New answers tagged

0

An alternative to CaptureBAT o win10 is FakeNet-NG https://github.com/fireeye/flare-fakenet-ng


0

Alternatively, you can use Microsoft Network Monitor tool to filter the traffic of a specific process. Archive Download Link: https://www.microsoft.com/en-us/download/details.aspx?id=4865 EDIT: Figured out the problem with CaptureBAT, most likely because of it being 32 bit, while win10 is 64 bit.


0

What you are observing is the effect of ASLR. You should focus on the instructions which access this memory location. To put simply: on x86, you will find some .reloc entries pointing to these instructions; on x64, the memory operand is RIP related (this is hidden in IDA by default). Since you tagged ollydbg, I'm guessing this is for x86, and the 'bad' ...


Top 50 recent answers are included