OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, July 19 2010 17:01.22 CDT

Direct Link, View / Make / Edit Comments

HiperDrop 0.0.1

Author:

GynvaelColdwind

# Views: 10057

Hi :)

I've published a tool that I've made a while ago, and forgot it later. I've came across it yesterday while looking through the directories.

Anyway, it's called HiperDrop, and it's a simple command line process memory dumper for Windows.

Basically, it attaches to a process, read the whole memory (unlike LordPE / OllyDump, this tool is design to download the whole memory of the process), and saves it to disk.

I've written some more details on my tech blog :)

You can download the tool (it's open source) here:
http://gynvael.coldwind.pl/download.php?f=HiperDrop-0.0.1.zip

Take care :)

Created: Tuesday, January 26 2010 19:26.05 CST

Modified: Tuesday, January 26 2010 19:26.51 CST

Direct Link, View / Make / Edit Comments

The tale of Syndicate Wars Port

Author:

GynvaelColdwind

# Views: 5219

As promised, It's time to reveal the technical story behind the Syndicate Wars Port. The story is divided into two parts - the first, and the second attempt to port this game. Comments are welcomed!

Read more... (be warned that the story is long :)

Created: Monday, January 25 2010 17:20.35 CST

Modified: Monday, January 25 2010 17:28.55 CST

Direct Link, View / Make / Edit Comments

Syndicate Wars - a reverse-engineering tale

Author:

GynvaelColdwind

# Views: 9973

Syndicate Wars is a game published in 1996, created by Bullfrog. The game was written in C (Watcom) for the DOS4GW DOS extender. And of course it has stopped working natively (i.e. without emulators like DOSBox) when the modern operating systems, like GNU/Linux or Windows NT series, emerged.

A few years ago my friend, Unavowed, told me about proposition of a project to create a port of Sydicate Word for modern OS'es like the two previous one I've mentioned. The port was to be done by decompiling the original executable file, locating all the functions from the standard C library, locating the DOS4GW and I/O (sound, keyboard, gfx, mouse, etc) dependencies, replacing them with modern native libc function call and libSDL/OpenAL libraries (sometimes using simple wrappers, other times by creating converters), and finally, recompiling it all to form native executables for the modern systems.

Yesterday, we've finished this project, and we've published executables, not only for GNU/Linux and Windows, but also for Mac OSX :)

Project site (screens, downloads, even a video):
http://swars.vexillium.org/

As for the technical side of the project, I'll describe everything in the next post - it was the biggest reverse-engineering project I've took part in, and I hope you'll too find something interesting in the details for yourselves :)

GNU/Linux:

Mac OSX 10.5:

Windows Vista:

Created: Monday, January 11 2010 16:22.07 CST

Direct Link, View / Make / Edit Comments

Exception detection on Windows and HITB ezine

Author:

GynvaelColdwind

# Views: 5485

The Hack In The Box ezine, which was published in the years 2000-2005 (37 issues total) has been revived!
The newest issue contains 6 articles (including mine), which gives 44 pages of text, in PDF (link below). Imho it's worth taking a look. It's very possible your find something interesting for yourself there :)

Article list:
- p. 03 - Exception Detection on Windows (by me)
- p. 07 - The Art of DLL Injection (by Christian Wojner, CERT.at)
- p. 09 - LDAP Injection. Attack and Defense Techniques (cover story, by Esteban Guillardoy, Facundo de Guzman, Hernan Abbamonte)
- p. 18 - Xprobe2-NG. Low Volume Remote Network Information Gathering Tool (by Fedor V. Yarochkin. Ofir Arkin (Insightix), Meder Kydyraliev (Google), Shih-Yao Dai, Yennun Huang (Vee Telecom) and Sy-Yen Kyo)
- p. 25 - Malware Obfuscation. Tricks and Traps (by Wayne Huang, Armorize Technologies)
- p. 39 - Reconstructing Dalvik Applications Using UNDX (by Marc Sch�nefeld)

Download: HITB-Ezine-Issue-001.pdf

Comments about my article are mostly welcomed :)

Created: Tuesday, January 5 2010 13:33.31 CST

Direct Link, View / Make / Edit Comments

DR6 may or may not be useful for bochs/VirtualPC detection

Author:

GynvaelColdwind

# Views: 4631

This post will be similar to the previous one, and will be about small, but interesting, details of x86 architecture, that might be (and sometimes are) easily overlooked by creators of emulators and virtual machines. The hero of today's post is the DR6 debug register, or, to be more precise, the four least significant bits of this register - B0 to B3 (breakpoint condition detected flags). Please read the whole post before jumping into any conclusions :)

Read the full post...

Archived Entries for GynvaelColdwind

Subject	# Views	Created On
BSWAP + 66h prefix (bochs, QEMU detection)	5528	Tuesday, December 29 2009
A thought about drivers\etc\hosts file	2353	Friday, August 7 2009
Another file visualizations	2946	Wednesday, May 27 2009
CONFidence conference ESET crackme solution	4265	Tuesday, May 26 2009
Ent 0.0.3 and a post about entropy in RCE	2784	Sunday, March 8 2009
ExcpHook 0.0.5-rc2 released	2956	Tuesday, February 3 2009
Difference between exports in DLLs - Vista SP 1 vs Windows 7 Beta	2674	Tuesday, January 20 2009
LOOP vs. default Mac OS X assembler	2686	Sunday, December 7 2008
Freedom for everything - total annihilation of process memory	2789	Thursday, November 27 2008
Google Chrome Sandbox	3217	Thursday, September 4 2008
ExcpHook 0.0.4 released	12384	Tuesday, January 22 2008
Exception monitor	5303	Sunday, January 13 2008
Windows Vista environment variables	5163	Friday, August 3 2007
Looking for a job...	3592	Tuesday, December 12 2006
Hello World!	3227	Thursday, September 7 2006

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit