高機能バイナリトレーサqiraはどのように実装されているのか - るくすの日記 ~ Out_Of_Range ~
1. qiraとは qiraとは世界的なハッカー、George Hotz氏 (ジョージ・ホッツ - Wikipedia) によって開発された高機能バイナリトレーサーであり、qiraという名は（QEMU Interactive Runtime Analyser）の略である。 GitHub - BinaryAnalysisPlatform/qira: QEMU Interactive Runtime Analyser 略語を見れば分かるがuser mode QEMUを使用したバイナリ解析ツールであり、ELFなどの実行形式バイナリを実際に動作させて各命令のレジスタ、メモリへの操作を逐次記録する。 これらの記録はweb UIを通して好きな命令位置にカーソルを移動させるだけで見ることができ、その時のレジスタ、メモリの記録が再現される仕組みになっている。ソフトウェアのデバッグやCTFにおけるバイナリ解
Microsoft - AI、クラウド、生産性向上、コンピューティング、ゲーム、アプリ
すべての Microsoft 製品 Global Microsoft 365 Teams Copilot Windows Surface Xbox セール 法人向け サポート ソフトウェア Windows アプリ AI OneDrive Outlook Skype OneNote Microsoft Teams PC とデバイス Xbox を購入する アクセサリ VR & 複合現実 エンタメ Xbox Game Pass Ultimate Xbox とゲーム PC ゲーム Windows ゲーム 映画とテレビ番組 法人向け Microsoft Cloud Microsoft Security Azure Dynamics 365 一般法人向け Microsoft 365 Microsoft Industry Microsoft Power Platform Windows 365 開発者
Using the Immunity Debugger API to Automate Analysis
Intelligence Center Intelligence Search Email & Spam Trends Vulnerability Research Vulnerability Reports Microsoft Advisories Incident Response Talos IR Capabilities Emergency Support Security Resources Open Source Security Tools Intelligence Categories Reference Secure Endpoint Naming Reference Media Talos Intelligence Blog Threat Source Newsletter Beers with Talos Podcast Talos Takes Podcast Tal
IDA Dalvik debugger: tips and tricks – Hex Rays
The latest publicly available build of IDA, the processor and plugin SDK including the source code of 30+ processor modules and 20+ loaders. One full year of free downloadable updates. One full year of e-mail technical support. One of the new features of IDA 6.6 is the Dalvik debugger, which allows us to debug Dalvik binaries on the bytecode level. Let us see how it can help when analysing Dalvik
ID/IDAPython scripts extracting PlugX configs - CCI
I release Immunity Debugger and IDAPython scirpts dumping PlugX configs (and original PEs) then parsing them. IIJ-SECT (CSIRT team at IIJ, Inc.) classifies PlugX samples into 3 types: type I/II/III. In more detail, check our presentation. The Immunity Debugger script can be used for PlugX type I&II. The IDAPython script can parse type III configs. Distinction between Type I&II and III Before using
Good tutorial for WinDbg?
Basic Tutorials & Usage Demos Installing and Configuring WinDbg (Windows Debug Tools) Mike Taulty - A word for WinDbg WinDbg Tutorials Windows Debuggers: Part 1: A WinDbg Tutorial Different Ways to "Start"/Attach WinDbg Start Debugging with WinDbg (includes how to debug an .msi) How to debug a Windows service Setting up Windows Debugging Debugging SQL Server...here, here, here, here Workspaces (Un
Malware Analysis Tutorial 28: Break Max++ Rootkit Hidden Drive Protection
Learning Goals: Practice WinDbg for Intercepting Driver Loading Practice IMM for Modifying Binary Code Trace and Modify Control Flow Using IMM Applicable to: Operating Systems Assembly Language Operating System Security 1. Introduction One typical feature of Max++ is its ability to hide malicious files in a hidden drive. In this tutorial, we show you how to modify the malware itself to break its h
Debuggers Anti-Attaching Techniques - Part 3
In this post i will shed some light on another anti-attach trick. The point here is based on the fact that only one debugger is allowed to debug a specific process. Implementing it is as easy as creating two executables (hereafter, i will refer to them as EXE1 and EXE2). EXE1 spawns and then debugs EXE2. So, any further attempt to debug EXE2 will fail. A demonstrating example can be found here. Th
The trace replayer – Hex Rays
The latest publicly available build of IDA, the processor and plugin SDK including the source code of 30+ processor modules and 20+ loaders. One full year of free downloadable updates. One full year of e-mail technical support. One of the new features that will be available in the next version of IDA is a trace re-player. This pseudo-debugger allows to re-play execution traces of programs debugged
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
The Managed-code Debugging Extension (MEX) is now publicly available for download.
0xd4d/dnSpy: .NET assembly editor, decompiler, and debugger
Dave Aitel on Twitter: "Immunity Debugger 2.0 is coming soon, with 64 bit support. However, we decided everyone should learn AT&T syntax. http://t.co/BYkbxU63Y2"
Develop your master boot record and debug it with IDA Pro and the Bochs debugger plugin – Hex Rays
Google Code Archive - Long-term storage for Google Code Project Hosting.
My presentation at REcon 2012 Montreal
DetachMe, A New OllyDbg Plugin
https://blogs.oracle.com/linux/post/8-gdb-tricks-you-should-know
Malware Analysis Tutorial 13: Tracing DLL Entry Point
Debuggers Anti-Attaching Techniques - Part 1
Malware Analysis Tutorial 12: Debug the Debugger - Fix Module Information and UDD File