<?xml version="1.0" encoding="ISO-8859-1"?>

<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title><![CDATA[RCE Messageboard's Regroupment]]></title>
		<link>http://www.woodmann.com/forum/</link>
		<description>Serious reversing, cracking and programming discussions</description>
		<language>en</language>
		<lastBuildDate>Sun, 08 Nov 2009 02:27:56 GMT</lastBuildDate>
		<generator>vBulletin</generator>
		<ttl>60</ttl>
		<image>
			<url>http://www.woodmann.com/forum/images/misc/rss.jpg</url>
			<title><![CDATA[RCE Messageboard's Regroupment]]></title>
			<link>http://www.woodmann.com/forum/</link>
		</image>
		<item>
			<title>ASM/OllyDBG assistance needed</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13194&amp;goto=newpost</link>
			<pubDate>Sat, 07 Nov 2009 11:34:14 GMT</pubDate>
			<description><![CDATA[I need to execute the following asm code using ollydb on an executable 
 
MOV BYTE PTR DS:[6C4D56],1 
MOV BYTE PTR DS:[6C4D5A],1 
 
MOV BYTE PTR DS:[7151A0],2 
MOV DWORD PTR DS:[7151A2],C4B0DBB8 
MOV DWORD PTR DS:[7151A6],0 
MOV DWORD PTR DS:[7151AC],FCC8ACCE 
MOV DWORD PTR DS:[7151B0],0D8CC]]></description>
			<content:encoded><![CDATA[<div>I need to execute the following asm code using ollydb on an executable<br />
<br />
MOV BYTE PTR DS:[6C4D56],1<br />
MOV BYTE PTR DS:[6C4D5A],1<br />
<br />
MOV BYTE PTR DS:[7151A0],2<br />
MOV DWORD PTR DS:[7151A2],C4B0DBB8<br />
MOV DWORD PTR DS:[7151A6],0<br />
MOV DWORD PTR DS:[7151AC],FCC8ACCE<br />
MOV DWORD PTR DS:[7151B0],0D8CC<br />
<br />
Can anyone tell me what to do with this lines of code?<br />
Screenshot guidance would be much appreciated</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=16">The Newbie Forum</category>
			<dc:creator>openwdb</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13194</guid>
		</item>
		<item>
			<title>debug boot loader in bosch</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13191&amp;goto=newpost</link>
			<pubDate>Fri, 06 Nov 2009 02:50:30 GMT</pubDate>
			<description><![CDATA[i've read Ilfak's post about same topic. actually, i am in same need, that is to debug a certain boot loader. i tried to debug it with boschdbg.exe, and setting the image etc... but in the debugger screen, i keep trying to do p(roceed) command until it load, but i cannot really pinpoint where the...]]></description>
			<content:encoded><![CDATA[<div>i've read Ilfak's post about same topic. actually, i am in same need, that is to debug a certain boot loader. i tried to debug it with boschdbg.exe, and setting the image etc... but in the debugger screen, i keep trying to do p(roceed) command until it load, but i cannot really pinpoint where the boot code starts.<br />
anyone knows how to get to the start of boot code in bosch?<br />
<br />
thank you</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=6">Off Topic</category>
			<dc:creator>dion</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13191</guid>
		</item>
		<item>
			<title>modifying code in memory</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13190&amp;goto=newpost</link>
			<pubDate>Thu, 05 Nov 2009 23:32:13 GMT</pubDate>
			<description><![CDATA[I'm trying to modify code that has already been loaded into memory. I was hoping to open a crackme so that it is loaded into memeory. Then run a program to patch the crackme in memory. First, I can't seem to open the crackme then open it using the patching program. I don't know if I have the wrong...]]></description>
			<content:encoded><![CDATA[<div>I'm trying to modify code that has already been loaded into memory. I was hoping to open a crackme so that it is loaded into memeory. Then run a program to patch the crackme in memory. First, I can't seem to open the crackme then open it using the patching program. I don't know if I have the wrong attributes for the CreateFile and MapViewoFile apis. Also, can I just write directly to the memory, or do I need to use a specific api to write to memory like with writing to a file? <br />
<br />
below is the code I wrote<br />
<br />
This is the DlgProc function<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">invoke CreateFile, addr TargetName,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; GENERIC_READ+GENERIC_WRITE,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; FILE_SHARE_READ+FILE_SHARE_WRITE,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NULL,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OPEN_EXISTING,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; FILE_ATTRIBUTE_NORMAL,\<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NULL<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .if eax!=INVALID_HANDLE_VALUE<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov hTarget, eax<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call Search<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .endif</code><hr />
</div>This is the Function that searches and tries to write to the memory to patch the crackme<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">Search proc<br />
Local ReturnValue :DWORD<br />
mov ReturnValue, 0<br />
invoke GetFileSize, hTarget, NULL<br />
mov FileSize,eax<br />
invoke CreateFileMapping, hTarget, NULL, PAGE_READWRITE, 0,0,NULL<br />
mov hTargetMap, eax<br />
invoke MapViewOfFile, hTargetMap, FILE_MAP_WRITE,0,0,0<br />
mov pTargetMap,eax<br />
mov edi, pTargetMap<br />
mov esi, offset Sequence<br />
mov ecx, FileSize<br />
mov al, byte ptr [Sequence]<br />
dec edi<br />
@@: <br />
inc edi<br />
dec ecx<br />
cmp byte ptr[edi],al<br />
jne @b<br />
cmp ecx, 0<br />
jz @notfound<br />
push ecx<br />
push edi<br />
push esi<br />
mov ecx, 4<br />
dec esi<br />
dec edi<br />
@a:<br />
inc esi<br />
inc edi<br />
mov bl, byte ptr[esi]<br />
cmp bl,byte ptr[edi]<br />
je @a<br />
cmp ecx, 0<br />
jz @found<br />
pop esi<br />
pop edi<br />
pop ecx<br />
jmp @b<br />
<br />
@found:<br />
dec edi<br />
dec esi<br />
mov byte ptr[edi], 4Ch<br />
pop esi<br />
pop edi<br />
pop ecx<br />
mov eax, FileSize<br />
sub eax, ecx<br />
mov ReturnValue, eax<br />
jmp @return<br />
<br />
@notfound:<br />
mov ReturnValue,0<br />
jmp @return<br />
<br />
@return:<br />
invoke UnmapViewOfFile,pTargetMap<br />
invoke CloseHandle,hTargetMap<br />
mov eax, ReturnValue<br />
Ret<br />
Search EndP<br />
<br />
end start</code><hr />
</div></div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=16">The Newbie Forum</category>
			<dc:creator>Vigual</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13190</guid>
		</item>
		<item>
			<title>REcon2010?</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13189&amp;goto=newpost</link>
			<pubDate>Thu, 05 Nov 2009 19:40:05 GMT</pubDate>
			<description>I know is kind of early to ask this question but my boss keep pushing for an answer.  Is there going to be a REcon 2010?</description>
			<content:encoded><![CDATA[<div>I know is kind of early to ask this question but my boss keep pushing for an answer.  Is there going to be a REcon 2010?</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=6">Off Topic</category>
			<dc:creator>owl</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13189</guid>
		</item>
		<item>
			<title>swf exploit</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13188&amp;goto=newpost</link>
			<pubDate>Wed, 04 Nov 2009 21:31:00 GMT</pubDate>
			<description><![CDATA[I use Sothic SWF Decompiler and i've got this 
 
