OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Friday, December 24 2010 02:16.57 CST

Modified: Friday, December 24 2010 02:18.43 CST

Direct Link, View / Make / Edit Comments

Using NtCreateThreadEx for Remote Thread Execution in System Process for Vista & Windows7

Author:

tnagareshwar

# Views: 57315

Some times back I wrote article on using lesser known method, NTCreateThreadEx for remote thread execution. This is better alternative compared to CreateRemoteThread especially for Vista & Windows 7. As you may aware CreateRemoteThread was the popular method used for DLL Injection.

Here are some of the highlights of this technique

* Major advantage is that it can work across session boundaries while CreateRemoteThread cannot.

* User need to have sufficient privileges to perform tasks such as DLL injection using this method.

* It is UNDOCUMENTED- there is a risk but it is worth it.

This article explains everything you need to know about NtCreateThreadEx with complete code example.

Click on the below link to read the full article,

Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows7

.

Created: Wednesday, November 24 2010 11:57.46 CST

Direct Link, View / Make / Edit Comments

Reversing PDF - Vulnerabilities, Exploits and Malwares

Author:

tnagareshwar

# Views: 6001

In this tutorial, Dhanesh explains how to use basic PDF analysis tools such as PDFAnalyzer in dissecting the exploit code from malicious PDF files in simple steps with illustrative screenshots.

Highlights of the Article

    * Throws light on usage of PDF analysis tools such as PDFAnalyzer
    * Demonstrates malware analysis of real PDF samples
    * Describes in detail dissecting of the exploit code from PDF structures.

Read the complete article here

Created: Sunday, November 14 2010 01:19.27 CST

Modified: Sunday, November 14 2010 01:22.14 CST

Direct Link, View / Make / Edit Comments

Android Reverse Engineering - A Kick Start

Author:

tnagareshwar

# Views: 7513

In this article our contributing author Dhanesh

  * explains about basics of Andriod Reverse Engineering with step by step tutorial using simple crackme.

  * throws light on the tools required for reversing and demonstrate how to use them in right sequence with complete pictorial representation.

  * describes dissecting of the Android code package to reveal the secrets.

Read More

Created: Friday, May 29 2009 20:00.23 CDT

Modified: Friday, May 29 2009 20:00.23 CDT

This is an imported entry. View original.

Direct Link

VistaUACMaker with New Look & Feel

Author:

tnagareshwar

# Views: 5436

Vista has introduced new feature called UAC (User Account Control). In short it basically controls the way in which applications are executed by different users. Due to enforcement of this UAC, by default any application on Vista will run under the context of standard user instead of administrator. As a [...]

Created: Friday, May 29 2009 19:51.16 CDT

Modified: Friday, May 29 2009 19:51.16 CDT

This is an imported entry. View original.

Direct Link

SpyDLLRemover with Spyware Scanning Feature

Author:

tnagareshwar

# Views: 5199

SpyDLLRemover is the standalone tool to effectively detect and delete spywares from the system. Now It comes with advanced spyware scanner which can quickly discovers hidden Rootkit processes as well suspicious/injected DLLs within all running processes. It not only performs sophisticated auto analysis on process DLLs but also displays them [...]

Archived Entries for tnagareshwar

Subject	# Views	Created On
Enhanced BHORemover : Now Quicker & Easier than Earlier	2253	Sunday, May 10 2009
Book of the Month : 19 Deadly Sins of Software Security	2043	Sunday, May 10 2009
Best Compiled List of WinDbg Commands	1641	Tuesday, April 28 2009
Detecting Hidden Rootkit Services Using AdvancedWinServiceManager	2093	Saturday, April 18 2009
Book of the Month - Fuzzing: Brute Force Vulnerability Discovery	1636	Sunday, April 5 2009
SpyDLLRemover : Detect & Delete Spywares From The System	1353	Sunday, March 15 2009
RootkitAnalytics is Live Now	1205	Sunday, March 15 2009
Disabling Windows File Protection (SFC)	1665	Wednesday, March 4 2009
SFCList : Windows Protected Files Listing Tool	1731	Friday, February 20 2009
Have you crashed into _strlwr_s() ?	2160	Tuesday, February 10 2009
Online Virus Analysis	2242	Sunday, February 8 2009
HAKIN9 : Hardcore IT Security Magazine	2094	Thursday, January 22 2009
Book of the Month : The IDA PRO	1264	Tuesday, January 6 2009
ProcHeapViewer with integrated search feature	2090	Monday, October 27 2008
ProcHeapViewer with integrated search feature	2020	Monday, October 6 2008
Hacker Reversing Challenge 2008 Starting Soon	1653	Saturday, October 4 2008
Virtualization Conference at IIT Bombay	1998	Sunday, April 6 2008
FireMaster with Pattern based Password Recovery Technique	1882	Sunday, March 30 2008
New book on Reversing and IDA Pro	3415	Wednesday, February 6 2008
New book on Reversing and IDA Pro	1533	Thursday, January 31 2008
LDAPSearch with new Look	1436	Tuesday, January 29 2008
Solution of Hacker Reversing Challenge 2007	1851	Saturday, January 19 2008
New AntiDebugging Timer Techniques	1817	Sunday, December 16 2007
Hypervisor @ FOSS.IN	1520	Friday, December 7 2007
ProcHeapViewer : Faster way to enumerate process heaps	6578	Sunday, August 26 2007
First bytes at OpenRCE	1990	Sunday, August 26 2007
F-Secure RE Challenge Conquered	1510	Friday, August 3 2007
Detecting & Defeating the Debuggers	1498	Sunday, July 15 2007
Reminder to remind your tasks	1405	Friday, June 22 2007
ProcHeapViewer : Faster way to enumerate process heaps	1135	Monday, June 18 2007
Exploit Game : $$$ vs Vulnerability Researcher	1236	Saturday, June 2 2007

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit