that. I tried it first with a simple NOP patching and it worked. After I edited it to patch 8 offsets I ended up with a not working-Send report to Microsoft application. I uploaded the edited source code. I don't know much about it, and why that happened. . . Is this the proper way to do it? Is there another better template? I know that there exist some cool patch engines but I would like to experiment and building my own. Thanks in advance! #include <windows.h> #include <stdio.h> #include <stdlib.h> int applyPatch(); const int SIZE = 8; int main(){ applyPatch(); return 0; } int applyPatch() { int offset[SIZE]={0x5758F,0x57590,0x57591,0x57592,0x57594,0x5792D,0x5792F,0x5F963}; byte patch[SIZE]={0xE9,0x97,0x03,0x90,0x90,0xE4,0x01,0xEB}; int i=0; int patch_counter = 0; FILE *f; f=fopen("target.exe","r+"); if(f==0) { MessageBox(0,"File not found!","Error",MB_ICONERROR); return 0; } for(patch_counter = 0; patch_counter < SIZE ; patch_counter++) { for(i=0;i<2;i++) { fseek(f,offset[patch_counter],SEEK_SET); fprintf(f,"%c",patch[patch_counter]); // Write patch offset[patch_counter]++; } } fclose(f); MessageBox(0,"Successfully patched! ","Patched",MB_OK); return 0; }
  16. 1 point
    Also Windows Defender might have options to do live cloud verification or other levels of threat verification like generic heuristics. Is the web connection enabled in the VM and all Windows Defender settings the same? Virustotal style hash checking and stuff are becoming more common in antivirus apps lately for having access to a more up to date and broader database that allows vendors to find viruses earlier as well. Could even be some random spyware setting in your Windows account profile usually under the title of "help Microsoft improve our products and user experience" type of option. Or Windows Defender is so smart that it knows when you are in a VM or sandbox probably you are studying the viruses and do not want to block them. But doubt it
  17. 1 point
    Hi guys, thanks for the feedback again.So this really sounds like hell to build any own client code without to build a browser engine to find out what kind of validation any xy site does request.So why is this validation so dynamic?Sound like that any server could also use any own request method XY instread GET / POST etc like GET_IT or whatever you know.All in all its just bad for me now so there are too much diffrent variables to handle and to know before.This just sucks. greetz
  18. 1 point
    @LCF-AT sure, is like, is diff executable, depends on author. apart from diff server validations each form has diff name for elements, ex these names take place when POST/GET to the server when u click 'login' or whatever..
  19. 1 point
    https://www.infoq.com/news/2020/07/mandrel-graalvm/ @CodeExplorer -- bonus pavellaptev.github.io/web-dark-ages/
  20. 1 point
    _PyEval_EvalFrameDefault executes a code object on the Python frame. To dump the code object to a file you need to use PyMarshal_WriteObjectToFile / PyMarshal_WriteObjectToString at an appropriate place within the function. DnSpy has nothing to do with Python. It's just a piece of string inserted there on purpose.
  21. 1 point
    Well it's true though right? Every OS upgrade adds more background services, more memory consumption. They always seek to maximally utilize the resources. You basically need a multi core with high RAM to do anything interesting nowadays. By forcing hardware upgrades, they sell more licenses so there is justification for this business strategy. My father told me in the 1970s these same things went on. So it's much older. They never rewrote the code to be more efficient because they wanted the system always busy so they could justify its use and further upgrades. Some things never change Does not leave us consumers with much options. As you correctly point out, tools like this are never as reliable or well understood as the OS choosing to be more efficient or flexible. To prove it further, Microsoft does not do much to stop Win10 cracks. But put a minimal Win10 with the bloat stripped out and they will DMCA it at light speed. Priorities! Instead of designing to run on certain hardware configurations as claimed, they in reality design it not to run on certain hardware specs.
  22. 1 point
    We say this with every iteration of Windows. Recalling XP being bloated... 🤔 Ted.
  23. 1 point
    Often servers have global settings and per domain or IP settings. So globally require SSL is on. But only the IPv4 address is configured for the redirect. The redirect should have been global possibly or defined also for the IPv6. Actually usually it's done on domain names which makes more sense. There are further tricks since SSL can validate IPs and there is some complexity to getting all this to work right in all scenarios such as shared certificates for multiple domains, etc.
