• Member for 8 years, 9 months
  • Last seen more than 2 years ago
Where to find information about a file format?
10 votes

I like file to determine the type of file from the header magic and Wotsit for standard file formats/documentation/reversed file format structures by other people. was suggested as ...

View answer
How to capture an "in-memory" malware in MS-Windows?
4 votes

MoonSols and Volatility are one option. Another set of options are Redline and Memoryze, both of which are from Mandiant. An added bonus with Memoryze is that memory acquisition is included.

View answer
What are the best practice methods for documenting research into the reverse engineering of a file format?
2 votes

I can't think of anything more "standard" than block diagrams, a pseudo-code implementation, and possibly a reference implementation. Take for example the FIPS standard here or the LUKS standard ...

View answer
Unable to set breakpoints in keygen
1 votes

I'm not sure it's true in your case, but a common anti-keygenning/debugging trick is to compress the parts of code you're going to want to breakpoint and over-write them at runtime. This way if an ...

View answer