OpenRCE: Blog

Using NtCreateThreadEx for Remote Thread Execution in System Process for Vista & Windows7

Fri, 24 Dec 2010 02:16:57 -0600

Some times back I wrote article on using lesser known method, NTCreateThreadEx for remote thread execution. This is better alternative compared to CreateRemoteThread especially for Vista & Windows 7. As you may aware CreateRemoteThread was the popular method used for DLL Injection.

Here are some of the highlights of this technique

* Major advantage is that it can work across session boundaries while CreateRemoteThread cannot.

* User need to have sufficient privileges to perform tasks such as DLL injection using this method.

* It is UNDOCUMENTED- there is a risk but it is worth it.

This article explains everything you need to know about NtCreateThreadEx with complete code example.

Click on the below link to read the full article,

Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows7

.

Reversing PDF - Vulnerabilities, Exploits and Malwares

Wed, 24 Nov 2010 11:57:46 -0600

In this tutorial, Dhanesh explains how to use basic PDF analysis tools such as PDFAnalyzer in dissecting the exploit code from malicious PDF files in simple steps with illustrative screenshots.

Highlights of the Article

    * Throws light on usage of PDF analysis tools such as PDFAnalyzer
    * Demonstrates malware analysis of real PDF samples
    * Describes in detail dissecting of the exploit code from PDF structures.

Read the complete article here

Android Reverse Engineering - A Kick Start

Sun, 14 Nov 2010 01:19:27 -0600

In this article our contributing author Dhanesh

  * explains about basics of Andriod Reverse Engineering with step by step tutorial using simple crackme.

  * throws light on the tools required for reversing and demonstrate how to use them in right sequence with complete pictorial representation.

  * describes dissecting of the Android code package to reveal the secrets.

Read More

VistaUACMaker with New Look & Feel

Fri, 29 May 2009 20:00:23 -0500

Vista has introduced new feature called UAC (User Account Control). In short it basically controls the way in which applications are executed by different users. Due to enforcement of this UAC, by default any application on Vista will run under the context of standard user instead of administrator. As a [...]

SpyDLLRemover with Spyware Scanning Feature

Fri, 29 May 2009 19:51:16 -0500

SpyDLLRemover is the standalone tool to effectively detect and delete spywares from the system. Now It comes with advanced spyware scanner which can quickly discovers hidden Rootkit processes as well suspicious/injected DLLs within all running processes. It not only performs sophisticated auto analysis on process DLLs but also displays them [...]