All Activity 4 You - All ActivityenNeed help to unpack a malware found on my pc please help,uploaded a's a bad copy-paste of Firebird RAT - yet-another-script-kiddie-tool. ‎Nicolas, you don't need to study the code, you need to grow a brain first.Sat, 06 Jun 2020 18:04:51 +0000Need help to unpack a malware found on my pc please help,uploaded a help to unpack a malware found on my pc please help, uploaded a need to study the code. I managed to obfusticate some but I have not the knowledge to complete this. hive_test-original.exeSat, 06 Jun 2020 17:27:18 +0000CrackMe Native - Next version.I don't know how to search for flags, but the comparison is in the address 0040281CSat, 06 Jun 2020 12:06:40 +0000My first crackme(KoiVM)It looks rude on my part, but I sat for hours, and already tried every way to get at least something out of there, but I could not do anything.Sat, 06 Jun 2020 09:27:17 +0000LdrLoadDll/LdrGetProcedureAddressSat, 06 Jun 2020 06:41:16 +0000My first crackme(KoiVM)Maybe these protectors are not used and he just add those classes to fool you... Just an opinion, didn't actually checked.Sat, 06 Jun 2020 06:21:40 +0000My first crackme(KoiVM)what the fornication? You just stuffed every possible obfuscato r and packer in there. These are just packages in a package. Terribly. Stupid and on moronic.Fri, 05 Jun 2020 20:43:28 +0000Example CrackMe - Debug Blocker x64Just fill in the NOP first functions Createprocess and CreateMutex and then replace jne on jmp at 00000001400021B3. crck.exeFri, 05 Jun 2020 19:55:39 +0000Example CrackMe - Debug Blocker x64??????????Fri, 05 Jun 2020 19:47:19 +0000198 Protector V2 By WaduFri, 05 Jun 2020 08:11:59 +0000CrackMeBoiIt's not good i think. Big file size, not encrypted strings or not emulated calls. Only bp true function and get valid serial.Wed, 03 Jun 2020 23:14:28 +0000CrackMeBoiWed, 03 Jun 2020 22:34:09 +0000CrackMeBoi made a custom obfuscator and I haven't made any progress cracking it so please crack the file with my custom .NET obfuscator. Do not use OllyDbg or any software of that kind, you can use Mega Dumper and other tools similar.Wed, 03 Jun 2020 15:50:53 +0000How to access any cisco course for freeWed, 03 Jun 2020 15:48:40 +0000PE Parser [assembly]All good. Wanted to be sure you knew the documentation existed and there are Windows API's to help speed up development. I just realised Portable Executable Format (PE) category in Downloads should have had quite a bit of information on this topic. I have not yet uploaded the files. Will try to do it over the weekend, there will likely be some useful information for you there... Ted.Wed, 03 Jun 2020 14:08:16 +0000NuMega SmartCheck is a run-time debugging tool that addresses the most problematic conditions encountered by Visual Basic developers: Fatal run-time errors that are cryptic and hard-to-solve Problems that result from a sequence of events Incorrect Windows API Usage from Visual Basic Bad values passed to built-in Visual Basic functions Problematic value coercions Errors in components, such as ActiveX controls, used by your program How SmartCheck Works As you run a program (EXE), SmartCheck runs in the background monitoring it continuously, and capturing program events and errors. During program execution, you have the option to disable and enable event reporting at will. This allows you to capture information relevant to testing your program, while eliminating the overhead of unnecessary event reporting. The information captured by SmartCheck can be viewed in a Program Results window, either during or after running a program. You can also save a session’s log file for later review. SmartCheck automatically searches for errors in your program executable as well as the dynamic-link libraries (DLLs), third-party modules, and OLE components used by your program. It can also find errors in programs for which you do not have source code, though we recommend that you have source code with debugging information to maximize error detection and diagnosis. SmartCheck checks all API calls, memory allocations and deallocations, Windows messages, and