Map and projects (the most frequently updated page of this blog)

2011/04/01

Mireille est une star au fin fond du Tibet

@ 18:35 tags , , ,
Here are a few things that I released recently but didn't get a regular blog post, just a twitter entry:
  • Usermode test(v0.1): a usermode opcode tester, covering most opcodes, including rare, obsolete, recent, undocumented, 64 bits, exception triggers, anti-debugs.... (gathering and extending the result of my previous blog entries and programs)
  • Following Peter Ferrie's article, I wrote a commented source of JJencode, the funny javascript obfuscator, along with a dumb decryption script.
  • I extended y0da's binary corpus, with various compiled files and my own experimental PEs, to build my own binary corpus. It covers a lot of different compilers, sections layout, image directories,...
  • I created a simple screencast to introduce tracing with OllyDbg, based on Oleh's tutorial.

4 comments:

  1. Anonymous2/4/11 13:16

    Great collection of PE files! Can't wait to test them on my own tools :)

    bw

    ReplyDelete
  2. Ange Albertini2/4/11 17:32

    Good ! I hope they'll be useful !

    ReplyDelete
  3. Peter Ferrie3/4/11 16:29

    section count limit was removed in Vista. 64kb-1 sections are now possible. :-(
    There are other tricks that might not be in the corpus, like large headers, odd optional header size, OOB entrypoint, VA entrypoint (not RVA)...
    smallest executable on 64 bit is 268 bytes.

    ReplyDelete
  4. Ange Albertini13/4/11 13:33

    Interesting, I'll have to update the corpus then ;)

    ReplyDelete

Subscribe to: Post Comments (Atom)