Hot answers tagged

3

I'm writing this answer under the assumption the OP is within his legal rights to share the binaries. First of, I read up on password protected zip files. Apparently that is not part of the ZIP specification itself but an invention of WinZip. They have documented their format modifications and all details on this page: https://www.winzip.com/win/en/...


3

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.


3

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as kernelmode code. This became quite a common replacement for AVs once SSDT hooking was protected by Microsoft using patch-guard. Additionally, a few security ...


2

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative casing to an existing file). Yep, that's right a trailing dot in a file name is illegal in Win32, but the most frequently used file system (NTFS) has no ...


2

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled this looks like [0x00400560]> s sym.test [0x00400656]> pdf ┌ (fcn) sym.test 11 │ sym.test (); │ ; CALL XREF from main @ 0x400670 │ ...


2

The problem is the way you reference this object with a new pointer. Derived obj = *ptr; This actually creates a new object utilizing the data of the old object. Yay! C++! In line 27 you can see that a new object is generated by calling a constructor. If you have a look at the disassembly, you'll see the vtable is not used for the function call. Hence you ...


1

Easy stupid way: patch the instruction with an invalid one, if the program crashes you know the instruction has been hit


1

i cant understand what your usecase is assuming you have some code like this running and you want to break when some thing is written to some space you can use ba (hardware assisted breakpoint ) code for demo it writes randomly the @ sign in a space of 0x2000 bytes #include <stdio.h> #include <stdlib.h> #include <time.h> char ...


Only top voted, non community-wiki answers of a minimum length are eligible