peter ferrie's user avatar
peter ferrie's user avatar
peter ferrie's user avatar
peter ferrie
  • Member for 11 years
  • Last seen more than a month ago
27 votes

Determining if a file is managed code or not

19 votes

What is the purpose of 'mov edi, edi'?

19 votes
Accepted

How can DLL injection be detected?

19 votes
Accepted

INT 2D Anti-Forensic Method

12 votes
Accepted

Strange GDB behavior in OSX

11 votes

Analyzing highly obfuscated JavaScript

11 votes

buffer overflow exploits - Why is the shellcode put before the return address

10 votes
Accepted

in / out instructions - how should I treat this?

9 votes
Accepted

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

8 votes
Accepted

What impact does noninvasive debugging have?

8 votes
Accepted

How do AV vendors create signatures for polymorphic viruses?

8 votes

Hook end/middle of function

8 votes

How can I prevent Immunity Debugger / OllyDbg from breaking on attach?

8 votes
Accepted

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

7 votes

Better explanation of different x86 CALL variations

7 votes
Accepted

What are the differences between metamorphic, oligomorphic and polymorphic malware?

7 votes
Accepted

OllyDbg FPU anti-debug

7 votes
Accepted

Reliable algorithm to extract overlay of a PE

6 votes

Can a Windows process check if it has been injected by another process?

6 votes
Accepted

Modules that exist in a process address space

6 votes
Accepted

Prefix REPNE instruction

5 votes
Accepted

How to backport Vista program to XP without source code?

5 votes
Accepted

Handling INT 2D anti-debugger technique in IDA Pro

5 votes

Is there any simple open source Windows packer?

5 votes

How to force the loading of a DLL in Windows XP at a particular address

5 votes
Accepted

What do the following ARM instructions mean?

5 votes

Why is JMP used with CALL?

5 votes

Reversing Self-Modifying Malware

4 votes
Accepted

Passing a (string) argument via the return address?

4 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?