OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Tuesday, June 16 2009 08:56.01 CDT

Direct Link, View / Make / Edit Comments

i started working on Ubuntu

Author:

kizi

# Views: 4063

I started working on Ubuntu. and currently i'm not using WIndows.
I use VMWare to run Windows.
of couse, It works very very slowly. it takes about 3minuts to open IDA pro.

and so,
Are there ways that disassembling PE file on Linux?
Does gdb has options to disassemble PE file?
running OllyDbg/ImmuniryDebugger on WINE makes hang-up.

I whish I could disas PE files on Linux naturally.

Created: Saturday, March 29 2008 10:00.16 CDT

Direct Link, View / Make / Edit Comments

it's hard for me... orz

Author:

kizi

# Views: 2743

I'm trying to find vulnerablities by using IDA pro or ImmDbg and so on...
but, 6 months has passed... and nothing found. orz.
at first. I list functions which is like fopen, and trace the use of FD returned.
and investigate functions which is like memmove, memcpy, and memory copy operations.
but, all softwares which i debugged use these securely.
this method is not efficient?

Thre result i found is that,
the world is quite secure than i thought.

Created: Sunday, December 16 2007 09:06.46 CST

Direct Link, View / Make / Edit Comments

don't work...

Author:

kizi

# Views: 2270

I wrote immdbg python script as follows.

#-----------------------------------------
# hooktest.py
class TestHook( libhook.LogBpHook ):
    def __init__( self ):
libhook.LogBpHook.__init__( self );
    def run( self, regs ):
ImmDbgr = immlib.Debugger();
ImmDbgr.Log( "Test" );

def main(args):
    T = TestHook();
    T.add( "TestHook", int( args[0], 16 ) );
    return "set hook";
#----------------------------------

copied it to PyCommand,
and, invoked at commandline as "!hooktest 0x412120"
0x412120 is the head address of function that I wanted to hook.
finally i ran the immdbg.

when the above script invoked, it output "Test" in Log window,
and hang up...
what's wrong with me...orz

Created: Wednesday, October 17 2007 12:46.13 CDT

Direct Link, View / Make / Edit Comments

ImmunityDebugger

Author:

kizi

# Views: 3447

I want to use graphclass to illustrate code coverage.
but,
there are no example codes!.
Please tell me how to use it?

Archived Entries for kizi

Subject	# Views	Created On
No archived blog entries found.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit