PE 101 - a windows executable walkthrough

simpleuser · 13 days

awesome!

simpleuser · 23 days

blank? weird, works with sumatra or acrobat... what's your viewer ?

John_Mirra · 1 month

ignoring the j48 generated code, the PE parsing itself is worrying - for a 'malware classifier' - to say the least: it will just instantly crash if the PE has less than 2 sections, or no Data Directories, which is not uncommon with malwares or packers.

simpleuser · 1 month

I don't think all files need their own slideshow. Let me know - by answering this comment - which file requires one.

simpleuser · 3 months

you don't - these charts just explain the encoding of the mnemonics, not the operands (which might be very complex in some cases).

simpleuser · 3 months

yeah maybe i'll only provide it as PDF (which is a vector format, so much smaller than PNG yet perfect image), and imgur has a 1 Mb limit anyway.

simpleuser · 3 months

well throw and exceptions mechanisms are not 'direct' flow change IMO... but it's tough to define correct categories TBH.

at least, you can suggest better, and you're free to modify the original files if you want your own version anyway.

simpleuser · 3 months

it's planned in the next release ;)

simpleuser · 3 months

i didn't know php had a VM. is it worth making a map of it ?

simpleuser · 3 months

why?

simpleuser · 3 months

not yet. I started it, but I can't work on it for now (just doing that at home as a hobby), so I released it as is.

thanks.

cavedave · 3 months

I added subtitles http://www.universalsubtitles.org/en/videos/MCGL8ABJUdv7/info/-days:%20Ange%20Albertini:%20Such%20a%20weird%20processor%20-%20messing%20with%20x86%20opcodes/ (new link)

simpleuser · 3 months

thanks a million!

I used your subtitles as a base.

simpleuser · 3 months

it's now with complete english subtitles + extra comments http://www.universalsubtitles.org/en/videos/MCGL8ABJUdv7/info/-days:%20Ange%20Albertini:%20Such%20a%20weird%20processor%20-%20messing%20with%20x86%20opcodes/ (new link)

simpleuser · 3 months

check http://code.google.com/p/corkami/wiki/InitialValues

simpleuser · 3 months

I'll try to make subtitles (I'm the presenter), but I'm no video expert: if you can recommend a specific software to make subtitles from a youtube video? I'm all ears.

simpleuser · 3 months

check http://x86.corkami.com , all opcodes are there.

the debuggers usually don't crash (they fail because of PE characteristics though), they just can't disassemble but they still let you step through blindly.

simpleuser · 3 months

I understand your point, but most of the audience was not familiar with that (I asked at the start of the video) I was initially planning to skip forward that part.

simpleuser

TROPHY CASE

you'll need to login or register to do that

create a new account

login