  24. 1 point
    This site (in Chinese) explains a bit about that last parameter structure “The fourth parameter ppResult is a pointer of type PADDRINFOA, that is, a double pointer of type addrinfo” https://www.cnblogs.com/Ishore/p/4009205.html
  25. 1 point
    Seems like a tool to keep the cache empty. May be better to leave it to the OS to manage memory... Ted.
  26. 1 point
    Your IPv4 info resembles a typical website attempting to enforce SSL where all http:// traffic is forwarded to the proper https:// instead. Your IPv6 info resembles a server misconfigured for the same thing and not properly handling the forwarding.
  27. 1 point
    Bed_ControlFlow_Remover.rar x86_Retranslater.rar I can't give you the rest of em ( i don't have permission to share them, hope you understand me).
  28. 1 point
    part 2 https://hot3eed.github.io/2020/06/22/snap_p2_deobfuscation.html
  29. 1 point
    etc etc https://torrentfreak.com/removing-annoying-windows-10-features-is-a-dmca-violation-microsoft-says-200611/ cheers B
  30. 1 point
    Bro i agree with your each word my full vote for you and also @BlackHat words also... I need to tell one thing for all if past reverse they don't let some revering learning sufft then new reverse will never born..
  31. 1 point
  32. 1 point
    Is this a hidden feature of the protection or does the app just not work?
  33. 1 point
    How these Unpacking Posts are getting approved ? It is clearly written in the Rules that the solution of challenge will not be accepted if you don't describe the steps. Here everyone showing that they have cleaned it but no one is telling how ? so literally this is not a valid contribution to the forum if you don't descibe how it has been done. Just uploading files of cleaned is not all about unpacking. I think everyone must need to describe the steps or approach he has done to clean it. If I sound rude, I am sorry but this is what i feel.
  34. 1 point
    This is a notification of intent to cease and close the Blogs section of the site in a months time. The reasons for the change are; lack of use, activity and popularity, and for the most part the forum categories have been and are more than capable to host similar blog like content in the future. This notification gives you the opportunity to copy any information from Blogs that you wish to retain and/ or repost in the appropriate forum... Ted. Backups - Blogs.rar
  35. 1 point
    What makes you question either of these? Private: There are occasionally some techniques, practices (and tools) kept private to stay ahead of the game. Nothing has changed much over the years in this regard as far as I can tell. Knowledge: As @kao already mentioned most of the core techniques and information is out there to be discovered (in these forums for example). It only needs a willing and proactive individual to expand and develop on this information. As everyone seems to have their own blog (or YouTube channel) these days these generally seem to be the new format for tutorials. One day... when all my children have grown up and left home I can get my life back and get back to RCE and making traditional tutorials. Hopefully the RCE world will be an entirely new and interesting place to explore... 👍 Ted.
  36. 1 point
    This forum is overrun by lazy-ass noobs who don't really want to learn. They want to have a youtube video and automagic tool for everything. Ready-made tools are private for this exact reason. People who want to learn will find the necessary information to learn the basics. And once you show you've done your homework, knowledge and techniques are being shared freely. Maybe not 100% public but via PMs and chat.
  37. 1 point
  38. 1 point
    hello, I apologize if it has nothing to do with this post, I'm decompressing with ManagedJiterFr4.exe but I get the following errors why? how can i solve? this if i try with unpackme
  39. 1 point
    You don't need to know correct key to get the flag: Is that what you're looking for? How-to: 1) Run and dump from memory; 2) (optional) Fix imports with Scylla; 3) Load dump in IDA; 4) Find WndProc and see how WM_COMMAND is handled; 5) The key check is very convoluted but it all ends up here: ... lots of horrible operations with entered key .. strncpy(buffer, encryptedFlag, 25); for ( n = 0; n < 25; ++n ) { v3 = buffer[n]; v4 = HIDWORD(v3) ^ HIDWORD(v20) ^ HIDWORD(v21) ^ HIDWORD(v22) ^ HIDWORD(v23) ^ HIDWORD(v11); v8[2 * n] = v3 ^ v20 ^ v21 ^ v22 ^ v23 ^ v11; v8[2 * n + 1] = v4; decryptedFlag[n] = v8[2 * n]; } // check last 2 bytes of decrypted flag result = 24; if ( decryptedFlag[24] == 'Z' ) { result = 23; if ( decryptedFlag[23] == 'C' ) ... Xor key for all bytes is the same. You know encrypted flag. You know last 2 bytes of decrypted flag. So, you can deduce XOR key and decrypt the flag.