Code: 
--------- 
package  
{ 
    import flash.display.*; 
    import flash.events.*; 
    import flash.utils.*; 
    import fromFactLooks.*;]]></description>
			<content:encoded><![CDATA[<div>I use Sothic SWF Decompiler and i've got this<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">package <br />
{<br />
&nbsp; &nbsp; import flash.display.*;<br />
&nbsp; &nbsp; import flash.events.*;<br />
&nbsp; &nbsp; import flash.utils.*;<br />
&nbsp; &nbsp; import fromFactLooks.*;<br />
<br />
&nbsp; &nbsp; public class fromFactLooks extends Sprite<br />
&nbsp; &nbsp; {<br />
<br />
&nbsp; &nbsp; &nbsp; &nbsp; public function fromFactLooks()<br />
&nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var readerTypeNot:Loader;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var sArr:* = new Array();<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[0] = &quot;0x72&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[1] = &quot;0x63&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[2] = &quot;0x64&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[3] = &quot;0x3e&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[4] = &quot;0xc1&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[5] = &quot;0xf7&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[6] = &quot;0x64&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[7] = &quot;0x62&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[8] = &quot;0x48&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[9] = &quot;0xed&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[10] = &quot;0xdc&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[11] = &quot;0x49&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[12] = &quot;0x3e&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[13] = &quot;0x4b&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[14] = &quot;0x2f&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[15] = &quot;0xef&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[16] = &quot;0x47&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sArr[17] = &quot;0xd2&quot;;<br />
&nbsp; &nbsp; &nbsp; &nbsp;  <br />
<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  .........................................<br />
<br />
<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var itsPieceNot:* = new ByteArray();<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var oneNormalThe:Number;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var alsoThePiece:String;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var i:Number;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while (i &lt; sArr.length)<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var _loc_2:* = alsoThePiece;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; oneNormalThe = oneNormalThe++;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; itsPieceNot[i] = sArr[i] ^ _loc_2.alsoThePiece[&quot;charCodeAt&quot;](oneNormalThe);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (oneNormalThe &gt;= alsoThePiece.length)<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; oneNormalThe;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; i = i++;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; readerTypeNot = new Loader();<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; addChild(readerTypeNot);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var _loc_2:* = readerTypeNot[&quot;loaderInfo&quot;];<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _loc_2.readerTypeNot[&quot;loaderInfo&quot;][&quot;addEventListener&quot;](Event.COMPLETE, function (event:Event) : void<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; upUseEver(event, readerTypeNot);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }// end function<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; );<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var _loc_2:* = readerTypeNot;<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _loc_2.readerTypeNot[&quot;loadBytes&quot;](itsPieceNot);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; catch (e:Error)<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; trace(e);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;<br />
&nbsp; &nbsp; &nbsp; &nbsp; }// end function<br />
<br />
&nbsp; &nbsp; &nbsp; &nbsp; private function upUseEver(event:Event, C:\Documents and Settings\Loner\Desktop\new\bilder;;fromFactLooks.as:Loader) : void<br />
&nbsp; &nbsp; &nbsp; &nbsp; {<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; trace(event);<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return;<br />
&nbsp; &nbsp; &nbsp; &nbsp; }// end function<br />
<br />
&nbsp; &nbsp; }<br />
}</code><hr />
</div>How can I get malicious url? What to do next???<br />
<br />
Can anybody help with this ?</div>


	<br />
	<div style="padding:6px">

	

	

	

	
		<fieldset class="fieldset">
			<legend>Attached Files</legend>
			<table cellpadding="0" cellspacing="3" border="0">
			<tr>
	<td><img class="inlineimg" src="http://www.woodmann.com/forum/images/attach/rar.gif" alt="File Type: rar" width="16" height="16" border="0" style="vertical-align:baseline" /></td>
	<td><a href="http://www.woodmann.com/forum/attachment.php?attachmentid=2170&amp;d=1257370070">fromFactLooks.rar</a> (41.0 KB)</td>
</tr>
			</table>
		</fieldset>
	

	</div>
]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=4">Malware Analysis and Unpacking Forum</category>
			<dc:creator>BATMAN</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13188</guid>
		</item>
		<item>
			<title>URLANDEXIT tag in WMV</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13187&amp;goto=newpost</link>
			<pubDate>Wed, 04 Nov 2009 15:03:54 GMT</pubDate>
			<description>fake torrent, URLANDEXIT tag inside WMV file contains 
http//tpbtrack.com/index.php 
which redirects to http//microsoftmedicenter.com/ for dld 
codec_update2.7.exe 
 
kill this WEB_page soon. don W!</description>
			<content:encoded><![CDATA[<div>fake torrent, URLANDEXIT tag inside WMV file contains<br />
http//tpbtrack.com/index.php<br />
which redirects to http//microsoftmedicenter.com/ for dld<br />
codec_update2.7.exe<br />
<br />
kill this WEB_page soon. don W!</div>


	<br />
	<div style="padding:6px">

	

	

	

	
		<fieldset class="fieldset">
			<legend>Attached Files</legend>
			<table cellpadding="0" cellspacing="3" border="0">
			<tr>
	<td><img class="inlineimg" src="http://www.woodmann.com/forum/images/attach/zip.gif" alt="File Type: zip" width="16" height="16" border="0" style="vertical-align:baseline" /></td>
	<td><a href="http://www.woodmann.com/forum/attachment.php?attachmentid=2169&amp;d=1257347108">fake_torr.zip</a> (400.2 KB)</td>
</tr>
			</table>
		</fieldset>
	

	</div>
]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=4">Malware Analysis and Unpacking Forum</category>
			<dc:creator>evaluator</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13187</guid>
		</item>
		<item>
			<title>looking for tuts/books/useful links on RE under linux</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13186&amp;goto=newpost</link>
			<pubDate>Wed, 04 Nov 2009 12:51:08 GMT</pubDate>
			<description><![CDATA[I need comprehensive introduction books/tuts on RE under Linux for referencing while I get stucked by such question,'whats the command to use for dumping the symbol table of one executable'. 
 
