New answers tagged

3

It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.


2

If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction mode they added, which is separate from the functionality of SysInternals Strings. On the other hand, if you do need to extract strings stored more sneakily (...


1

Load your binary into IDA, after completing the initial analysis click on, imports, then press CTRL + F and type sleep, automatically IDA will reference the import (if used), from that you will need to list all cross references with "X", so it will locate the routines used for its sleep function, however taking into account, I do not believe that ...


1

I found a solution and gonna leave it here for future reference. First, you need to calculate the linear address (the one the binary will have in run-time) from the RIP offset of the jump. Let's say the RIP offset is 0x8fe. You add this, and the offset of the instruction itself (offset from start of .text section) plus the instruction size and you get a ...


1

You can parse a header using File > Load file > C header file or create a type library beforehand.


1

If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.


1

All statically linked MFC binaries I've seen always include strings for some internal classes. The naming convention can be found in afximpl.h: #define AFX_WNDCLASS(s) \ _T("Afx") _T(s) _T(_MFC_FILENAME_VER) _STATIC_SUFFIX _UNICODE_SUFFIX _DEBUG_SUFFIX #define AFX_WND AFX_WNDCLASS("Wnd") #define AFX_WNDCONTROLBAR ...


1

It is strange that segments ends in the middle of a function. You could optimize your method, writing script that calculates the desired start and end of combined segments , deleting the relevant segments and then recreating as a combined segment. It is probably better than merging. You have a lot of control over parameters of the segments and it needs to ...


1

The earliest break is sxe ibp break on kd communication if you want to break earlier than that you need to lookup boot debugging you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro


2

CreateRemoteThread takes 7 arguments and the 4th of them is called lpStartAddress. Now, from MSDN docs: lpStartAddress A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more ...


1

Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers: OllyDbg Immunity Debugger IDA Pro/Freeware WinDbg x64dbg It seems Visual Studio is not supported but you can always do it the manual way: Patch an infinite loop (EB FE) at the current EIP/RIP; Detach the current debugger. ...


2

Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.


Top 50 recent answers are included