  40. 1 point
    I Released a way of patching these vm's, here https://github.com/TobitoFatitoNulled/Venturi77CallHijacker but you'll need to manually inject agile for now (will try to fix the issue asap tho.
  41. 1 point
    Beds Protector ? I found is Babel Protector .
  42. 1 point
    Run the program, put any fake password, click on "Check password" wrong msg will be prompted, open up process hacker, right click on the file process -> properties -> net module -> strings -> scan/dump and then you have a .txt file with all strings extracted from memory. Seek for the wrong msg prompt text and nearby is the password.
  43. 1 point
    my confuserex unpacker works for this with one slight modification in the anti tamper find method it fails just make it find anti tamper (easiest way just change the if (sections.Count == 3) from a 3 to a 2 this will then fix it and static route work 100%
  44. 1 point
    Yep. That is one of the sections. It may be more on larger files. BTW. Here is my script for recover VM'ed Enigma OEP. Is written back in 2015 and i don't know if is fail proof because i did not use/test for more than a year ago. // giv@reversing.ro // Script for restore VM OEP on Enigma 5.xx VM'ed OEP // Delphi files + VB6 bc lc bphwc bpmc dbh GMI eip, CODEBASE mov bazacod, $RESULT GMI eip, CODESIZE mov marimecod, $RESULT VAR INTRARE ask "Enter the EIP of the stolen OEP" mov INTRARE, $RESULT //mov INTRARE, 0041F372 BPHWS INTRARE erun bphwc INTRARE ask "Enter compiler type: 1 for Delphi 2 for Visual Basic 3 for C++" mov tipcompilator, $RESULT cmp $RESULT,1 ifeq jmp Delphi endif cmp $RESULT,2 ifeq jmp vb6 endif cmp $RESULT,3 ifeq jmp C_plus endif //Target compiler select mov delphi, 1 mov vb6, 0 mov cpp, 0 ///////////////// cmp delphi, 1 ifeq jmp Delphi endif cmp vb6, 1 ifeq jmp vb6 endif cmp cpp, 1 ifeq jmp C_plus endif Delphi: log "PUSH EBP" log "MOV EBP, ESP" log "ADD ESP, -10" BREAK: bc bphwc bpmc BPRM bazacod, marimecod erun cmp eip, INTRARE ifeq jmp BREAK endif cmp eip, bazacod+marimecod ifa jmp BREAK endif cmp eax, 01000000 ifa jmp DWORD endif cmp [eip], #FF25#, 2 ifeq jmp BREAK endif mov valoareeax, eax eval "MOV EAX, 00{valoareeax}" LOG $RESULT, "" eval "MOV ECX, 00{ecx}" log $RESULT, "" eval "MOV EDX, 00{edx}" log $RESULT, "" mov pozitie, eip eval "CALL 0{pozitie}" log $RESULT, "" GASIRE_RET: bpmc cmp [eip], #FF25#, 2 ifeq jmp BREAK endif find eip, #C3#, 5 mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa bp adresagasitaret erun bc adresagasitaret esti gci eip, COMMAND mov stringoep, $RESULT scmpi stringoep, "PUSH 0x0", 4 cmp $RESULT, 0 ifa jmp Comanda_gci endif esti jmp Comanda_gci endif find eip, #5?C?#, 1500 mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa mov diferenta, adresagasitaret-eip cmp diferenta, 35 ifb cmp [adresagasitaret], #5BC3#, 2 ifeq bpmc bp adresagasitaret erun esti esti jmp Comanda_gci endif cmp [adresagasitaret], #5DC2#, 2 ifeq bpmc bp adresagasitaret erun esti esti jmp Comanda_gci endif msg "Diferenta prea mica" endif mov adresacomparare, adresagasitaret add adresacomparare, 1 cmp [adresacomparare], #C3#,1 ifneq mov start, eip add start, 35 find start,#E8????????C3# bp $RESULT erun bc find eip, #5?C?