From Collaborative RCE Tool Library
Dream of every reverser
| Tool name: | Dream of every reverser |
|
||
|---|---|---|---|---|
| Author: | deroko of ARTeam | |||
| Website: | http://deroko.phearless.org | |||
| Current version: | public | |||
| Last updated: | May 6, 2007 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Engine used to perfrom stealth memory trace of a target. Public version only supports tracing of the eip in certain range. To compile source you will need DDK. It supports MP and win2k/winxp. Systems running KAV are not supported as KAV installs hook in SwapContext which is essential for this tracer. Technical aspects: 1. Hooks int 0e and int 01 2. Hooks SwapContext 3. Installs ProcessNotifyRoutine Due to the nature of paged memory in r3, there are 2 ways of tracing: using U/S flag, and using P bit in PTE. Both cases are handled and supports PAE and nonPAE addressing modes. Role of SwapContext is to set breaks on given range when traced process is about to execute. Role of notify routine is to stop tracer if traced program exits by any chance during tracing. When good range is hit, tracer will automaticaly stop and you will see in DebugView or DbgMon when EIP is in good range. |
|||
| Related URLs: | No related URLs have been submitted for this tool yet | |||
| Screenshot: |
|---|
 |
Feed containing all updates for this tool.
(please also edit it if you think it fits well in some additional category, since this can also be controlled)
You are welcome to add your own useful notes about this tool, for others to see!