공존이 블로그

Make your OllyDbg Strong! This plug-in provides three kinds of ways to initiate the process: 1, Normal - And the same manner as the original start, the STARTUPINFO inside unclean data 2, CreateAsUser - User with a mandate to initiate the process of the user, so that the process running under the purview of the User, unable to establish the process Admin operation. Running is such a need in the l..

Sometimes we want to find out where in a module the code parsing is done. In the example below, we want to find the code that parses the QuickTime video codecs that are in Windows media player. We know that the codecs support the raw, rle, jpeg, mjpb, and rpza tags, so all we need to do is to search for those tags in our module--in this case, the "quartz.dll" module. The OllyEye hunter knows tha..

A small plugin for OllyDbg 1.10 which allow you to replace the old disassemble routine used in OllyDbg by a more recent one (beaengine). With this plugin, you can now debug FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2 and VMX without problems. Example : Code: 00401000 PSLLQ MM0,QWORD PTR DS:[402020] 00401007 MOVQ MM0,QWORD PTR DS:[402020] 0040100E MOV EAX,1235 00401013 MOV DWORD PTR DS:[4020..