# bp $RESULT erun bc esti esti jmp Comanda_gci //msg "Pauza C3" endif bp adresagasitaret erun bc adresagasitaret esti esti jmp Comanda_gci endif find eip, #5?5?5?5?C3#,500 bpmc mov adresagasitaret, $RESULT cmp adresagasitaret, 0 ifa bp adresagasitaret erun bc adresagasitaret esti esti jmp Comanda_gci endif cmp adresagasitaret, 0 Continuare_ret: bpmc ifa bp adresagasitaret bpmc erun endif bc adresagasitaret esti esti Comanda_gci: GCI eip, COMMAND mov comanda, $RESULT scmpi comanda, "PUSH 0x0", 4 ifneq jmp GASIRE_RET endif jmp BREAK DWORD: ///////// bc bphwc ///////// mov gasire, eax rev gasire mov gasire, $RESULT /////////////////// eval "{gasire}" mov gasire, $RESULT ////////////////// len gasire cmp $RESULT, 7 ifeq eval "0{gasire}" mov gasire, $RESULT jmp ansamblare_gasire endif len gasire cmp $RESULT, 6 ifeq eval "00{gasire}" mov gasire, $RESULT endif //log gasire, "" ansamblare_gasire: eval "#{gasire}#" mov gasire, $RESULT findmem gasire, bazacod mov adresa_p, $RESULT cmp adresa_p, 0 ifeq msg "Pointer negasit" pause endif ifa eval "MOV EAX, DWORD PTR[{adresa_p}]" log $RESULT, "" cmp ecx, 401000 ifa eval "MOV ECX, 00{ecx}" log $RESULT, "" endif cmp edx, 401000 ifa eval "MOV EDX, 00{edx}" log $RESULT, "" endif mov pozitie, eip eval "CALL 0{pozitie}" log $RESULT, "" jmp GASIRE_RET vb6: findmem #5642??21#, bazacod mov variabilapush, $RESULT cmp variabilapush,0 ifeq msg "Pattern not found for push value - VB6" jmp Sfarsit endif eval "PUSH 00{variabilapush}" LOG $RESULT, "" asm eip, $RESULT mov variabilacall, eip-6 eval "CALL 00{variabilacall}" LOG $RESULT, "" asm eip+5, $RESULT jmp Sfarsit C_plus: bc bphwc bpmc BPRM bazacod, marimecod erun MOV intrarecallc, eip EVAL "CALL {intrarecallc}" log $RESULT, "" ASM INTRARE, $RESULT bc bphwc bpmc rtr esti BPRM bazacod, marimecod erun MOV jmpc, eip EVAL "JMP {jmpc}" log $RESULT, "" ASM INTRARE+5, $RESULT jmp Sfarsit Sfarsit: msg "Script is finished"
  45. 1 point
    Hacking Android Apps Using Backup Techniques http://resources.infosecinstitute.com/android-hacking-security-part-15-hacking-android-apps-using-backup-techniques/ Cracking Android App Binaries http://resources.infosecinstitute.com/android-hacking-security-part-17-cracking-android-app-binaries/ Android Application hacking with Insecure Bank Part 4 http://resources.infosecinstitute.com/android-application-hacking-with-insecure-bank-part-4/ Android Application hacking with Insecure Bank – Part 3 http://resources.infosecinstitute.com/android-application-hacking-with-insecure-bank-part-3/ Android Application hacking with Insecure Bank Part 2 http://resources.infosecinstitute.com/android-application-hacking-insecure-bank-part-2/ Android Application hacking with Insecure Bank Part 1 http://resources.infosecinstitute.com/android-application-hacking-insecure-bank-part-1/ Understanding Disk Encryption on Android and iOS http://resources.infosecinstitute.com/understanding-disk-encryption-android-ios/ Getting Started with Android Forensics http://resources.infosecinstitute.com/getting-started-android-forensics/ Penetration Testing Apps for Android Devices http://resources.infosecinstitute.com/pen-test-apps-android-devices/ Android Hacking and Security, Part 3: Exploiting Broadcast Receivers http://resources.infosecinstitute.com/android-hacking-security-part-3-exploiting-broadcast-receivers/ Android Hacking and Security, Part 2: Content Provider Leakage http://resources.infosecinstitute.com/android-hacking-security-part-2-content-provider-leakage/ Android Hacking and Security, Part 1: Exploiting and Securing Application Components http://resources.infosecinstitute.com/android-hacking-security-part-1-exploiting-securing-application-components/ Android Application Security Testing Guide: Part 2 http://resources.infosecinstitute.com/android-app-sec-test-guide-part-2/ Android Application Security Testing Guide: Part 1 http://resources.infosecinstitute.com/android-application-security-testing-guide-part-1/ Exploiting Debuggable Android Applications http://resources.infosecinstitute.com/android-hacking-security-part-6-exploiting-debuggable-android-applications/ Android App Permissions and Security: What You Need to Know http://resources.infosecinstitute.com/android-app-permissions-security-need-know/ Security and Hacking apps for Android devices http://resources.infosecinstitute.com/security-hacking-apps-android/ Android Forensics: Cracking the Pattern Lock Protection http://resources.infosecinstitute.com/android-forensics-cracking-the-pattern-lock-protection/ Sniffing Network Traffic on Android http://resources.infosecinstitute.com/sniffing-network-traffic-android/ Creating a kewl and simple Cheating Platform on Android https://deepsec.net/docs/Slides/2014/Creating_a_kewl_and_simple_Cheating_Platform_on_Android_-_Milan_Gabor-Danijel_Grah.pdf Racing with DROIDS http://2014.zeronights.org/assets/files/slides/racingwithdroids.pdf Steroids for your App Security Assessment http://2014.zeronights.org/assets/files/slides/grassi.pdf Hey, we catch you - dynamic analysis of Android applications https://pacsec.jp/psj14/PSJ2014_Wenjun_Hey- We Catch You - Dynamic Analysis of Android Applications.pdf An Infestation of Dragons: Exploring Vulnerabilities in the ARM TrustZone Architecture https://pacsec.jp/psj14/PSJ2014_Josh_PacSec2014-v1.pdf Making Android's Bootable Recovery Work For You http://matasano.com/research/eko2014_recovery.pdf Mobile Hacking – Reverse Engineering the Android OS http://www.slideshare.net/EC-Council/hacker-halted-2014-reverse-engineering-the-android-os MAN IN THE BINDER: HE WHO CONTROLS IPC, CONTROLS THE DROID https://www.blackhat.com/docs/eu-14/materials/eu-14-Artenstein-Man-In-The-Binder-He-Who-Controls-IPC-Controls-The-Droid.pdf Hide Android Applications in Images https://www.blackhat.com/docs/eu-14/materials/eu-14-Apvrille-Hide-Android-Applications-In-Images.pdf BREAKING “SECURE” MOBILE APPLICATIONS http://conference.hitb.org/hitbsecconf2014kul/materials/D2T1 - Dominic Chell - Breaking Secure Mobile Applications.pdf TACKYDROID: Pentesting Android Applications in Style http://conference.hitb.org/hitbsecconf2014kul/materials/D2T2 - Chris Liu and Matthew Lionetti - TackyDroid.pdf Android Forensics: The Joys of JTAG https://ruxcon.org.au/assets/2014/slides/tty0x80-Ruxcon Presentation-12th-October-2014-for-release.pdf Enter The Snapdragon! https://www.hacktivity.com/en/downloads/archives/319/ A distributed approach to malware analysis https://speakerdeck.com/nviso/a-distributed-approach-to-malware-analysis-brucon-0x06-daan-raman Bypassing wifi pay-walls with Android http://www.slideshare.net/rootedcon/pau-olivafora-rootedcon2014 Play Flappy Bird while you pentest Android in style http://hitcon.org/2014/downloads/P1_10_Chris Liu - Matthew Lionetti - TackyDroid Slides.pptx On the Feasibility of Automa3cally Generating Android Component Hijacking Exploits http://hitcon.org/2014/downloads/P1_09_Daoyuan Wu - On the Feasibility of Automatically Generating Android Component Hijacking Exploits.pdf Peeking into Your App without Actually Seeing it: UI State Inference and Novel Android Attacks https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-chen.pdf ASM: A Programmable Interface for Extending Android Security https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-heuser.pdf Android Packers:Separating from the pack http://www.fortiguard.com/paper/Android-Packers--Hacktivity2014/ Sprobes: Enforcing Kernel Code Integrity on the TrustZone Architecture http://mostconf.org/2014/slides/s2p3-slides.pdf