So what are your recommendations? 
 
thx in advance.]]></description>
			<content:encoded><![CDATA[<div>I need comprehensive introduction books/tuts on RE under Linux for referencing while I get stucked by such question,'whats the command to use for dumping the symbol table of one executable'.<br />
<br />
So what are your recommendations?<br />
<br />
thx in advance.</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=16">The Newbie Forum</category>
			<dc:creator>jcyang</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13186</guid>
		</item>
		<item>
			<title>Can you identify this dongle maker?</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13184&amp;goto=newpost</link>
			<pubDate>Wed, 04 Nov 2009 05:16:06 GMT</pubDate>
			<description><![CDATA[I have a dongle I am trying to emulate, and I dont know who makes it.  I'm not sure if you can tell just by how it looks, but I'm including a picture just incase. 
 
http://img29.imageshack.us/img29/6384/image124t.jpg 
 
http://img25.imageshack.us/img25/5868/image123ys.jpg]]></description>
			<content:encoded><![CDATA[<div>I have a dongle I am trying to emulate, and I dont know who makes it.  I'm not sure if you can tell just by how it looks, but I'm including a picture just incase.<br />
<br />
<i><u>http://img29.imageshack.us/img29/6384/image124t.jpg</u></i><br />
<br />
<i><u>http://img25.imageshack.us/img25/5868/image123ys.jpg</u></i></div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=16">The Newbie Forum</category>
			<dc:creator>thetered</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13184</guid>
		</item>
		<item>
			<title>problems on fenris installtion</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13183&amp;goto=newpost</link>
			<pubDate>Tue, 03 Nov 2009 14:31:41 GMT</pubDate>
			<description><![CDATA[I am obviously newbie to linux re, after browsing Linux Disaasembler in tools section (http://www.woodmann.com/collaborative/tools/index.php/Category:Linux_Disassemblers),I found fenris attract me. 
 
So I download it and try to make and install it,so the problems  comes, 
[1] try to use 'make...]]></description>
			<content:encoded><![CDATA[<div>I am obviously newbie to linux re, after browsing <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:Linux_Disassemblers" target="_blank">Linux Disaasembler in tools section</a>,I found fenris attract me.<br />
<br />
So I download it and try to make and install it,so the problems  comes,<br />
[1] try to use 'make install', failed with havn't stripped libc binary.<br />
[2] try the two recommend steps of the first failed step,only get 'we need your gdb information'<br />
<br />
could anyone explain what's striping libc?Why do fenris need to strip libc?<br />
And is there anyone who is using fenris now?<br />
<br />
thanks.</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=3">Tools of our Trade (TOT) Messageboard</category>
			<dc:creator>jcyang</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13183</guid>
		</item>
		<item>
			<title>Processor Module absolute address problems</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13182&amp;goto=newpost</link>
			<pubDate>Tue, 03 Nov 2009 03:13:08 GMT</pubDate>
			<description><![CDATA[Hello,   
 
  I'm having a bit of an issue trying to get specific results from IDA's kernel. 
Have been fumbling around with an 8bit MCU and am trying my hand at writing a custom proc module.   things are working out so far but i'm having issues with printing labels vs. addr 
 
Expected Output in...]]></description>
			<content:encoded><![CDATA[<div>Hello,  <br />
<br />
  I'm having a bit of an issue trying to get specific results from IDA's kernel.<br />
Have been fumbling around with an 8bit MCU and am trying my hand at writing a custom proc module.   things are working out so far but i'm having issues with printing labels vs. addr<br />
<br />
Expected Output in IDA<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">ROM:BAB2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jsr&nbsp; &nbsp;  LOC_B5DE<br />
ROM:BAB8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jsr&nbsp; &nbsp;  LOC_D3BA</code><hr />
</div>but i'm getting absolute addresses instead labels.  i am struggling trying to understand why it isn't working correctly.  the book i'm following doesn't touch on using labels so I'm hoping someone here could point me in the right direction.</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=3">Tools of our Trade (TOT) Messageboard</category>
			<dc:creator>hwnd</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13182</guid>
		</item>
		<item>
			<title>Unexported SSDT functions finding method</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13181&amp;goto=newpost</link>
			<pubDate>Mon, 02 Nov 2009 22:29:18 GMT</pubDate>
			<description>Today, I would like to write about finding the addresses of non-exported kernel functions (syscall handlers) from user mode. The technique I am going to write about is my very own idea, that occured to me during one of my talks regarding Windows x86 kernel exploitation (greetings to suN8Hclf...</description>
			<content:encoded><![CDATA[<div>Today, I would like to write about finding the addresses of non-exported kernel functions (<i>syscall handlers</i>) from user mode. The technique I am going to write about is my very own idea, that occured to me during one of my talks regarding Windows x86 kernel exploitation (greetings to <i><u>suN8Hclf</u></i>!). Despite this, I cannot guarantee that it hasn't been invented and described by some independent authors a few months/years ago. If some of you - the readers - is aware of a similar publication, please let me know (I will surely publish some supplementary material to this post). Let's get to the point...<br />
<br />
The subject of practical vulnerability exploitation of the system kernel or one of its modules is simply too wide to entirely talk it over here. The technical aspects of making use of such vulnerabilities have already been described by a number of researchers, and the results of their work can be found, inter alia, there:<ul><li> <i><u>Kernel-mode Payloads on Windows</u></i></li>
<li> <i><u>Remote Windows Kernel Exploitation - Step into the Ring 0</u></i></li>
<li> <i><u>How to exploit Windows kernel memory pool</u></i></li>
</ul>A basic problem, usually encountered by a newbie reverser lurking in kernel-mode bugs, is how to take advantage of them in practice. When the vuln eventually makes it possible for you to execute your own code in the kernel context and create a relatively stable environment, the question is - what now? In reality, every single functionality we would like to implement, requires some external kernel functions to be used. In 99% cases, the module being imported from is simply <b><i>NTOSKRNL.EXE</i></b> (or any other kind of the kernel executable image). Many methods of finding its base address are available (i.e. <i><u>Finding <i>NTOSKRNL.EXE</i> Base Address</u></i> @ Uninformed), that are mostly suitable for our purposes - hence I will not cover this subject today.<br />
<br />
The next step towards creating a fully functional payload is obtaining the virtual addresses of specific functions we want to use. In the simpliest scenario, where we are only about to operate on exported functions, all we need is an easy way of parsing the internal Portable Executable structures, which can be implemented in &quot;a few&quot; lines, in fact. A very common enhancement is introducing a hash routine, used to convert long symbol names into short 16-32 bit values (as representative as the names themselves). The hashing algorithm doesn't have to be complex at all - one simple bit operation like shifting is fairly enough for our purposes:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">; ASSUMPTIONS: ESI = string to hash (input)<br />
; EAX = return value (output)<br />
;<br />
GenerateNameHash:<br />
&nbsp; xor eax, eax ; Zero out the EAX (hash) value<br />
<br />
@HashLoop:<br />
&nbsp; rol eax, 13 ; Rotate left by one<br />
&nbsp; xor al, byte [esi] ; Xor with the current char<br />
<br />
&nbsp; inc esi ; Increment pointer<br />
&nbsp; cmp byte [esi], 0 ; Check if NULL<br />
&nbsp; jnz @HashLoop ; If not, carry on<br />
&nbsp; ret ; EAX is already set, we have nothing to do - return</code><hr />
</div>In most cases, we don't even require more than the less-significant 16 bit part of the function's result, therefore a great memory saving can be noted here. Whether such an optimization is necessary depends on the type of the vulnerability we're dealing with, however we usually want to reduce the payload size to absolute minimum. All in all, what we are considering now is just getting access to publicly available addresses of the kernel image, which is not very hard to achieve. In my opinion, a much more interesting subject for a potential research would be searching for internal functions, not exported by the kernel in any way. In this case, we are forced to use harder techniques, based mostly on the particular operating system versions etc. Despite the fact that there aren't too many universal problem solutions, some specific situations exist, in which we are able to get the address of a given internal function, under some special conditions.<br />
