Salutations fellow readers. I hope some of you saw me speak on JoeCrypter last week at CactusCon. As for the slides from my talk, you can view them here. For those who don’t know, I wrote the reverse engineering challenges this year for the CTF. Most of them were solved, but not all. Perhaps some […]
Finally, I’m done with this my crypter. I’ve written the entire thing in a mish mash of C#, C, and assembly. The crypter I made modifies exes, packs them, and adds AV / VM / Sandbox / debugging evasions inside of a wrapper. I’m employing a basic process hollowing technique for the payload that is […]
Howdy fellow readers. My time is split between video games, code, and work. I have a number of interesting samples I’ve seen that I’ve decided to share with you all. This is a 3+ stage malware. Each stage meaning its own executable (think inception, but with exes). This isn’t all that uncommon with malware. Typically […]
Hello loyal readers! Sorry for the delay in posts, I’ve just been busy with life. Anywho, I got some code to share. A lil script I put together for scanning office documents for the Sandworm exploit. aka Microsoft Security Bulletin MS14-060. For those of you who don’t know / live under a rock, its a […]
Howdy all! Long time no updates. Sorry about that, the life of the AV reverse engineer is a busy one, but busy is good right? Anywho, I come bearing gifts. An anti-debugger trick I learned (while coding skiddy AV tool). The way it works is simple – under normal circumstances, the working set (amount of […]
Hello all! Last Friday was our local Phoenix conference called CactusCon. I gave a 2 hour workshop on cheating at video games. It wasn’t recorded, but I still said I would share the slides (html file), code, and videos. Notes? Check it out! Videos? Now that I have some free time I can finally work […]
Users of the net dread this screen. They feel when they see it all hope is lost. In the case of this ransomware dropper, the same holds true. In fact, in running this, I lost my downloads folder >:( Indeed, a risk all malware reverse engineers take. Live and learn right? Anywho, let’s dive into […]
Howdy ho! This is one of those interim posts where I’m not posting something cool, but rather something that’s bothering me. You know, like a blog post? Anyways, I downloaded Uber the other day and its pretty cool and handy. The only qualm I had was with all the permissions it asked for. You can […]
Hello fellow readers! You all are probably wondering what the hell I’ve been up to this past month. Lot’s of stuff. This post is all over the place with code and slides and malware and general wackiness. Rather than spreading it out over several blog posts, I decided to just get it all over with […]
SourceForge has been around as long as I can remember. Bringing open source projects to the world for people to download and peer at source code and projects. With github taking over in popularity, the need for SourceForge has dwindled. Slashdot owns SourceForge now (or maybe they always have? I don’t recall). So what brings […]