A Systematic Security Evaluation of Android's Multi-User Framework http://mostconf.org/2014/slides/s3p3-slides.pptx Enter Sandbox: Android Sandbox Comparison http://mostconf.org/2014/slides/s3p1-slides.pdf Exploiting the Bells and Whistles: Uncovering OEM Vulnerabilities in Android http://thecobraden.com/uploads/Valletta - CarolinaCon X - Exploiting the Bells and Whistles.pdf Execute this! Looking into code-loading techniques on Android http://warsaw2014.honeynet.org/slides/honeynet2014-day1-Sebastian.pdf Post-Mortem Memory Analysis of Cold-Booted Android Devices http://www.homac.de/publications/Post-Mortem-Memory-Analysis-of-Cold-Booted-Android-Devices-slides.pdf Tricks for image handling in Android http://www.slideshare.net/tyronenicholas/devoxx-images-android Pentesting Android Applications http://www.slideshare.net/clviper/pentesting-android-applications Rage Against the Virtual Machine: Hindering Dynamic Analysis of Android Malware http://www.syssec-project.eu/m/documents/eurosec14/RATVM.pdf Pre-installed Android application poisoning https://speakerdeck.com/owaspjapan/pre-installed-android-application-poisoning-number-appsecapac2014 AirBag: Boosting Smartphone Resistance to Malware Infection http://yajin.org/papers/ndss14_airbag.pdf SMV-Hunter: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps https://www.utdallas.edu/~zxl111930/file/NDSS14b.pdf AppSealer: Automatic Generation of Vulnerability-Specific Patches for Preventing Component Hijacking Attacks in Android Applications http://sycurelab.ecs.syr.edu/~mu/AppSealer-ndss14.pdf Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications https://anonymous-proxy-servers.net/paper/android-remote-code-execution.pdf DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket http://filepool.informatik.uni-goettingen.de/publication/sec//2014-ndss.pdf Reverse Engineering, Pentesting and Hardening of Android Apps https://speakerd.s3.amazonaws.com/presentations/25bc54e0728001318b20063debaef239/DroidconIT2014.pdf Predatory Hacking of Mobile: Real Demos http://www.rsaconference.com/writable/presentations/file_upload/mbs-w03-predatory-hacking-of-mobile-real-demos-v2.pdf Touchlogger on iOS and Android http://www.rsaconference.com/writable/presentations/file_upload/mbs-w01-touchlogger-on-ios-and-android-v2.pdf Beginners Guide to Reverse Engineering Android Apps http://www.rsaconference.com/writable/presentations/file_upload/stu-w02b-beginners-guide-to-reverse-engineering-android-apps.pdf Mobile Analysis Kung Fu, Santoku Style http://www.rsaconference.com/writable/presentations/file_upload/anf-w03-mobile-analysis-kung-fu-santoku-style_v2.pdf Android FakeId Vulnerability https://bluebox.com/technical/blackhat-fake-id-talk-material-and-follow-up/
  46. 1 point
    Small modification of ragdog's idea: 1) breakpoint on LoadBitmapA; 2) look at parameters to the call: 0012F740 00AC119D /CALL to LoadBitmapA from 00AC1198 0012F744 00AC0000 |hInst = 00AC0000 0012F748 00AC3000 \RsrcName = "MyBitmap" So, the DLL is loaded at address AC0000. 3) Dump memory at address AC0000. I used PETools, so it calculated size of dump automatically (EC000 bytes). But you can always use other tool and dump more memory, it won't hurt. 4) Open dump with CFF and use its resource editor function to extract BMP.
  47. 1 point
    Hi They Mostly focus on their VM engine, and they upgraded a lot. Unpacking method is same as old version.
  48. 1 point
    Hi Here is the Unpacked File:) KinD Regards Unpacked.rar
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up
×
×
  • Create New...