sp has posted his solution for level 3. Excellent post, but I should mention that level 3 contains lots of obfuscated code, something sp doesn’t emphasize.
Monday 7 August 2006
Leave a Comment »
No comments yet.
Didier Stevens
Didier Stevens Labs
Pages
- About
- Didier Stevens Suite
- Links
- My Software
- Professional
- Programs
- Ariad
- Authenticode Tools
- Binary Tools
- CASToggle
- Disitool
- EICARgen
- ExtractScripts
- FileGen
- HeapLocker
- Network Appliance Forensic Toolkit
- Nokia Time Lapse Photography
- oledump.py
- OllyStepNSearch
- PDF Tools
- Shellcode
- SpiderMonkey
- Translate
- USBVirusScan
- UserAssist
- VirusTotal Tools
- XORSearch & XORStrings
- YARA Rules
- ZIPEncryptFTP
- Public Drafts
- Reverse Engineering Mentoring
- Screencasts & Videos
Top Posts
Categories
- .NET
- 010 Editor
- Announcement
- Arduino
- Bash Bunny
- Beta
- bpmtk
- Certification
- Didier Stevens Labs
- Eee PC
- Encryption
- Entertainment
- Fellow Bloggers
- Forensics
- Hacking
- Hardware
- maldoc
- Malware
- My Software
- N800
- Networking
- Nonsense
- nslu2
- OSX
- Personal
- Physical Security
- Poll
- Puzzle
- Quickpost
- Reverse Engineering
- RFID
- Shellcode
- smart card
- Spam
- technology
- UltraEdit
- Uncategorized
- Update
- Vulnerabilities
- WiFi
- Windows 7
- Windows 8
- Windows Vista
- Wireshark
-
Blog Stats
- 4,535,457 hits
Twitter @DidierStevens
- RT @NVISO_Labs: And the 4th resource is shellcode (XOR 0x86 encoded). twitter.com/NVISO_Labs/sta… 1 day ago
- RT @martijn_grooten: @DidierStevens They're here btw. blog.didierstevens.com/my-software/ 1 day ago
- RT @martijn_grooten: I don't do a lot of malware analysis, but when I need to do some ad hoc stuff, those tools by @DidierStevens are reall… 1 day ago
- RT @NVISO_Labs: The #petya sample uses GetIpNetTable to retrieve the ARP cache and attack hosts on the local network (dynamic ARP entry) ht… 1 day ago
- RT @NVISO_Labs: The #Petya sample contains 4 resources, all zlib compressed. 3 PE files. 3th is #psexec version 1.98 with valid signature.… 1 day ago
Archives
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- April 2016
- March 2016
- February 2016
- January 2016
- December 2015
- November 2015
- October 2015
- September 2015
- August 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- October 2014
- September 2014
- August 2014
- July 2014
- June 2014
- May 2014
- April 2014
- March 2014
- February 2014
- January 2014
- December 2013
- November 2013
- October 2013
- September 2013
- August 2013
- July 2013
- June 2013
- May 2013
- April 2013
- March 2013
- February 2013
- January 2013
- December 2012
- November 2012
- October 2012
- September 2012
- August 2012
- July 2012
- June 2012
- May 2012
- April 2012
- March 2012
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
Leave a Reply (comments are moderated)