RECON2008 talk: 64-bit Imports Rebuilding and Unpacking by Sébastien Doucet (IITAC)
IITAC member Sébastien Doucet gave a talk on 64-bit Imports Rebuilding and Unpacking at RECON2008.
With 64-bit packers and protectors being released, there is presently a growing need to create new tools to facilitate the manual unpacking process and to make it as trivial as it is now for protected 32-bit executables. I’m proposing two brand-new tools: CHimpREC and CHimpREC-64, allowing the spirit of ImpREC to live on under the best possible compatibility with all the x64 versions of the Windows operating system.
This talk is about explaining the inner-workings of coding a 32-bit imports rebuilder and the problems encountered due to the WoW64 environment and Address Space Layout Randomization. Next, is an overview of the differences between the PE and PE32+ formats and their impact on porting CHimpREC to 64-bit. Finally, 2 or 3 short live unpacking sessions with different examples of 64-bit packers and how trivial it has become to deal with them with the help of CHimpREC-64.
IITAC - Sponsor of the RECON conference! Free IDA Pro training!
RECON is a computer security conference being held in Montreal. The conference offers a single track of presentations over the span of three days. RECON also offers a variety of technical training courses that take place just before the conference dates. The conference is 13-15 June 2008.
IITAC is a sponsor of the conference in Canada, Montréal. IITAC will give a free lunch workshop on IDA Pro during the conference!
Damn Vulnerable Linux Strychnine+605 1.4 final - Mirrors contacted!
The mirrors for Damn Vulnerable Linux Strychnine+605 1.4 final have been contacted. Over the weekend we might release the download links.
3 days IDA Pro bootcamp as offline or online Training - Preparation for the Certified IDA Pro Professional according to ISO/IEC 17024
This course is by no means a 3-day powerpoint presentation. Instead, you will be engaged in a number of individual and group hands-on exercises to reinforce and solidify everything that is taught in the class.
Some of the exercises are held in a competitive nature, followed by class discussion to pin point elegant approaches and solutions that various individuals or groups may have used. Despite the fact that the course is held in Italy, Germany and Canada, take home exercises will be available for the type-A personalities attending the course. Read more
-
News
-
Security Labs Blog
-
Damn Vulnerable Linux
-
Get in touch
-
Get your free copy!
-
Security Consulting
IITAC offers additional services such as Secure Software Development, Binary Auditing, Copy Protection, Digital Rights Management, Security Concepts and Security Consulting!Scientific Hacking™
Go far beyond classical ethical hacking! Instead of using tools only look under the hood, instead of making multiple choice tests only get certified by true practical assessments!IDA Pro Training
Get trained to analyze malware, vulnerability or copy protections with the no. 1 binary analysis tool IDA Pro!
Cognitive Debugging™
The debugging skill of the programmer is probably the biggest factor in the ability to debug a problem, but the difficulty of software debugging varies. Cognitive Debugging™ trains debugging with respect to brain and mental abilities! Both combined result is most powerful debugging results!Action-based Training™
IITAC professional bootcamps enhances your qualification. We provide courses, seminars, trainings and workshops in the field of IT Security, Secure Software Engineering and Software Engineering. Online training activities are supported by training videos or live online events.Certification acc. ISO 17024
Get certified according to ISO/IEC 17024 100% online! No need to travel around! Learn whenever you want, where you want! Get certified home exercise like… without time pressure!