Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Code code:"if (foo != bar)"
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Bookmarks inbookmarks:mine
inbookmarks:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with
Search options user 2021

A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins.

1
vote
In addition to what Jason said, I'd add that there is another potentially helpful way: Breakpoint on ExitProcess() (and probably HeapFree() too) Enter in the input box some test - "bla bla bla" Sear …
answered Sep 16 '13 by PhoeniX
6
votes
If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To …
answered May 19 '15 by PhoeniX
1
vote
Your question is too broad and it looks that you lack basics in the RCE in general. I would suggest to start with some theory : Reversing: Secrets of Reverse Engineering - nice book for an intro Col …
answered Jan 6 '15 by PhoeniX
4
votes
I'll list some ways to do it. Obviously there are many others and most likely other fellows here will add. Start with those as they are ones of the mostly used. While debugging a malicious process, …
answered Jan 1 '14 by PhoeniX
2
votes
At first try to start with hardware BP instead of software BP ("the regular ones") but remember that you only have 4 hardware BPs and they are per specific thread. In addition, taking into account th …
answered Jan 5 '14 by PhoeniX
0
votes
Based on provided information I suspect that the used method here is Dynamic forking of a process or as it also know process hollowing. The idea is to execute some arbitrary process in suspended state …
answered Mar 10 '15 by PhoeniX
1
vote
As there are little data about the unpack flow, here is the general approach you should follow in most packed malwares. This will probably be more complicated if we are talking about some custom and s …
answered May 31 '16 by PhoeniX
16
votes
You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by …
answered Jan 17 '14 by PhoeniX
1
vote
From analysis of the following report on malwr.com, it looks like the malware has crashed on there system, which could indicate that it also has crashed at yours. Regarding GetTickCount API, you sho …
answered Aug 18 '13 by PhoeniX