other significant program events for errors such as: Common memory errors, including memory overruns and memory leaks Resource leaks, including Windows-specific handles Windows-specific errors in Win32APIs, ODBC, DirectX, and COM/OLE APIsWed, 03 Jun 2020 13:55:31 +0000PE Parser [assembly]Hi Ted, Am not trying to reinvent the wheel , I want to apply what I've learned in Goppit's tutorial and to learn more about assembly language . ☺️ Hi Bartosz , nice to see you here As I said before it's all about knowledge , am not interesed in ready PE Parsers ... I've already read Goppit's tutorial why should I read the documentation again ? (masm32/include/ + "win32api.HLP" is all what I need for the moment. GreetzMon, 01 Jun 2020 20:55:21 +0000.NET CrackMe (First Attempt)Nice Challenge send me source for this appMon, 01 Jun 2020 20:26:20 +0000PE Parser [assembly]Read the f******g documentation rightMon, 01 Jun 2020 20:13:21 +0000PE Parser [assembly]It seems like you may be trying to reinvent the wheel. The PE Format is well documented in the Windows Dev Center. You can use Windows API's to map, parse, verify and manipulate PE files... Ted.Mon, 01 Jun 2020 15:28:30 +0000PE Parser [assembly]It's string formated using "wsprintf" so it will display the ascii representation of the first two bytes 4D 5A (am not using it) I performed a check for the MZ signature in this case when it founds 00 01 instead of 4D 5A it will notify the user that the file is not a valid executable. cmp word ptr [edi].e_magic,IMAGE_DOS_SIGNATURE jnz ErrorMon, 01 Jun 2020 14:29:55 +0000PE Parser [assembly]Your assumption is wrong. You're displaying string. So it will display whatever there is till null terminator byte. If You would put there "Hello world" it would display it and it wouldn't matter that Your exe would be invalid.Mon, 01 Jun 2020 14:13:01 +0000PureBasic Adventures - ExtractIconEx RevisitedMon, 01 Jun 2020 00:37:34 +0000PureBasic Adventures - System Up-Time Since BootTimeThis is a repost from the "PureBasic Adventures" blog... Last week I read a blog entry by Raymond Chan regarding the way Task Manager computes the systems up-time and it reminded me of a bug I noticed in AID64's implementation. On Sunday I had a bit of free time before the Manchester United vs Arsenal game kicked off and decided to see what I could come up with. There are a dozen different methods for calculating up-time, some methods are better and some of these do factor in leap years. Raymond's particular blog mentioned the use of GetTickCount API (contradictory to what he implies it does include sleep time), that method seems a little long winded if your end result is to format the result in to; years, month, days, hours, minutes and seconds. I'll show you a simpler way by using NtQuerySystemInformation and taking advantage of Windows API time functions. You can also use this method if you want to compute the time between two different dates such as how old someone is, although Windows Calculator has that covered with it's date calculations. Of course the example code below is in PureBasic, if you have queries regarding the code please comment... Declare UpdateSystemTime(void) If OpenWindow(0, 0, 0, 400, 65, "System Up-Time Since BootTime...", #PB_Window_SystemMenu | #PB_Window_ScreenCentered) TextGadget(1, 10, 10, 95, 20, "System Boot Time :") TextGadget(2, 105, 10, 200, 20, "") TextGadget(3, 10, 35, 50, 20, "UpTime :") TextGadget(4, 60, 35, 400, 20, "") CreateThread(@UpdateSystemTime(), #Null) Repeat MyEvent = WaitWindowEvent() Until MyEvent = #PB_Event_CloseWindow EndIf Procedure UpdateSystemTime(void) #SystemTimeOfDayInformation = 3 #STATUS_SUCCESS = 0 Structure SYSTEM_TIMEOFDAY_INFORMATION ; We are only concerned about BootTime and CurrentTime members of this structure. BootTime.FILETIME CurrentTime.FILETIME EndStructure Protected SystemBootTime.SYSTEM_TIMEOFDAY_INFORMATION ; SystemInformation parameter should be large enough to hold an opaque SYSTEM_TIMEOFDAY_INFORMATION structure. Repeat ; Use NtQuerySystemInformation to retrieve BootTime and Current time information. Note "NtQuerySystemInformation may be altered or unavailable in future versions of Windows". If NtQuerySystemInformation_(#SystemTimeOfDayInformation, @SystemBootTime, SizeOf(SystemBootTime), #Null) = #STATUS_SUCCESS ; Subtract the high and low order parts of the file time from LocalTime and BootTime to calculate the time and date difference. SystemBootTime\CurrentTime\dwLowDateTime - SystemBootTime\BootTime\dwLowDateTime SystemBootTime\CurrentTime\dwHighDateTime - SystemBootTime\BootTime\dwHighDateTime ; Convert the FILETIME structure into a time that is easy to display to a user. FileTimeToSystemTime_(@SystemBootTime\BootTime, @lpSystemTime_BootTime.SYSTEMTIME) FileTimeToSystemTime_(@SystemBootTime\CurrentTime, @lpSystemTime_CurrentTime.SYSTEMTIME) ; Convert BootTime time in Coordinated Universal Time (UTC) to local time. SystemTimeToTzSpecificLocalTime_(#Null, @lpSystemTime_BootTime, @lpSystemTime_BootTime) ; Contains a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC) - offset from this date. lpSystemTime_CurrentTime\wYear - 1601 lpSystemTime_CurrentTime\wMonth - 1 lpSystemTime_CurrentTime\wDay - 1 ; Display date and time difference as UpTime Since Last Reboot... SetGadgetText(2, Str(lpSystemTime_BootTime\wDay) + "/" + Str(lpSystemTime_BootTime\wMonth) + "/" + Str(lpSystemTime_BootTime\wYear) + " @ " + Str(lpSystemTime_BootTime\wHour) + ":" + Str(lpSystemTime_BootTime\wMinute) + ":" + Str(lpSystemTime_BootTime\wSecond)) SetGadgetText(4, Str(lpSystemTime_CurrentTime\wYear) + " years, " + Str(lpSystemTime_CurrentTime\wMonth) + " months, " + Str(lpSystemTime_CurrentTime\wDay) + " days, (" + Str(lpSystemTime_CurrentTime\wHour) + " hours, " + Str(lpSystemTime_CurrentTime\wMinute) + " minutes, " + Str(lpSystemTime_CurrentTime\wSecond) + " seconds)") ; Cycle once every second... Sleep_(1000) Else MessageBox_(#Null, "Could not retrieve system information...", "Peanut!", #MB_ICONERROR | #MB_TOPMOST | #MB_SETFOREGROUND) Break EndIf ForEver EndProcedure Ted. System Up-Time Since BootTime.zipMon, 01 Jun 2020 00:30:55 +0000PureBasic Adventures - Calendar Date FormatThis is a repost from the "PureBasic Adventures" blog... A query was raised last week about how to determine the calendar date format for different regions; year/month/day, day/month/year, etc. After a bit of fruitless pondering whether this could be achieved via API I decided to see if it could be done via the registry. Multiple editions of Windows support the International registry subkey and from there we can use either sShortDate or sLongDate to help us reach our goal. The operating system kindly finds and formats the calendar date in the correct regional order when the user configures their region in the Control Panel or during installation. I chose sShortDate and replaced those known registry values with the values retrieved from the SYSTEMTIME structure. Below is the example... ; Setup string and data sizes for storing date values... DateValue.s = Space(20) : DateSize = Len(DateValue) ; Open registry and retrieve the local calendar/date format If RegOpenKeyEx_(#HKEY_CURRENT_USER, "Control Panel\International", #Null, #KEY_READ, @DateFormat) = #ERROR_SUCCESS If RegQueryValueEx_(DateFormat, "sShortDate", #Null, #Null, @DateValue, @DateSize) = #ERROR_SUCCESS ; Receive the local date GetLocalTime_(@lpSystemTime.SYSTEMTIME) ; Find registry string values and replace string values from SYSTEMTIME structure DateValue = ReplaceString(DateValue, "yyyy", Str(lpSystemTime\wYear)) DateValue = ReplaceString(DateValue, "yy", Str(lpSystemTime\wYear)) DateValue = ReplaceString(DateValue, "MM", Str(lpSystemTime\wMonth)) DateValue = ReplaceString(DateValue, "M", Str(lpSystemTime\wMonth)) DateValue = ReplaceString(DateValue, "dd", Str(lpSystemTime\wDay)) DateValue = ReplaceString(DateValue, "d", Str(lpSystemTime\wDay)) ; Display the date MessageBox_(#Null, DateValue, "What is the date today?", #MB_ICONQUESTION | #MB_TOPMOST | #MB_SETFOREGROUND) EndIf RegCloseKey_(DateFormat) EndIf If you know of a way this can be done purely by API please let me know... Ted. Todays Date.zipMon, 01 Jun 2020 00:28:23 +0000