Comments on: Quickpost: DisableAMD & DisableRegistryFools

By: Didier Stevens

Didier Stevens — Sat, 17 Jul 2010 10:45:21 +0000

@bob Mark Russinovich explained this on his blog.

By: bob

bob — Fri, 16 Jul 2010 20:57:41 +0000

Hi didier and thx for the great post,
Could you tell me a step by step process of how to look for the disablecmd string?

By: Josh

Josh — Fri, 21 Mar 2008 05:37:26 +0000

Oh, here it is…

$ xxd cmd.exe| grep “D.i.s.a” -n2
–
7030:001b750: 0909 0907 0908 9090 4400 6900 7300 6100 ……..D.i.s.a.
7031-001b760: 6200 6c00 6500 4300 4d00 4400 0000 9090 b.l.e.C.M.D…..

By: Josh

Josh — Thu, 20 Mar 2008 15:09:42 +0000

$ strings cmd.exe | grep “DisableCMD”

Returns nothing. What am I missing?

By: bpmtk: DisableAMD « Didier Stevens

bpmtk: DisableAMD « Didier Stevens — Wed, 12 Mar 2008 00:43:51 +0000

[...] Filed under: Hacking, My Software, Reverse Engineering — Didier Stevens @ 0:43 Remember my DisableAMD post? In stead of patching the EXE file, you can also use my Basic Process Manipulation Tool Kit to [...]

By: Didier Stevens

Didier Stevens — Wed, 28 Nov 2007 21:26:46 +0000

Sorry for the misunderstanding, but it is not a typo. This is how I renamed the registry keys, as a play on words.

By: Charlene

Charlene — Wed, 28 Nov 2007 18:53:09 +0000

I read this post to find out if I was missing something about my AMD chip. Then I discoverd that the title DisableAMD & DisableRegistryFools was probably a typo!