Jump to content

dr0p

Dedicated Members
  • Posts

    761
  • Joined

  • Last visited

Posts posted by dr0p

  1. I do that because some machines do not reply to the ICMP reply, but if say a port is open, you get its IP address and MAC address returned in the scan.

    I agree, I always do -PN. Hell, McAffee firewall even blocks responding to ICMP request and it's terrible.

  2. If you are running POS then I assume you are a legitimate business. Phone the supplier and tell them you need a new serial, I'm sure they would be more than grateful to help you.

    This.

    Or if you're bored you can reverse the hell out of it and fix it that way ^-^

  3. Well there are two parts to making a crypter. The first part is meshing your target file(s) with the stub that you have coded. Usually the stub will locate the OEP in the target program(s) and append this this along with the actual exe to the stub, and then encrypt the target. Then, when the program is run, the stub does anti-debug and anti-vm checks, decrypts the target program, and then uses the OEP that it stored along with CreateThread() to start the target going. However, if you're more advanced (and I mean a lot more) you can create a special handler that only decrypts the target in RAM as each piece of memory is needed, and then encrypt it again when it's not in use, but this is much more difficult to code and rarer to see.

  4. @MuNk: I realize that a custom crypter does a muchmuchmuch better job at protecting an EXE but since he asked if changing a variable in the assembly info pane would protect his EXE, I didn't think he was quite up to it, so I offered easy solutions. Imho a segment about how crypters work and how to make a basic one that just does a simple xor routine or something would be simply amazing and an eye opener for a lot of people in this community, but for some reason I just don't see that happening :x

  5. Pretty sure that has nothing to do with blocking reverse engineering. In all actuality, the toughest thing for a reverser to deal with is code virtualization (trust me on this one). Unless you're on a really old/slow machine, or you're doing some crazy math formula, your end user won't really notice that it's being virtualized so you don't have to worry about that. And of course you can always add anti-debug tricks such as IsDebuggerPresent() but those are easily bypassed and don't work nearly as well as code obfuscation / encryption. In the end though, if a reverser has enough time, there is absolutely nothing you can do to stop him or her from achieving his or her own goal.

    Some easy to use options for anti-reversing are EXECryptor, Armadillo, and Themida.

    1. Perl - Easy, cross-platform scripting language. You should probably look into python though as it is a stronger language, I just personally haven't got around to learning it.
    2. C - Most open-source pentesting tools that aren't written in a scripting language are written in C so it's good to know so that you can edit these tools to your needs.
    3. ASM - Yay exploit development and hardcore debugging :3
  6. i am having some issues infecting my vm.... dunno if this is some smart ass thing the worm does, but i have the 'malware.exe' file... wont run. doesnt add anything to anything, no traffic over the wire. I heard it's supposed to be a dll, so i tried that.. already crashed firefox with it (my own doing, not the worm) trying to just use a firefox file deleted and renamed the malware as that dll file :P. so then i just tried the plain ole registering the dll! regsvr32 malware.dll. Wont do that! so now i'm stuck trying to initiate a virus....

    any suggestions?

    btw... everytime I try to change the clock in my vm, it changes back to the origional time?! even unchecked to autoupdate over the wire (which it's sandboxed in anyway).. wtf is up with that?

    Conficker has many anti-debugging tricks built into it, anti-VM is one of those. According to what I've read, it uses Armadillo for it's packing which also has anti-debugging options, so remove the Armadillo protection from it and it should run on your VM without any problems.

  7. A DNS spoof attack would implicitly cause a DoS as well. After the 'error' is displayed, it is still not possible to reach the real site (if this is what you want). A MITM/phishing attack get around this.

    Agreed, MITM would be the best way to go about it.

  8. I not so much judge as get jealous :P

    For instance if some1 younger then me (noticably tho like more then a year) is more knowledgable then me in web design or programmin, i spend some time hating their guts :P then get over it and learn more about what they no to the point where i feel i better them :P

    Prime example: the 15 year old who developed Muziic. I thought of many ways to kill him... then i got over it and continued to write some php :P

    Muziic is a really easy thing to program, I just would have never thought of the idea, and that's what I'm generally envious of. I seriously lack creativity ._.

    Anyways, I try not to judge people based on any aspect that they can't control, but it happens.

  9. Its a waste of time, we need to focus on cleaner ways of producing power like fusion, solar, wind and bio-engineering.

    End of story, if we would figure out better ways of obtaining and re-using energy then we wouldn't have to turn our crap off ever. I did not observe last year and I don't plan on observing this year either.

×
×
  • Create New...