Flag: Tornado! Hurricane!

Blogs >> RolfRolles's Blog

Created: Friday, June 15 2007 00:33.36 CDT  
Printer Friendly ...
ProcDump Thorough IDB
Author: RolfRolles # Views: 6215

After some deliberation, I have decided to release my thorough IDB for ProcDump 1.62 final, which is substantially more detailed than the original ASM source code itself.  If you care to study it, you can learn a great deal about coding dynamic reversing tools and static reversing.  

At the time I analyzed this, in late 2003, it was the largest binary that I'd attempted.  My analysis style was somewhat immature and sporadic, and so you shouldn't try to emulate anything you see inside of it.  (It took another six months after this to perfect my static technique.)

I hope that the ProcDump authors aren't upset about this; after all, ProcDump is nine years old and has since been succeeded by ImpRec, OllyDump, NTICEDUMP, etc.  Greets to the ProcDump team, and thanks for their valuable contribution (which ultimately shaped the direction of dynamic tools for years to come).


Blog Comments
Sellmi Posted: Friday, June 15 2007 03:22.56 CDT
This is a good example for the power of the hexrays decompiler
plugin for IDA...

http://pastebin.com/929445

dennis Posted: Friday, June 15 2007 03:57.00 CDT
Sure, it's like running hexrays on an ms binary with
debug symbols applied (with the exception ms binaries
usually not being written in 100% asm code) ;-)

Orr Posted: Friday, June 15 2007 04:28.25 CDT
Rolf - Hardcore :)

sp Posted: Sunday, June 17 2007 10:11.02 CDT
Thanks for sharing, man.

Soul12 Posted: Thursday, June 21 2007 13:04.00 CDT
to much spare time :> gj

NeOXQuiCk Posted: Wednesday, December 19 2007 20:28.42 CST
nice ... it took you some time to do it



Add New Comment
Comment:









There are 30,782 total registered users.


Recently Created Topics
How can I write olly...
Oct/05
Career: Malware Reve...
Sep/30
How to produce separ...
Sep/20
How to decompile a f...
Sep/16
How to trap mouse cl...
Sep/03
Intel pin in loaded ...
Jun/27
Going to do today wi...
Jun/27
how to create delphi...
Jun/27
enabling menu in a s...
Jun/18
How to get the Image...
Jun/17


Recent Forum Posts
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin


Recent Blog Entries
oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

oleavr
Apr/17
frida.re 1.2.0 is out, with...

More ...


Recent Blog Comments
djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit