Archive for September 25, 2008

IDA Pro Demo Video

Posted: September 25, 2008 in IDA Pro Demo Video, Other Tutorials

IDA Pro Demo Video

Description:  This is a demo video for IDA. The video is an analysis of a dynamic link library on a system compromised by spyware. It goes through and explains how to use some of the key features found in IDA.

Author : Network Solutions Center ( http://ccso.com/ )

Download : http://ccso.com/demo.wmv

Best Regards


Description : The Hex-Rays Decompiler converts executable programs into a human readable C-like pseudo code text.

Author : Network Solutions Center (http://ccso.com/)

Download : http://ccso.com/files/hexraysdemo.swf

Regards

diablo2oo2’s Ollydbg

Posted: September 25, 2008 in RE Tools

diablo2oo2’s Ollydbg

News

[20.09.2008]
Final version of dUP v2.18 is released today.  dUP 2 now can be translated to any language. Check out the forum for more information.

Also there is a new version of my PEID plugin “advanced scan” out.

And last i also updated my custom ollydbg package.

Download diablo2oo2’s Ollydbg

http://diablo2oo2.di.funpic.de/downloads/d2k2.ollydbg.public.rar


ARTeam: IDA plugin to analyze dumped memory regions inside IDA

Hi all,
this is another interesting release from deroko/ARTeam.

A set made of two programs (an IDA plugin and a dumper) useful to analyze dumped memory regions inside IDA. Useful for malware or VMs to analysis of dynamically allocated memory code sections (full sources included)

dump_all/load_all set of tools by deroko ARTeam

dump_all.exe is program which will dump all regions of a certain executable into
specified folder. All dumps are stored as r00000000.dmp where
00000000 is virtual address of a paticilar memory region.
Advice is to create always new folder for these dumped regions, as
load_all will load all of these regions to IDA database. Just to keep
everything organized, and to avoid loading of wrong files, which could
occur under some cicumstances.

load_all.plw is and IDA plugin which will actually load all of these memory regions
into IDA database. Example plugin is compiled with IDA 5.2 SDK, but you
may compile it for other versions too.
Plugin will prompt you for file, so you are free to select any of these
.dmp, and plugin will load all of them into database. This could be useful
when analyzing malware or some protection with many buffers, for better
analyze of a VM, or import protection. This will avoid need to dump regions
manually.

http://arteam.accessroot.com/releases.html

BR,
Shubby


ARTeam: IDA plugin to depack aplib/lzma statically compressed data into IDA

Hi all,
deroko just released a plugin for IDA 5.2 and following, to decompress aplib or lzma packed data in your target when analyzing with IDA.

The plugin supports aPlib which is quite common in malware, but there’s also support for packman lzma compression, even if this one is very rare.

Run plugin by pressing CTRL+9 and you will be prompted with a window for unpacking or simply go to Edit->plugins->aplib depack

Full C sources are included, aswell. See the readme.txt for further details and instructions.

http://arteam.accessroot.com/releases.html

By Shub from ARtEAM