antelox.blogspot.com
RCE Blog: October 2009
http://antelox.blogspot.com/2009_10_01_archive.html
Thursday, October 1, 2009. Win32Hlp for Windows 7 x86 and x64. How many people have noticed, Windows 7 can't read .hlp files natively! A couple of days ago I found WinHlp for Windows 7 x86 and x64, so I decided to share with you ;P. This is the link when u'll download it: WinHlp. See you in the next post. =). Subscribe to: Posts (Atom). Win32Hlp for Windows 7 x86 and x64. View my complete profile. Awesome Inc. template. Powered by Blogger.
insid3codeteam.blogspot.com
Insid3Code Team: [C/C++] From kernel32!Sleep to ntdll!NtDelayExecution
http://insid3codeteam.blogspot.com/2015/05/from-kernel32sleep-to.html
Monday, May 18, 2015. C/C ] From kernel32! Close me to start delay! CALL DWORD PTR DS. PUSH ESI PUSH DWORD PTR SS. CALL DWORD PTR DS. MOV DWORD PTR SS. EAX CMP DWORD PTR SS. Close me to start delay! Http:/ www.mediafire.com/download/afrw4e8lx8zrud4/Sleep.rar. C/C ] Protected Reg Key (Embedded null characters). C/C ] From kernel32! C/C ] From GetModuleHandleW to LdrGetDllHandle. C/C ] Protect handle from close. C/C ] Using RtlAdjustPrivilege to detect debugger. C/C ] Hide my loaded modules.
insid3codeteam.blogspot.com
Insid3Code Team: [C/C++] Using RtlAdjustPrivilege to detect debugger.
http://insid3codeteam.blogspot.com/2015/05/cc-using-rtladjustprivilege-to-detect.html
Friday, May 22, 2015. C/C ] Using RtlAdjustPrivilege to detect debugger. A basic way using RtlAdjustPrivilege. To detect the debugger (OllyDbg and IDA demo 6.6). As usually but not (enabled by default) for all debugger, the Debugger must acquiring debug privilege. To work with its complete capacity. The snippet is simple and probably already used but I write it as simple as possible to get a clear ASM code. Enables or disables a privilege from the calling thread or process. MessageBoxW( NULL, L"Nothing!
insid3codeteam.blogspot.com
Insid3Code Team: [C++/NATIVE] inaccessible folder
http://insid3codeteam.blogspot.com/2016/09/native-inaccessible-folder.html
Friday, September 30, 2016. C /NATIVE] inaccessible folder. Inaccessible folder inspired from "WinMend Folder Hidden" work. Include windows.h #include ntdll.h #ifdef WIN64 char *captionMsg = "64-bit Application"; #else char *captionMsg = "32-bit Application"; #endif char *statusMsg = "FAILED! Define MAIN FOLDER L"? Link: http:/ www.mediafire.com/file/9wwiembfz3vbacn/inaccessible folder.rar. C/C ] Protected Reg Key (Embedded null characters). C/C ] From kernel32! C/C ] Protect handle from close.
insid3codeteam.blogspot.com
Insid3Code Team: [C/C++] Protected Reg Key (Embedded null characters)
http://insid3codeteam.blogspot.com/2015/05/cc-protected-reg-key-embedded-null.html
Monday, May 18, 2015. C/C ] Protected Reg Key (Embedded null characters). Inspired from Mark Russinovich's work - Sysinternals. Create a registry key that contain embedded-null characters. The created registry key become in-accessible using standard registry editing tools. NRun me with Admin privileges.". REGISTRY USER .DEFAULT Targeted Key". REG OPTION NON VOLATILE. REG OPTION NON VOLATILE. Done nTry this key: [HKEY USERS .DEFAULT Targeted Key]". C/C ] Protected Reg Key (Embedded null characters).
insid3codeteam.blogspot.com
Insid3Code Team: Plugins
http://insid3codeteam.blogspot.com/p/plugins.html
BEGIN PGP PUBLIC KEY BLOCK- - -. Version: GnuPG v2.0.17 (MingW32). U8ONbKmmsAS4oVR1h4 ECgfrZ/ 3Xe2k dJqQh3EIbbj1GW7i8Gp7J9M93IjzyHN. END PGP PUBLIC KEY BLOCK- - -. Highlightfish (OD1.10 and ImmDbg Plugin) 1.0. OllyDbg and ImmDbg plugin: Highlightfish FINAL v1.0 build date 18/05/2013. Supported OllyDbg and ImmunityDebugger release: 1.10. Highlightfish will allow you to set coulour and Highlighting. Coded to work with OllyDbg and ImmunityDebugger, one plugin for both debuggers. 18/05/2013 (version 1.0).
insid3codeteam.blogspot.com
Insid3Code Team: [C/C++] From GetModuleHandleW to LdrGetDllHandle
http://insid3codeteam.blogspot.com/2015/05/cc-from-getmodulehandlew-to.html
Monday, May 18, 2015. C/C ] From GetModuleHandleW to LdrGetDllHandle. Kernel32.dll ImageBaseAddress: 0x%p". Call memset add esp. Push eax push offset. Call snwprintf add esp. Case when GetModuleHandleW handle NULL parameter: I observed than if we pass "NULL" as parameter the function doesn't call any other function and retrieve the ImageBaseAddress directly from the information stored in the current PEB (Process Environment Block). Edi push ebp mov ebp. Esp cmp dword ptr. Rewriting the Code snippet:.
insid3codeteam.blogspot.com
Insid3Code Team: VirtualBox Hardened Loader x64 (kernelmode.info)
http://insid3codeteam.blogspot.com/2015/05/virtualbox-hardened-loader-x64.html
Monday, May 18, 2015. VirtualBox Hardened Loader x64 (kernelmode.info). VirtualBox Hardened VM detection mitigation loader x64 from kernelmode.info. Step by step guide for VirtualBox Hardened (4.3.14 ) VM detection mitigation configuring. Http:/ www.kernelmode.info/forum/viewtopic.php? Project comes with full source code. In order to build from source you need: Microsoft Visual Studio 2013 U4 and later versions for loader build. Windows Driver Kit 8.1 U1 and later versions for driver build.
insid3codeteam.blogspot.com
Insid3Code Team: Memory patcher to deal with (ASLR) 02 Updated
http://insid3codeteam.blogspot.com/2015/10/memory-patcher-to-deal-with-aslr-02.html
Tuesday, October 20, 2015. Memory patcher to deal with (ASLR) 02 Updated. Code snippet updated to support Wow64 for 64bit patcher to patch 32bit target. Attached file contains (source and binary (32bit/64bit and Wow64. Link: http:/ www.mediafire.com/download/l81e74mr9nc09he/loader02.rar. C/C ] Protected Reg Key (Embedded null characters). C/C ] From kernel32! C/C ] From GetModuleHandleW to LdrGetDllHandle. C/C ] Protect handle from close. C/C ] Using RtlAdjustPrivilege to detect debugger.
insid3codeteam.blogspot.com
Insid3Code Team: [C/C++] Protect handle from close.
http://insid3codeteam.blogspot.com/2015/05/cc-protect-handle-from-close.html
Monday, May 18, 2015. C/C ] Protect handle from close. Include windows.h #include stdio.h #include ntdll.h int iWinMain() { #ifdef WIN64 LPWSTR captionMsg = L"64-bit Application"; #else LPWSTR captionMsg = L"32-bit Application"; #endif WCHAR mainMsg[MAX PATH] = {0}; HANDLE FileHandle = NULL; UNICODE STRING ObjectName; OBJECT ATTRIBUTES ObjectAttributes; OBJECT HANDLE ATTRIBUTE INFORMATION ObjectHandleAttributeInformation; RtlInitUnicodeString(&ObjectName, L" REGISTRY USER .DEFAULT"); Init...If (NtOpenKey...
