Category Archives: Reversing

MUI files under the hood

Posted on November 14, 2012 by Daniel Pistelli

Have you ever copied after Vista a system file like notepad.exe onto the desktop and tried to execute it? Have you ever tried after Vista to modify the resources of a system file like regedit.exe? It’s most likely that neither … Continue reading →

Posted in Internals, Reversing | 1 Comment

PDF Insider Demo

Posted on May 25, 2010 by Daniel Pistelli

A small, on the fly video presentation of my new utility. The emphasis of this application stands on parsing correctly the PDF format, if it can’t because the PDF is malformed (very common among malicious PDFs), then it provides the … Continue reading →

Posted in News, Reversing | Tagged , | 9 Comments

Filter Monitor 1.0.1

Posted on October 17, 2009 by Daniel Pistelli

This week, after months of development of bigger projects, I found some time to windbg “ntoskrnl.exe” and write a utility. It is called Filter Monitor and shows some key filters installed by kernel mode components. “As you probably all know … Continue reading →

Posted in Internals, News, Reversing | Tagged | Leave a comment

Native Blocks Pre-Alpha

Posted on June 30, 2009 by Daniel Pistelli

Here’s a presentation of my new tool. I called it Native Blocks. It’s a re-assembler basically. Since a written presentation would take me too much time I prepared a video presentation. Again, this is a pre-alpha. This tool will soon … Continue reading →

Posted in News, Reversing | Tagged , , | 10 Comments

Qt Internals & Reversing

Posted on November 28, 2008 by Daniel Pistelli

Today I took a break from the larger article I’m currently writing. To relax, I wrote a smaller article about the Qt framework. I hope you enjoy. Qt Internals & Reversing Half of the text of this article comes from … Continue reading →

Posted in Internals, Reversing | Tagged , | 4 Comments

Rebel.NET

Posted on April 25, 2008 by Daniel Pistelli

Today I’m releasing the Rebel.NET software and its official guide. Rebel.NET is a rebuilding tool for .NET assemblies which is capable of adding and replacing methods and streams. It’s possible to replace only a limited number of methods or every … Continue reading →

Posted in Reversing | Tagged | 3 Comments

DynLogger

Posted on April 13, 2008 by Daniel Pistelli

DynLogger logs all dynamically retrieved functions by reporting the module name and the requested function. It can come very handy when one wants to know a “hidden” function used by an application. I recycled the code of a bigger project … Continue reading →

Posted in Reversing | Tagged | 2 Comments

Microsoft’s Rich Signature (undocumented)

Posted on March 5, 2008 by Daniel Pistelli

In the last days I’ve been quite sick, so I decided that as long as I had to stay in bed I might at least use the time to do something useful (or quite so). What happened is that someone … Continue reading →

Posted in Internals, Reversing | Tagged | 7 Comments