<br />
In this particular case, the aforementioned conditions means functions belonging to <b>SSDT</b> (<i>System Service Descriptor Table</i>) - a simple array, containing pointers to functions responsible for handling various kinds of system calls triggered by user's applications. Most of the syscall handlers are not directly exported by the kernel, though they turn out to be very useful when creating some advanced ring-0 payload. Furthermore, what should be noted, is that obtaining the address of an SSDT function is a trivial task from a driver's level, provided we know the system call's ID. In such case, the only &quot;problem&quot; is the way of retrieving the system version, in order to match a corresponding function number.<br />
<br />
The same task is yet not so easy in user mode - here, the only solutions known by me are based on heuristic ideas, hence they cannot be considered 100% reliable regardless of the Windows version. What you can see below is a list of respective stages performed by an exemplary application, illustrating the method I am writing about<b></b>:<ul><li> Loading the kernel image into our process context - because of the fact that the <i>NTOSKRNL.EXE</i> file contents will be extensively used in the near future, we have to load it to the user-mode part of the process address space. Doing so makes it possible for us to refer &quot;local&quot; addresses of the exported functions in an easy and clean manner, thus lets us calculate the offset of any address, against the real kernel ImageBase. Since we are not treating the loaded image us a typical DLL library, we must ensure than no undesired operations are performed (such as calling the executable's EntryPoint as if it was regular DllMain), but loading the file contents to memory. Thanks to the extended <i><u>LoadLibraryEx</u></i> functionality, we can use the <b>DONT_RESLOVE_DLL_REFERENCES</b> flag and avoid any unwanted side effects, as described:<br />
<br />
If this value is used, and the executable module is a DLL, the system does not call DllMain for process and thread initialization and termination. Also, the system does not load additional executable modules that are referenced by the specified module.</li>
</ul><ul><li> Choosing one, specific function that can be easily found inside SSDT, as well as on the kernel export list, i.e. <i>NtCreateFile</i>, <i>NtCreateEvent</i>, <i>NtConnectPort</i>, <i>NtClose</i>. This function is considerably important for us, since we know its exact address in the kernel-side memory (based on the real and &quot;temporary&quot; kernel ImageBase addresses), and we are able to designate addresses of any other SSDT function, providing we know its SyscallId value (can be dynamically obtained).</li>
</ul><ul><li> Retrieving the <i>ImageBase</i> and <i>ImageSize</i> values of the loaded image, which can be done using one of the Process Status API function, that is - <i><u>GetModuleInformation.</u></i></li>
</ul><ul><li> Getting the real system kernel address, required to point out the place of every function we are interested in. In this case, two functions seem especially useful - <i><u>EnumDeviceDrivers</u></i> and <i><u>GetDeviceDriverBaseName</u></i> (PSAPI). Using them, we can list and filter all the active kernel modules, including the kernel itself. The following piece of code aims to illustrate how the real ImageBase value is being queried:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">DWORD GetDriverBaseAddr(const char* BaseName)<br />
{<br />
&nbsp; static LPVOID BaseAddresses[4096]; // XXX: let's assume there are at most 4096 active device drivers<br />
<br />
&nbsp; DWORD cbNeeded;<br />
<br />
<br />
&nbsp; /* Get a list of all the drivers' Image Base Addresses */<br />
<br />
&nbsp; if(!EnumDeviceDrivers(BaseAddresses,sizeof(BaseAddresses),&amp;cbNeeded)) return 0;<br />
&nbsp; CHAR FileName[MAX_PATH];<br />
<br />
&nbsp; /* Go thru the entire list */<br />
&nbsp; for( int i=0;i&lt;(int)(cbNeeded/sizeof(LPVOID));i++ )<br />
&nbsp; {<br />
&nbsp; &nbsp; /* For each image base, retrieve the driver's name */<br />
&nbsp; &nbsp; GetDeviceDriverBaseNameA(BaseAddresses[i],FileName,sizeof(FileName));<br />
<br />
&nbsp; &nbsp; /* In case of the current module being kernel, return its base */<br />
&nbsp; &nbsp; if(!_stricmp(FileName,BaseName)) return (DWORD)BaseAddresses[i];<br />
&nbsp; }<br />
<br />
&nbsp; /* Should never get here */<br />
&nbsp; return 0;<br />
}</code><hr />
</div></li>
</ul><ul><li> Scanning the memory of the already-loaded kernel image (user-mode) in search of the chosen function's address (it is NtCreateFile for us). It is first - and the only - phase of the algorithm, presenting a heuristic approach. Its task is to find a place inside SSDT, where the exported function's pointer is stored. This technique could possibly lead to false positives under certain conditions (when finding more than one matching signature), hence it is strongly advices to introduce some additional conditions to check. As we know that the only satisfying result is a place inside SSDT, we can assume that the adjacent values should also point inside the <i>NTOSKRNL.EXE</i> memory range. As it turns out, the above conditions are quite enough to reduce the false positives' number to zero (on every Windows versions tested by me). Here's the code, performing the described memory scanning:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">for( PUCHAR i=(PUCHAR)KernelImageStart;i&lt;(PUCHAR)KernelImageEnd-sizeof(DWORD);i++ )<br />
