OpenRCE: Blog

Portable Executable Format Posters for Sale in A1 format

Tue, 21 Feb 2012 10:00:44 -0600

I've created PE Format poster in A1 59,4 x 84,1 cm format, including almost all of the structures from PE/PE32+ format (with comments from WinNT.h header file), if you would like to buy a printed copy, please contact me.

http://www.secnews.pl/2012/02/21/pe-format-poster-en/

RCE Directory

Fri, 04 Apr 2008 19:29:07 -0500

Just a small project of mine - a link directory to RCE tools, blogs and everything else more or less related to reverse engineering:

http://www.rcedir.com

Feel free to add your own links:

http://www.rcedir.com/submit.php

If you can't find proper category, just add your link to any available category and i will do the rest :)

Thank you!

MultiExtractor File Ripper

Thu, 19 Apr 2007 14:56:13 -0500

MultiExtractor is a classic file ripper written by my friend Maciek, if you ever wanted to see what's hidden inside files at "C:\Program Files" this is the right tool (then you can go and complain to software developers about the size of their applications becouse of the hidden easter egg pictures :)

Screenshots
http://www.multiextractor.com/screenshots.html

VMware detection (anti-debugging trick against TRW)

Sun, 15 Apr 2007 16:52:50 -0500

Binaries + source code
http://www.pelock.com/blog/2007/04/15/vmware-detection-anti-debugging-trick-against-trw/

Some of the anti-debugging tricks can be used to detect VMware, one of them is an old anti TRW (TRW was a popular debugger in 9x days) trick.

This anti-debugging trick works fine on a real Windows 9x installations (95, 98, ME) but it raises an exception under VMware (while reading IDT entry).



BOOL IsVMware9xTrw()

{

    // detect NT/XP/Vista

    if ( (GetVersion() & 0x80000000) == 0 )

    {

        return FALSE;

    }

 

    // detect VMWare (anti debugging trick against TRW)

    // VMware isn't detected with vm acceleration disabled

    __try

    {

        __asm

        {

            sub    esp, 6

            sidt   fword ptr [esp]

            pop    ax

            pop    eax

            mov    al, byte ptr [eax + 00Eh]

        }

    }

    __except(EXCEPTION_EXECUTE_HANDLER)

    {

        return TRUE;

    }

 

    return FALSE;

}