Category Archives: Reversing

Posts about reverse code engineering (aka RCE, reversing, RE, reverse engineering)

MD5 is dead

Scientists have shown that the attack method devised against MD5 in 2004 is usable and can even trick code-signing tools into “believing” that the binary is the same. We announce two different Win32 executable files with different functionality but identical … Continue reading

Posted in EN, IT Security, Programming, Reversing, Software | Leave a comment

Hallo aus Wien

Einige werden es bereits aus privaten Konversationen wissen, der Rest weiß es eben jetzt … ich halte mich als einer von sieben Vertretern von FRISK Software in Wien bei der Virus Bulletin Konferenz 2007 auf. Hier trifft man nette Leute … Continue reading

Posted in /dev/null, DE, IT Security, Reversing, Software | Leave a comment

Joanna Rutkowska gets serious ;)

She and a partner, Alexander Tereshkin, have published the source to BluePill, or rather a rewrite called New BluePill (NBP), since Rutkowska’s previous employer owns the rights to the original one: http://www.bluepillproject.org The source is a little flawed, at least … Continue reading

Posted in DDKWizard/DDKBUILD, EN, IT Security, Programming, Reversing | Comments Off on Joanna Rutkowska gets serious ;)

No it wasn’t an April Fool’s joke

Michał ‘GiM’ Spadliński, a Polish blogger wrote in his article “Czy Redpill Joanny Rutkowskiej jest poprawny?“: Oliver Schneider (Reverse Engineer pracujący dla F-Prota) opublikował […] artykuł, datowany na pierwszego kwietnia, który wcale nie wygląda na prima aprilisowy żart. This made … Continue reading

Posted in EN, IT Security, Programming, Reversing, Software | Comments Off on No it wasn’t an April Fool’s joke

Battle of the titans?

Ptacek, Lawson and Ferrie – well-known security specialists – joined up to challenge Rutkowska and prove that her virtualization rootkit BluePill (up to now AMD-specific) is detectable regardless of her claims. The above link leads to her official reply to … Continue reading

Posted in EN, IT Security, Programming, Reversing | Comments Off on Battle of the titans?

What the heck, Kaspersky???

… here Kaspersky claims: An advisory has recently been published on rootkit.com regarding a vulnerability in KAV 7.0. Unfortunately, the authors of this material chose not to adhere to industry standard practice, and contact the vendor prior to disclosing vulnerability … Continue reading

Posted in EN, IT Security, Reversing, Software | Leave a comment

Wicked stuff!

Ilfak posted a nice demo clip on his blog: “Decompilation gets real”. This is really a dream of many reversers and could really speed up the analysis of many samples. // Oliver

Posted in EN, IT Security, Reversing, Software | Leave a comment

Redpill getting colorless? (continued)

In my previous article from November last year I challenged the claims of Joanna Rutkowska concerning Redpill. A recent article in the German computer magazine iX (April 2007) mentioned Rutkowska’s findings again so that I decided to review the tool, … Continue reading

Posted in EN, IT Security, Programming, Reversing, Software | Leave a comment

Updates in the IDA SDK 5.1 …

Since it is always exciting to find new features, I thought it would be good to put up a list of the changes introduced into the IDA SDK since version 5.0! This should allow all plugin writers to get a … Continue reading

Posted in EN, Programming, Reversing, Software | Leave a comment

IDA 5.1 and Virtual PC 2007 released

Finally IDA 5.1 and Virtual PC 2007 have been released. I wrote about IDA during the beta-phase and I promise to write some more stuff (probably) the next weekend. Virtual PC 2007, just like its predecessor Virtual PC 2004, is … Continue reading

Posted in EN, Reversing, Software | 2 Comments

IDA 5.1 Beta 2

Yesterday Ilfak released the second beta of IDA 5.1. Not only have several issues been fixed, but also were the IDC symbol and kernel function introduced as described in the updated blog entry from a few days ago. // Oliver

Posted in EN, Programming, Reversing, Software | Leave a comment

Some IDC scripts uploaded (update)

On my website you can find some IDC scripts which have been uploaded just lately. Some are related to kernel mode reversing and some (MFCxx.rar) at user mode reversing. Please find them here. Update: If you downloaded the scripts before, … Continue reading

Posted in EN, Programming, Reversing, Software | Leave a comment

IDA 5.1 Beta 1 (updated).

Last week Ilfak released the first beta version of the upcoming IDA 5.1. I am one of the lucky ones who get to test IDA in beta stage already. And since everyone should know how I love IDA – a.k.a. … Continue reading

Posted in EN, Reversing, Software | Leave a comment

Violating GPL to make the big money …

What would you think of a company that is presenting its new product which is somewhat innovative, but the product is based on OpenSource software and the company does not care about the OpenSource licenses of the used components? As … Continue reading

Posted in EN, Programming, Reversing, Software | Leave a comment

Redpill getting colorless?

Although I had posted this already at the malware research forum and received little feedback, I decided to prepare a brief research paper about this topic and post it here. The topic is that the Redpill approach by Joanna Rutkowska … Continue reading

Posted in EN, IT Security, Programming, Reversing, Software | 2 Comments

Agnitum still panicked?! …

Recently I wrote an article about Agnitum, a security software vendor known for its firewall, because of their accusations towards Microsoft. Today I recognized there was a comment of someone from Agnitum at the Sunbelt Blog, so I decided to … Continue reading

Posted in IT Security, Programming, Reversing | Leave a comment

Agnitum panicked because of Microsoft’s security measures

In the Sunbelt Blog I read today, that Agnitum, vendor known for its firewall mainly, is panicked because of Microsofts Kernel Patch Protection. Sorry, but that caused me to laugh. No idea how new the news are, but to those … Continue reading

Posted in IT Security, Programming, Reversing | 5 Comments