{<br />
&nbsp; if(( *(DWORD*)(i+0) == SearchedFunctions[0].Address ) &amp;&amp;<br />
&nbsp; ( *(DWORD*)(i-4) &gt;= OrgKernelStart &amp;&amp; *(DWORD*)(i-4) &lt;= OrgKernelEnd ) &amp;&amp;<br />
&nbsp; ( *(DWORD*)(i+4) &gt;= OrgKernelStart &amp;&amp; *(DWORD*)(i+4) &lt;= OrgKernelEnd ) )<br />
&nbsp; {<br />
<br />
&nbsp; &nbsp; printf(&quot;[+] Function pointer found at [0x%.8x]\n&quot;,(UINT)i);<br />
&nbsp; &nbsp; SearchedFunctions[0].SsdtAddress = (DWORD)i;<br />
&nbsp; &nbsp; break;<br />
&nbsp; }<br />
}</code><hr />
</div></li>
</ul><ul><li> Reading the system call ID numbers of the functions of interest. There is a very easy and reliable way of reading the system call number for any NTDLL wrapper, without any need to check the operating system version, or (what's even worse), defining some static SyscallIds in the source. What we are taking advantage of is a specific build of the routines passing execution to kernel, which can be observed in the 2 following examples:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">.text:7C90D090 ; __stdcall NtCreateFile(x, x, x, x, x, x, x, x, x, x, x)<br />
.text:7C90D090 _NtCreateFile@44 proc near<br />
.text:7C90D090<br />
.text:7C90D090 B8 25 00 00 00 mov eax, 25h<br />
.text:7C90D095 BA 00 03 FE 7F mov edx, 7FFE0300h<br />
.text:7C90D09A FF 12&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call dword ptr [edx]<br />
.text:7C90D09C C2 2C 00&nbsp; &nbsp; &nbsp;  retn 2Ch</code><hr />
</div>and <br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">.text:7C90D580 ; __stdcall NtOpenFile(x, x, x, x, x, x)<br />
.text:7C90D580 _NtOpenFile@24 proc near<br />
.text:7C90D580<br />
.text:7C90D580 B8 74 00 00 00 mov eax, 74h<br />
.text:7C90D585 BA 00 03 FE 7F mov edx, 7FFE0300h<br />
.text:7C90D58A FF 12&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call dword ptr [edx]<br />
.text:7C90D58C C2 18 00&nbsp; &nbsp; &nbsp;  retn 18h</code><hr />
</div>As presented, we are able to obtain the syscall number by reading the 32-bit instruction operand from the [FunctionAddress+1] address. This is strongly related to the fact, that the first NTDLL wrapper function instruction is always<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">mov eax, SYSCALL_ID</code><hr />
</div>where SYSCALL_ID is a complete, 32-bit number.<br />
In our case, the code responsible for retrieving the number of respective functions could look like this:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">/* Get the SyscallId values for each function from the user-mode (ntdll.dll) code<br />
*/<br />
for( ULONG i=0;SearchedFunctions[i].FunctionName;i++ )<br />
{<br />
&nbsp; HMODULE hNtdll = GetModuleHandle(&quot;ntdll.dll&quot;);<br />
&nbsp; FARPROC pFunc = GetProcAddress(hNtdll,SearchedFunctions[i].FunctionName);<br />
&nbsp; /* Ignore invalid entries<br />
&nbsp;  */<br />
&nbsp; if(pFunc==NULL)<br />
&nbsp; &nbsp; continue;<br />
<br />
&nbsp; SearchedFunctions[i].SyscallId = *(DWORD*)(((DWORD)pFunc)+1);<br />
}</code><hr />
</div></li>
</ul><ul><li> Recalculating the SSDT functions' addresses by performing the following steps:<br />
<ul><li> Getting a pointer value from the address:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">(BaseFunction.Address + (BaseFunction.SyscallId - CurrentFunction.SyscallId)*sizeof(PVOID))</code><hr />
</div>this is, the address constructed by moving the base routine address (NtCreateFile) back or forward, depending on the search function's number.<br />
</li>
</ul><ul><li> Converting the pointer to kernel-memory address:<br />
<br />
<div style="margin:20px; margin-top:5px">
	<div class="smallfont" style="margin-bottom:2px">Code:</div>
	<hr /><code style="margin:0px" dir="ltr" style="text-align:left">CurrentFunction.KernelAddress = CurrentFunction.Address - LocalKernelImageBase + RealKernelImageBase</code><hr />
</div></li>
</ul></li>
</ul><br />
By performing the above steps, we can obtain the address of any system call handling function, on the condition that we have its user-mode correspondent exported by ntdll.dll (it is not necessary if we decide to use constant SyscallId numbers). What should be noticed is that the described method only enables us to get some kernel functions' addresses - we are still forbidden to read or modify the memory pointed by these addresses. Because of this, the technique itself is not useful in the context of i.e. SSDT table contents validation check. However, it makes it lot easier for us to calculate and integrate the addresses with our shellcode yet before the exploitation process, which in turn improves the exploit writing comfort.<br />
<br />
Some source code illustrating, how the described technique works, is available <b><i><u>here</u></i> (3kB).</b><br />
<br />
Have fun &amp;&amp; leave some comments! ;)<br />
<br />
<i><u>http://j00ru.vexillium.org/?p=222&amp;lang=en</u></i></div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=46">Blogs Forum</category>
			<dc:creator>j00ru vx tech blog</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13181</guid>
		</item>
		<item>
			<title>Opening .Net Application Error</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13180&amp;goto=newpost</link>
			<pubDate>Sun, 01 Nov 2009 23:47:56 GMT</pubDate>
			<description>Im getting this error when im trying to open a basic .net application. 
 
