|
Over the years I have invested heavily in product R&D building a wide
assortment of new skills, and fostering a diverse background and understanding.
These are some of the papers I have developed along my journey that I make freely available to help others along. |
Sandsprite Papers
VB6 P-Code / Reversing
Reverse Engineering / Binary Analysis
Understanding the Import table
Understanding IAT Hooking
Using an exe as a dll
Understanding Peb Module Lists
Libemu Shim for Unicorn
Remote Symbol Resolution
Transparent COM instrumentation
Visual Basic 6
- Transparent COM instrumentation - Cisco Talos 2026
IDispatch Logger is a COM hooking tool that logs all calls made through the IDispatch interface.
Dispatch logger hooks the instantiation boundaries, then adds IPC logging by the recursively proxying of IDispatch for every object it encounters.
This includes support for enumerators, class factories, object returns, byref out params, and monikers.
This paper has been published on the Cisco Talos blog. (pdf, code w/binaries)