Category Archives: Reversing

MUI files under the hood

Have you ever copied after Vista a system file like notepad.exe onto the desktop and tried to execute it? Have you ever tried after Vista to modify the resources of a system file like regedit.exe? It’s most likely that neither … Continue reading

Posted in Internals, Reversing | 4 Comments

PDF Insider Demo

A small, on the fly video presentation of my new utility. The emphasis of this application stands on parsing correctly the PDF format, if it can’t because the PDF is malformed (very common among malicious PDFs), then it provides the … Continue reading

Posted in News, Reversing | Tagged , | 9 Comments

Filter Monitor 1.0.1

This week, after months of development of bigger projects, I found some time to windbg “ntoskrnl.exe” and write a utility. It is called Filter Monitor and shows some key filters installed by kernel mode components. “As you probably all know … Continue reading

Posted in Internals, News, Reversing | Tagged | 2 Comments

Native Blocks Pre-Alpha

Here’s a presentation of my new tool. I called it Native Blocks. It’s a re-assembler basically. Since a written presentation would take me too much time I prepared a video presentation. Again, this is a pre-alpha. This tool will soon … Continue reading

Posted in News, Reversing | Tagged , , | 10 Comments

Qt Internals & Reversing

Today I took a break from the larger article I’m currently writing. To relax, I wrote a smaller article about the Qt framework. I hope you enjoy. Qt Internals & Reversing Half of the text of this article comes from … Continue reading

Posted in Internals, Reversing | Tagged , | 4 Comments

Rebel.NET

Today I’m releasing the Rebel.NET software and its official guide. Rebel.NET is a rebuilding tool for .NET assemblies which is capable of adding and replacing methods and streams. It’s possible to replace only a limited number of methods or every … Continue reading

Posted in Reversing | Tagged | 3 Comments

DynLogger

DynLogger logs all dynamically retrieved functions by reporting the module name and the requested function. It can come very handy when one wants to know a “hidden” function used by an application. I recycled the code of a bigger project … Continue reading

Posted in Reversing | Tagged | 2 Comments

Microsoft’s Rich Signature (undocumented)

In the last days I’ve been quite sick, so I decided that as long as I had to stay in bed I might at least use the time to do something useful (or quite so). What happened is that someone … Continue reading

Posted in Internals, Reversing | Tagged | 10 Comments