 
Image: http://i33.tinypic.com/2vkzrb9.jpg  
 
 
My System 
 
*  Vista 64bit Home Pre</description>
			<content:encoded><![CDATA[<div>Im getting this error when im trying to open a basic .net application.<br />
<br />
<br />
<img src="http://i33.tinypic.com/2vkzrb9.jpg" border="0" alt="" /><br />
<br />
<br />
My System<br />
<ul><li> Vista 64bit Home Pre</li>
</ul></div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=37">OllyDbg Support Forums</category>
			<dc:creator>Noobers</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13180</guid>
		</item>
		<item>
			<title>Visual Dialog Script V6.0</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13179&amp;goto=newpost</link>
			<pubDate>Sun, 01 Nov 2009 02:35:51 GMT</pubDate>
			<description>Anyone looked at this before. 
 
Came across a small utility that uses this Visual Dialog Script program. 
Quick look it uses a VDSRUN60.DLL file which has a RunScript inside it. 
Script is stored in the executable in a Resource Text\Script. 
 
Thought there might be a decompiler etc around for it?</description>
			<content:encoded><![CDATA[<div>Anyone looked at this before.<br />
<br />
Came across a small utility that uses this Visual Dialog Script program.<br />
Quick look it uses a VDSRUN60.DLL file which has a RunScript inside it.<br />
Script is stored in the executable in a Resource Text\Script.<br />
<br />
Thought there might be a decompiler etc around for it?</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=16">The Newbie Forum</category>
			<dc:creator>peterg70</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13179</guid>
		</item>
		<item>
			<title>Happy 25th Anniversary Fab.</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13177&amp;goto=newpost</link>
			<pubDate>Sat, 31 Oct 2009 18:24:32 GMT</pubDate>
			<description><![CDATA[On this Hallows&#8217; Eve,  RCE forum member Frank Rizzo celebrates his 25th anniversary as his alter ego known as Fabulous Furlough from The Humble Guys. 
 
Happy 25th Frank.:)]]></description>
			<content:encoded><![CDATA[<div>On this Hallows&#8217; Eve,  RCE forum member Frank Rizzo celebrates his 25th anniversary as his alter ego known as Fabulous Furlough from The Humble Guys.<br />
<br />
Happy 25th Frank.:)</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=6">Off Topic</category>
			<dc:creator>5aLIVE</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13177</guid>
		</item>
		<item>
			<title>inetinfo.exe crash</title>
			<link>http://www.woodmann.com/forum/showthread.php?t=13176&amp;goto=newpost</link>
			<pubDate>Sat, 31 Oct 2009 13:22:41 GMT</pubDate>
			<description><![CDATA[hi every1. i have a question about iis FTP bug that occure when name of path be very long. i use Immunity for find return address . attache inetinfo.exe and run it with f9. but when i want to run exploit from other host nothing happens. 
when i don't attach inetinfo.exe exploit works . 
how can i...]]></description>
			<content:encoded><![CDATA[<div>hi every1. i have a question about iis FTP bug that occure when name of path be very long. i use Immunity for find return address . attache inetinfo.exe and run it with f9. but when i want to run exploit from other host nothing happens.<br />
when i don't attach inetinfo.exe exploit works .<br />
how can i see runtime process of inetinfo.exe?</div>

]]></content:encoded>
			<category domain="http://www.woodmann.com/forum/forumdisplay.php?f=2">Advanced reversing and programming</category>
			<dc:creator>NMI</dc:creator>
			<guid isPermaLink="true">http://www.woodmann.com/forum/showthread.php?t=13176</guid>
		</item>
	</channel>
</rss>
