Archive for the ‘Reverse Engineering’ Category

Enter sandman… :)

October - 22 - 2007
Posted by Matthieu Suiche
Comments Off

Everyone knows that Dumbledore is homosexual but there is a most important thing you have to know! The PacSec Agenda had been released! http://www.securityfocus.com/archive/1/482602/30/0/threaded Speaker list: http://www.pacsec.jp/speakers.html Talk selections for PacSec 2007 – November 29 and 30 – Aoyama Diamond Hall ——- – Programmed I/O accesses: a threat to virtual machine monitors? – Loic Duflot,  [ Read More ]

DebugPrint proc near mov r9d, r8d mov r8d, edx mov dx, [rcx] mov rcx, [rcx+8] mov eax, 1 int 2Dh ; Internal routine for MSDOS (IRET) int 3 ; Trap to Debugger retn DebugPrint endp DebugPrompt proc near mov r9w, [rdx+2] mov r8, [rdx+8] mov dx, [rcx] mov rcx, [rcx+8] mov eax, 2 int 2Dh  [ Read More ]

Interrupts, Boot Loader, Vista 64bits (On the fly)

March - 10 - 2007
Posted by Matthieu Suiche
Comments Off

I’ve to do something to save me from idling while a software is rescuing my HDD. That’s why I’m gonna write short post about the boot loader and the interrupts initialization. By the way, I add a new category called “On the fly” for post like that which are more or less RCE Memento (interessting  [ Read More ]

This paper exposes part II of my previous article about Windows Vista and internals structures. This one is talking about the 32bits version and aims to show new authencity tricks. Download it from the following link: Windows_Vista_32bits_and_unexported_kernel_symbols.pdf Cheers,

Hi, I’m gonna published my (the?) first paper of the year 2007 !! :) This article is talking about Windows Vista 64bits and its system structures which are proteged against rootkit. I also explain how these structures can be authentified without Pathguard. Windows Vista 64bits and unexported kernel symbols.pdf Happy New Year !!!

Sponsors