Hot answers tagged

4

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...


1

Nobody is going to publish their source code for active ransomware, there are various reasons for that: Its a business and the author makes money from it, and by giving away the source code there is a competitor. Of course that is not wanted It is possible that someone will find weaknesses, obviously that is possible for binaries aswell but usually it's ...


Only top voted, non community-wiki answers of a minimum length are eligible