When writing a virus, size is a primary concern. A bloated virus carrying unnecessary baggage will run slower than its optimised counterpart and eat up more disk space.

Never optimise any code before it works fully, since altering code after optimisation often messes up the optimisation and, in turn, messes up the code. After it works, the focus can shift to optimisation. Always keep a backup of the last working copy of the virus, as optimisation often leads to improperly workin...
Read More >>

In order to recive control a virus can modify an executable in several ways:

• Modifying the entry-point field making it point to the virus code
• Inserting a jump to the virus over the programs code

The first way is easy, but almost every decent antivirus nowadays will mark infected files as suspicious. The reason? A file whose entry-point is outside code section is, at last, suspicious.

Damn Vulnerable Linux (DVL) is a Linux-based (modified Damn Small Linux) tool for IT-Security & IT-Anti-Security and Attack & Defense. It was initiated for training tasks during university lessons by the IITAC (International Institute for Training, Assessment, and Certification) and S²e - Secure Software Engineering in cooperation with the French Reverse Engineering Team. Visit their websites at http://www.iitac.org, http://www.Secure-Software-Engineering.com , and http://www.binary...
Read More >>

The name ASProtect sends shivers the spine to any want to be reverse engineer. Every time a new version comes out, new tricks follow. My target is Notepad.exe and I have packed it with ASProtect 2.22 demo version. This version of ASPR has advanced import protection. Let’s begin to tackle it.

Shellcoding in its most literal sense, means writing code that will return a remote shell when executed. The meaning of shellcode has evolved, it now represents any byte code that will be inserted into an exploit to accomplish a desired task. Yes, you are correct, there are tons of repositories all around the internet for shellcoding. Namely, the metasploit project seems to be the best. Writing an exploit can be difficult, what happens when all of the prewritten blocks of code cease t...
Read More >>

The 64-Bit technology introduces several new and complex tasks for software-developers. Even that the hardware developing industry claims that future software development should take care about the new introduced compiler systems, it is necessary to have a deep inside view on how the new underlying 64-Bit assembly language works. This paper describes what 64-Bit means for future software developments, how 64-Bit influences assembly programming and how to port applications programmed unde...
Read More >>

This issue mainly discuss some popular protection means under Microsoft .Net framework, including strongname, name obfuscation, flow obfuscation, metadata encryption, packing and some anti analysis tricks. With each protection, I will also provide some advice on how to reverse them. This issue is not a newbie tutorial, it targets on those guys who already get some experience in .Net programming and reversing.

In this paper I will try to demystify the commingled relations between the inner working of the behavioral serial checking algorithm in its core with some genetic modifications for better protection against simple reversing attacks. The study will be based on reversing the serial generator algorithm structurally for modified commercial application in conjunction with another KeygenMe victim to a higher level of modeling. Adding some layers of protections: Obfuscation/Encryption, Anti-Debugging...
Read More >>