ntinternals.org

antelox.blogspot.com

RCE Blog: October 2009

http://antelox.blogspot.com/2009_10_01_archive.html

Thursday, October 1, 2009. Win32Hlp for Windows 7 x86 and x64. How many people have noticed, Windows 7 can't read .hlp files natively! A couple of days ago I found WinHlp for Windows 7 x86 and x64, so I decided to share with you ;P. This is the link when u'll download it: WinHlp. See you in the next post. =). Subscribe to: Posts (Atom). Win32Hlp for Windows 7 x86 and x64. View my complete profile. Awesome Inc. template. Powered by Blogger.

antelox.blogspot.com

RCE Blog: August 2009

http://antelox.blogspot.com/2009_08_01_archive.html

Thursday, August 20, 2009. This morning while I was programming in Delphi. With my IDE Delphi 7, I noticed that the exe that has been compiled it has been detected by my AV as a Virus. My AV is Avast! And the exe compiled has been detected as Win32:Induc. Win32:Induc is a new emerging threat, exactly of 18/08/09. I have google and looked on my PC and I can say this:. The virus, first searchs in the registry path. HKLM Software Borland Delphi X.0. Key, that specifies the folder location of your Delphi IDE.

antelox.wordpress.com

RCE Blog | Page 2

https://antelox.wordpress.com/page/2

A fake MSN’s address. March 20, 2010. Today, while I’m chatting through MSN with my friends, I received a invite to add in my contact list one contact. The contact is: rosaliareeves38@hotmail.com. Being curious, I accepted the invitation to try to understand if it were a real contact or a classic fake account. So I’m starting a conversation with it saying: ”. 8220;, and I received a very very fast reply which said: ”. I know a way we can chat and have a better time. do you cam? December 28, 2009. And whi...

antelox.blogspot.com

RCE Blog: About

http://antelox.blogspot.com/p/about.html

I'm Stefano Antenucci aka Antelox. A student of Univaq ( Civil Engineering ) but I devote much of my free time for research in Computer Science and post here in my blog all my discoveries / research. Mainly C/C also with Qt framework and Win32 API, Delphi, ASM), Reverse Code Engineering. And other Security field. I am available in some communities as ARTeam. And many other. I'm moderator in the community quequero.org. UIC), in particular I'm also manage the wiki. My favorite music is: Rock / Metal.

antelox.blogspot.com

RCE Blog: July 2010

http://antelox.blogspot.com/2010_07_01_archive.html

Sunday, July 11, 2010. Just some Acrobat exploits. In this second post I will explain the functions in the javascript code carved out used to exploit the Acrobat vulnerability. First of all we take a look at the function that acts as a version-check of Acrobat with which the victim opened to read the pdf infected. This is the function:. The function name is GDUvmppC (). Variable is declared, and through app.viewerVersion.toString (). S will start the respective exploit depending on the detected version.

antelox.blogspot.com

RCE Blog: Morto Malware Analysis

http://antelox.blogspot.com/2011/09/morto-malware-analysis.html

Wednesday, September 7, 2011. After one year of total absence for various reasons from my blog, I'm returned here to present my one recent research in my new blog ;). Today we're going to analyze Morto.A. A malware which, in this weeks, is spreading in many Internet places. It's a worm that allows unauthorized access to an infected computer and tries to compromise administrator passwords for Remote Desktop. Contact me for sample. ]. Below I report how this malware is identified by some AV:. Symantec - Tr...

antelox.blogspot.com

RCE Blog: Notepad++ as default TXT Editor

http://antelox.blogspot.com/2012/08/notepad-as-default-txt-editor.html

Sunday, August 12, 2012. Notepad as default TXT Editor. In this brief blog post I want show you how replace the Windows notepad. Ok, let's go. First you must download Notepad ( of course :P ) from this link. Once you have installed Notepad :. Open regedit and browse to HKEY LOCAL MACHINE SOFTWARE Microsoft Windows NT CurrentVersion Image File Execution Options. Create a subkey a this location named ' notepad.exe. Then create a String value named ' Debugger. You must change the path with your own ];.

antelox.blogspot.com

RCE Blog: April 2010

http://antelox.blogspot.com/2010_04_01_archive.html

Friday, April 9, 2010. Other fake MSNs address. I discovered other fake MSN's address. There isn't much to say because they are similar to the previous fake address. I will only tell you the address and their malicious site respectively. Http:/ www.freecamlink.net/a2vhj. Http:/ www.freecamlink.net/a2vqg. Http:/ www.freecamlink.net/a2vpj. Http:/ www.freecamlink.net/a8n6r. Bye, see you to the next post. =). Subscribe to: Posts (Atom). Other fake MSNs address. View my complete profile.

antelox.blogspot.com

RCE Blog: March 2010

http://antelox.blogspot.com/2010_03_01_archive.html

Monday, March 22, 2010. Strong ARM (SA1110) Opcodes. BEQ xxxxxx0A b if zero (Z). BNE xxxxxx1A b if not equal (-Z). BGE xxxxxxAA b if greater or equal (N*V/-N*-V). BHI xxxxxx8A b if higher (-C*-Z). BLT xxxxxxBA b if less than (N*-V/-N*V). BCC xxxxxx3A b if carry clear. BCS xxxxxx2A b if carry set. BMI xxxxxx4A b if negative, set N. BLS xxxxxx9A b if lower or same (C/Z). BGT xxxxxxCA b if greater than (N*V*-Z/-N*-V*-Z). BLE xxxxxxDA b if less or equal (Z/N*-V/-N*V). 00022714 B loc 22734 06 00 00 EA. LDR R2...