Flag: Tornado! Hurricane!

Blogs >> RolfRolles's Blog

Created: Friday, June 15 2007 00:33.36 CDT  
Printer Friendly ...
ProcDump Thorough IDB
Author: RolfRolles # Views: 6047

After some deliberation, I have decided to release my thorough IDB for ProcDump 1.62 final, which is substantially more detailed than the original ASM source code itself.  If you care to study it, you can learn a great deal about coding dynamic reversing tools and static reversing.  

At the time I analyzed this, in late 2003, it was the largest binary that I'd attempted.  My analysis style was somewhat immature and sporadic, and so you shouldn't try to emulate anything you see inside of it.  (It took another six months after this to perfect my static technique.)

I hope that the ProcDump authors aren't upset about this; after all, ProcDump is nine years old and has since been succeeded by ImpRec, OllyDump, NTICEDUMP, etc.  Greets to the ProcDump team, and thanks for their valuable contribution (which ultimately shaped the direction of dynamic tools for years to come).


Blog Comments
Sellmi Posted: Friday, June 15 2007 03:22.56 CDT
This is a good example for the power of the hexrays decompiler
plugin for IDA...

http://pastebin.com/929445

dennis Posted: Friday, June 15 2007 03:57.00 CDT
Sure, it's like running hexrays on an ms binary with
debug symbols applied (with the exception ms binaries
usually not being written in 100% asm code) ;-)

Orr Posted: Friday, June 15 2007 04:28.25 CDT
Rolf - Hardcore :)

sp Posted: Sunday, June 17 2007 10:11.02 CDT
Thanks for sharing, man.

Soul12 Posted: Thursday, June 21 2007 13:04.00 CDT
to much spare time :> gj

NeOXQuiCk Posted: Wednesday, December 19 2007 20:28.42 CST
nice ... it took you some time to do it



Add New Comment
Comment:









There are 30,620 total registered users.


Recently Created Topics
Strategies to Get Gr...
Apr/16
Best Weight Loss Pro...
Apr/16
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10
need help about an D...
Feb/25
Stop a VB6 Applicati...
Feb/13
Add one new segment,...
Jan/23


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
Bozenhonkal
Apr/16
Roch hard on Bed

Idagren
Apr/15
Healthy Way to Get a Health...

gareebnavas
Jan/21
Android Malware Analysis

oleavr
Dec/21
frida.github.io: scriptable...

chr1x
Nov/05
!apilookup - Win32 API Func...

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

cin100dy on:
Dec/16
Devil May Cry Cosplay Costu...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit