codelaughs.blogspot.com

antelox.blogspot.com

RCE Blog: October 2009

http://antelox.blogspot.com/2009_10_01_archive.html

Thursday, October 1, 2009. Win32Hlp for Windows 7 x86 and x64. How many people have noticed, Windows 7 can't read .hlp files natively! A couple of days ago I found WinHlp for Windows 7 x86 and x64, so I decided to share with you ;P. This is the link when u'll download it: WinHlp. See you in the next post. =). Subscribe to: Posts (Atom). Win32Hlp for Windows 7 x86 and x64. View my complete profile. Awesome Inc. template. Powered by Blogger.

antelox.blogspot.com

RCE Blog: August 2009

http://antelox.blogspot.com/2009_08_01_archive.html

Thursday, August 20, 2009. This morning while I was programming in Delphi. With my IDE Delphi 7, I noticed that the exe that has been compiled it has been detected by my AV as a Virus. My AV is Avast! And the exe compiled has been detected as Win32:Induc. Win32:Induc is a new emerging threat, exactly of 18/08/09. I have google and looked on my PC and I can say this:. The virus, first searchs in the registry path. HKLM Software Borland Delphi X.0. Key, that specifies the folder location of your Delphi IDE.

antelox.blogspot.com

RCE Blog: About

http://antelox.blogspot.com/p/about.html

I'm Stefano Antenucci aka Antelox. A student of Univaq ( Civil Engineering ) but I devote much of my free time for research in Computer Science and post here in my blog all my discoveries / research. Mainly C/C also with Qt framework and Win32 API, Delphi, ASM), Reverse Code Engineering. And other Security field. I am available in some communities as ARTeam. And many other. I'm moderator in the community quequero.org. UIC), in particular I'm also manage the wiki. My favorite music is: Rock / Metal.

antelox.blogspot.com

RCE Blog: July 2010

http://antelox.blogspot.com/2010_07_01_archive.html

Sunday, July 11, 2010. Just some Acrobat exploits. In this second post I will explain the functions in the javascript code carved out used to exploit the Acrobat vulnerability. First of all we take a look at the function that acts as a version-check of Acrobat with which the victim opened to read the pdf infected. This is the function:. The function name is GDUvmppC (). Variable is declared, and through app.viewerVersion.toString (). S will start the respective exploit depending on the detected version.

antelox.blogspot.com

RCE Blog: Morto Malware Analysis

http://antelox.blogspot.com/2011/09/morto-malware-analysis.html

Wednesday, September 7, 2011. After one year of total absence for various reasons from my blog, I'm returned here to present my one recent research in my new blog ;). Today we're going to analyze Morto.A. A malware which, in this weeks, is spreading in many Internet places. It's a worm that allows unauthorized access to an infected computer and tries to compromise administrator passwords for Remote Desktop. Contact me for sample. ]. Below I report how this malware is identified by some AV:. Symantec - Tr...

antelox.blogspot.com

RCE Blog: Notepad++ as default TXT Editor

http://antelox.blogspot.com/2012/08/notepad-as-default-txt-editor.html

Sunday, August 12, 2012. Notepad as default TXT Editor. In this brief blog post I want show you how replace the Windows notepad. Ok, let's go. First you must download Notepad ( of course :P ) from this link. Once you have installed Notepad :. Open regedit and browse to HKEY LOCAL MACHINE SOFTWARE Microsoft Windows NT CurrentVersion Image File Execution Options. Create a subkey a this location named ' notepad.exe. Then create a String value named ' Debugger. You must change the path with your own ];.

antelox.blogspot.com

RCE Blog: April 2010

http://antelox.blogspot.com/2010_04_01_archive.html

Friday, April 9, 2010. Other fake MSNs address. I discovered other fake MSN's address. There isn't much to say because they are similar to the previous fake address. I will only tell you the address and their malicious site respectively. Http:/ www.freecamlink.net/a2vhj. Http:/ www.freecamlink.net/a2vqg. Http:/ www.freecamlink.net/a2vpj. Http:/ www.freecamlink.net/a8n6r. Bye, see you to the next post. =). Subscribe to: Posts (Atom). Other fake MSNs address. View my complete profile.

antelox.blogspot.com

RCE Blog: March 2010

http://antelox.blogspot.com/2010_03_01_archive.html

Monday, March 22, 2010. Strong ARM (SA1110) Opcodes. BEQ xxxxxx0A b if zero (Z). BNE xxxxxx1A b if not equal (-Z). BGE xxxxxxAA b if greater or equal (N*V/-N*-V). BHI xxxxxx8A b if higher (-C*-Z). BLT xxxxxxBA b if less than (N*-V/-N*V). BCC xxxxxx3A b if carry clear. BCS xxxxxx2A b if carry set. BMI xxxxxx4A b if negative, set N. BLS xxxxxx9A b if lower or same (C/Z). BGT xxxxxxCA b if greater than (N*V*-Z/-N*-V*-Z). BLE xxxxxxDA b if less or equal (Z/N*-V/-N*V). 00022714 B loc 22734 06 00 00 EA. LDR R2...

antelox.blogspot.com

RCE Blog: June 2010

http://antelox.blogspot.com/2010_06_01_archive.html

Friday, June 25, 2010. Qt Creator 2.0 is Out! Then OllyDbg 2.0 news, another one good;. Qt Creator 2.0. Is out. This last version integrates more nice features, improvements and it's makes to develop more fast and easy with mobile development kit. Qt Libraries. Is also out. More info:. Qt Creator 2.0 part of Nokia Qt SDK 1.0. Released today, the Nokia Qt SDK provides developers with a single package containing all tools they need – including Qt Creator and the Qt framework – to code, simulate...Also rele...

antelox.blogspot.com

RCE Blog: September 2009

http://antelox.blogspot.com/2009_09_01_archive.html

Monday, September 28, 2009. I have backuped a Database of P-Code Opcodes so it can help you and me to reverse a VB program makes with P-Code. HTML File Backuped: OpCode. See you in the next post! Labels: Reverse Code Engineering. Monday, September 7, 2009. My friend Evilcry has released a new useful tool; DLL Export Comparer! Dll Export Comparer can be used to differentiate DLLs and log differences into file. It's developed in Qt. Qt DLLs NOT INCLUDED! You must have 3 Qt Library:. View my complete profile.