Activity Stream

Filter
Sort By Time Show
Recent Recent Popular Popular Anytime Anytime Last 24 Hours Last 24 Hours Last 7 Days Last 7 Days Last 30 Days Last 30 Days All All Photos Photos Forum Forums Articles Articles Blog Blogs
  • WaxfordSqueers's Avatar
    July 11th, 2020, 19:27
    The book to which I linked on rootkits seems to be getting into the same idea. From what I gathered by skimming it, they use the TEB to hide their...
    5 replies | 90 view(s)
  • Kayaker's Avatar
    July 11th, 2020, 16:32
    That was my conclusion too. This is the only place I found a specific mention of the purpose of TlsLinks ...
    5 replies | 90 view(s)
  • WaxfordSqueers's Avatar
    July 11th, 2020, 16:10
    Kayaker...probably not much help but maybe a light will go on for you. Is TlsLinks possibly an entry into a linked list? They have two TEB...
    5 replies | 90 view(s)
  • WaxfordSqueers's Avatar
    July 11th, 2020, 15:06
    You're not alone, even Geoff Chappel doesn't know. https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/teb/index.htm "The...
    5 replies | 90 view(s)
  • Kayaker's Avatar
    July 10th, 2020, 23:44
    Hmm, it's possible TlsLinks is related to the TLS Callback array / IMAGE_TLS_DIRECTORY https://doxygen.reactos.org/dd/d83/ntdllp_8h_source.html...
    5 replies | 90 view(s)
  • Kayaker's Avatar
    July 10th, 2020, 14:39
    I'm trying to find some information on how/when TEB->TlsLinks is made use of. TEB->TlsSlots is used with TlsSetValue and TlsGetValue,...
    5 replies | 90 view(s)
  • Kayaker's Avatar
    July 2nd, 2020, 09:06
    Kayaker replied to a thread Don Wooma in Off Topic
    Heh heh. Hi wbe, it's nice to see some old names resurfacing here. There must be a proverb or something for that. "Old Reversers never die,...
    1 replies | 93 view(s)
  • wbe's Avatar
    July 1st, 2020, 11:16
    wbe started a thread Don Wooma in Off Topic
    Just to let you know: I'm still alive.:cool:
    1 replies | 93 view(s)
  • esther's Avatar
    June 30th, 2020, 16:04
    hi, if you have procdump,it still works in win10 32 bit for dumping upx.
    32 replies | 1469 view(s)
  • Kayaker's Avatar
    June 25th, 2020, 18:45
    Kayaker replied to a thread Windbg Syntax in General Reversing
    Well, after hours mucking around with Windbg scripting I came up with this monstrosity that worked to extract the function name. I wasn't able to...
    4 replies | 241 view(s)
  • blabberer's Avatar
    June 24th, 2020, 07:07
    blabberer replied to a thread Windbg Syntax in General Reversing
    I understand you want to use dx but for the last example you posted where you escape quotes etc you don't need the dx at all in fact you...
    4 replies | 241 view(s)
  • esther's Avatar
    June 23rd, 2020, 22:30
    esther replied to a thread real DOS in Off Topic
    someone created a 64 bit program NTVDMx64 by Leecher1337,it's not a microsoft program,dunno if it works in 64 windows,I didn't tried coz I don't have...
    1 replies | 208 view(s)
  • Kayaker's Avatar
    June 22nd, 2020, 16:26
    Kayaker replied to a thread Windbg Syntax in General Reversing
    Thanks Blabberer, that's some good useful info. Unfortunately there's a bit of weird behaviour to deal with. If I step or break on a Call...
    4 replies | 241 view(s)
  • blabberer's Avatar
    June 22nd, 2020, 09:53
    blabberer replied to a thread Windbg Syntax in General Reversing
    windbg provides two Pseudo Register ea and ea2 that corresponds to effective address 1 and effective address 2 if you have broken on some rip...
    4 replies | 241 view(s)
  • Kayaker's Avatar
    June 21st, 2020, 16:53
    I've been trying to make use of the Windbg 'dx' command and some of the fancy Natvis/LINQ stuff. There are a couple of recent examples of the types...
    4 replies | 241 view(s)
  • esther's Avatar
    June 19th, 2020, 02:30
    esther replied to a thread waves in Off Topic
    lol,my "knowledge" has given back to the rce cd archive :devil: Nice to see you,Kayaker :)
    2 replies | 232 view(s)
  • Kayaker's Avatar
    June 17th, 2020, 12:44
    Kayaker replied to a thread waves in Off Topic
    Greetz esther, nice to see old faces. Feel free to stop by and flame or teach anytime ;)
    2 replies | 232 view(s)
  • esther's Avatar
    June 17th, 2020, 02:22
    esther started a thread waves in Off Topic
    Hi guys, ltns,just passed by to say hello :)
    2 replies | 232 view(s)
No More Results