Meta
December 2024 M T W T F S S 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Blogroll
IP info
Programs
Category Archives: Reversing
IDA 5.4 Pro Beta released
Hex-Rays has released a beta of the upcoming version 5.4 of IDA. I was lucky enough to be allowed for the beta-test and the first new thing I noticed was that the command line field now had a button in … Continue reading
Schünemann will Internetzugänge effektiv abschaffen
Wie Heise berichtet, will der niedersächsische Innenminister (natürlich CDU) im Kampf gegen Kinderpornographie im Internet die Kunden von Internetzugängen zwingen eine Filtersoftware zu installieren. Und einige meinen nur der verehrte Dr. Schäuble säße allein in der Fraktion der Verfassungsgegner. Obwohl … Continue reading
Posted in DE, IT Security, Programming, Reversing
Leave a comment
For all IDA friends …
The fix to the memory sync problem in the debugger (5.3) has been fixed. You’ll need to upload your key to get the fix.
CreateRemoteThread, Vista and separate sessions
Recently I’ve hit a wall during development. I had written a nice workaround for a problem, based on code injection. In fact the code wasn’t injected by loading a DLL but instead by loading relocatable (32bit) code of less than … Continue reading
Posted in /dev/null, IT Security, Programming, Reversing
24 Comments
Two weeks after beta: IDA Pro 5.3 released
Those who haven’t heard the news, get your update now. Here’s a link to the update-request page. NB: According to Ilfak, the debugger has seen major improvements. // Oliver PS: Don’t forget to get the new SDK and the support … Continue reading
Yummy
I’ve upgraded to IDA Pro Advanced 5.2 recently and I really really like it. Good job as always, Ilfak! // Oliver
Posted in Reversing, Software
Leave a comment
IDA 4.9 Freeware
… and no more excuses from those pirating IDA. Datarescue made a freeware version 4.9 of IDA available for download. In the scope of IDA Palace, I have mirrored the files on two more servers. One of the servers is … Continue reading
MD5 is dead
Scientists have shown that the attack method devised against MD5 in 2004 is usable and can even trick code-signing tools into “believing” that the binary is the same. We announce two different Win32 executable files with different functionality but identical … Continue reading
Posted in EN, IT Security, Programming, Reversing, Software
Leave a comment
Hallo aus Wien
Einige werden es bereits aus privaten Konversationen wissen, der Rest weiß es eben jetzt … ich halte mich als einer von sieben Vertretern von FRISK Software in Wien bei der Virus Bulletin Konferenz 2007 auf. Hier trifft man nette Leute … Continue reading
Posted in /dev/null, DE, IT Security, Reversing, Software
Leave a comment
Joanna Rutkowska gets serious ;)
She and a partner, Alexander Tereshkin, have published the source to BluePill, or rather a rewrite called New BluePill (NBP), since Rutkowska’s previous employer owns the rights to the original one: http://www.bluepillproject.org The source is a little flawed, at least … Continue reading
Posted in DDKWizard/DDKBUILD, EN, IT Security, Programming, Reversing
Comments Off on Joanna Rutkowska gets serious ;)
No it wasn’t an April Fool’s joke
Michał ‘GiM’ Spadliński, a Polish blogger wrote in his article “Czy Redpill Joanny Rutkowskiej jest poprawny?“: Oliver Schneider (Reverse Engineer pracujący dla F-Prota) opublikował […] artykuł, datowany na pierwszego kwietnia, który wcale nie wygląda na prima aprilisowy żart. This made … Continue reading
Posted in EN, IT Security, Programming, Reversing, Software
Comments Off on No it wasn’t an April Fool’s joke
Battle of the titans?
Ptacek, Lawson and Ferrie – well-known security specialists – joined up to challenge Rutkowska and prove that her virtualization rootkit BluePill (up to now AMD-specific) is detectable regardless of her claims. The above link leads to her official reply to … Continue reading
Posted in EN, IT Security, Programming, Reversing
Comments Off on Battle of the titans?
What the heck, Kaspersky???
… here Kaspersky claims: An advisory has recently been published on rootkit.com regarding a vulnerability in KAV 7.0. Unfortunately, the authors of this material chose not to adhere to industry standard practice, and contact the vendor prior to disclosing vulnerability … Continue reading
Posted in EN, IT Security, Reversing, Software
Leave a comment
Wicked stuff!
Ilfak posted a nice demo clip on his blog: “Decompilation gets real”. This is really a dream of many reversers and could really speed up the analysis of many samples. // Oliver
Posted in EN, IT Security, Reversing, Software
Leave a comment
Redpill getting colorless? (continued)
In my previous article from November last year I challenged the claims of Joanna Rutkowska concerning Redpill. A recent article in the German computer magazine iX (April 2007) mentioned Rutkowska’s findings again so that I decided to review the tool, … Continue reading
Posted in EN, IT Security, Programming, Reversing, Software
Leave a comment
Updates in the IDA SDK 5.1 …
Since it is always exciting to find new features, I thought it would be good to put up a list of the changes introduced into the IDA SDK since version 5.0! This should allow all plugin writers to get a … Continue reading
IDA 5.1 and Virtual PC 2007 released
Finally IDA 5.1 and Virtual PC 2007 have been released. I wrote about IDA during the beta-phase and I promise to write some more stuff (probably) the next weekend. Virtual PC 2007, just like its predecessor Virtual PC 2004, is … Continue reading
IDA 5.1 Beta 2
Yesterday Ilfak released the second beta of IDA 5.1. Not only have several issues been fixed, but also were the IDC symbol and kernel function introduced as described in the updated blog entry from a few days ago. // Oliver
Some IDC scripts uploaded (update)
On my website you can find some IDC scripts which have been uploaded just lately. Some are related to kernel mode reversing and some (MFCxx.rar) at user mode reversing. Please find them here. Update: If you downloaded the scripts before, … Continue reading
IDA 5.1 Beta 1 (updated).
Last week Ilfak released the first beta version of the upcoming IDA 5.1. I am one of the lucky ones who get to test IDA in beta stage already. And since everyone should know how I love IDA – a.k.a. … Continue reading