Flag: Tornado! Hurricane!

Blogs >> RolfRolles's Blog

Created: Friday, June 15 2007 00:33.36 CDT  
Printer Friendly ...
ProcDump Thorough IDB
Author: RolfRolles # Views: 6050

After some deliberation, I have decided to release my thorough IDB for ProcDump 1.62 final, which is substantially more detailed than the original ASM source code itself.  If you care to study it, you can learn a great deal about coding dynamic reversing tools and static reversing.  

At the time I analyzed this, in late 2003, it was the largest binary that I'd attempted.  My analysis style was somewhat immature and sporadic, and so you shouldn't try to emulate anything you see inside of it.  (It took another six months after this to perfect my static technique.)

I hope that the ProcDump authors aren't upset about this; after all, ProcDump is nine years old and has since been succeeded by ImpRec, OllyDump, NTICEDUMP, etc.  Greets to the ProcDump team, and thanks for their valuable contribution (which ultimately shaped the direction of dynamic tools for years to come).


Blog Comments
Sellmi Posted: Friday, June 15 2007 03:22.56 CDT
This is a good example for the power of the hexrays decompiler
plugin for IDA...

http://pastebin.com/929445

dennis Posted: Friday, June 15 2007 03:57.00 CDT
Sure, it's like running hexrays on an ms binary with
debug symbols applied (with the exception ms binaries
usually not being written in 100% asm code) ;-)

Orr Posted: Friday, June 15 2007 04:28.25 CDT
Rolf - Hardcore :)

sp Posted: Sunday, June 17 2007 10:11.02 CDT
Thanks for sharing, man.

Soul12 Posted: Thursday, June 21 2007 13:04.00 CDT
to much spare time :> gj

NeOXQuiCk Posted: Wednesday, December 19 2007 20:28.42 CST
nice ... it took you some time to do it



Add New Comment
Comment:









There are 30,639 total registered users.


Recently Created Topics
Reversing opcode
Apr/24
Question about debbu...
Apr/16
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10
need help about an D...
Feb/25
Stop a VB6 Applicati...
Feb/13
Add one new segment,...
Jan/23


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
AnaPuckett
Apr/24
Natural Weight Loss For Sli...

valeriegraey
Apr/23
KeraPlex Bio Review - Actua...

xiaofeng01
Apr/23
At Drug Rehabs in Autentic ...

xiaofeng01
Apr/23
Harry Vardon, British Golfe...

Harvelcrown
Apr/22
Stay Young and Beautiful

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit