Statistics

Members: 1927
News: 293
Web Links: 1
Visitors: 3929313

Who's Online

We have 2 guests online
Damn Vulnerable LinuxDamn Vulnerable Linux (DVL) is a Linux-based (modified Damn Small Linux) tool for IT-Security & IT-Anti- Security and Attack & Defense. [CLICK HERE FOR MORE INFOS! ]

Featured Conference Video

T16-Recon2006-Joe_Stewart-OllyBonE.gif OllyBone - Semi-Automatic Unpacking on IA-32. View the conference video here!
Home arrow Articles - Programming arrow Reverse Code Engineering arrow Reverse Engineering Backdoored Binaries
Reverse Engineering Backdoored Binaries
User Rating: / 0
PoorBest 
Written by ChrisR   
Side Story
Processless Applications ­ Remotethreads on Microsoft Windows 2000, XP and 2003

The shown technique is able to run on all Windows operation systems. In order to avoid virus creation on it's best, this technique is shown for W2K/XP/2K3 only. NT4 systems doesn’t know several of the used API's, also it is possible to rewrite them. Non NT­based systems need other techniques to detect the correct process to inject the code. This essay was created while searching for new software protections to make ''crackers life'' even harder. Based on ''WatchDog theory'' ­ another way to protect applications ­ the idea is to create threads outside the main application which are able to continue workflow also if the main application terminates. This essay will show up a way to display a messagebox from process ''Explorer.Exe'', which is available on all OS. The created application is ''processless'' in that way that the ain application becomes terminated after creating the external thread. The shown source code is in Microsoft Assembler style.

 

Download: pdf
Read More >>



This paper is on reverse engineering backdoored binaries on an x86 Linux Operating System. It is meant for the beginner reverse engineer with some knowledge of ELF, C, x86 ASM, and Linux. We will begin by explaining the basics of our binary from what we can determine by disassembling and then we will recreate the source code for the evil part of our backdoored binary. You will need a few basic tools for this, objdump, elfsh, hexdump, a text editor. . . and your brain.

Download: pdf Reverse Engineering Backdoored Binaries