|
Over the years I have invested heavily in product R&D building a wide
assortment of new skills, and fostering a diverse background and understanding.
These are some of the papers I have developed along my journey that I make freely available to help others along. |
Sandsprite Papers
VB6 P-Code / Reversing
Reverse Engineering / Binary Analysis
Understanding the Import table
Understanding IAT Hooking
Understanding Peb Module Lists
Libemu Shim for Unicorn
Remote Symbol Resolution
Visual Basic 6
- Understanding the Peb Module List - 2011
Shows how the PEB_LDR_DATA and LDR_MODULE structures are interlinked to reveal the nuances of which dlls are loaded are loaded into the current process. Shellcode usually makes use of these structures in order to locate the API functions it requires. Shows you how to examine and make sense of the data on your own as well.