mrduclaw
  • Member for 8 years, 10 months
  • Last seen more than 1 year ago
How can you reliably unpack a Windows driver manually?
Accepted answer
16 votes

I kind of like your answer about changing the subsystem, especially if you're not a fan of kernel debugging. I'm a big fan of Windbg, though. The way I do this is: Hook up my kernel debugger to a ...

View answer
Determine Encryption Algorithm
Accepted answer
13 votes

Maybe check out this IDA plugin. After you locate the crypto functions, doing a cross-reference in IDA should allow you to see where the functions are called and likely the key is nearby. If you ...

View answer
Are there any tools or scripts for identifying compression algorithms in executables?
9 votes

I'm a big fan of binwalk, but sadly it doesn't help you much on Windows.

View answer
Where can I, as an individual, get malware samples to analyze?
5 votes

I just wanted to add one that I found on reddit, just so it's here: http://www.malshare.com The nice thing about this place is that there is absolutely no sign-up or anything.

View answer
How to see what data is being transmitted when an application calls home?
4 votes

Another option that's pointed out in the comments above by @CallMeV is to use hooking. On Windows you may look at using EasyHook.

View answer
How to investigate function calls across a batch of targets?
4 votes

I wish I had an easy way to help you. When I did something similar previously, I used distorm and pefile. Basically, the approach I took in my code (and it, admittedly, wasn't a great one) was to: ...

View answer
How to manage/revert to specific OS versions for effective patch diffing?
Accepted answer
3 votes

I think there's a couple of approaches to get where you want. Given your scenario where you have the KB patch on your fully updated system. To get back to the previous version, uninstall that patch. ...

View answer