trietptm / cs468

Automatically exported from code.google.com/p/cs468

Hi there 👋

• 🔭 I’m currently working on incident response & digital forensics (DFIR), cyber security consulting/blue teaming services, system/internal penetration testing/red teaming.
• 🌱 I’m currently learning Mathematics for Computer Science and Security Engineering.
• 👯 I’m looking to collaborate on study/researching state-of-the-art tools, techniques, tactics in binary analysis and reverse engineering.
  • Python is my favorite programming language: https://github.com/trietptm?tab=repositories&q=&type=&language=python
  • I am honoured to be mentioned in the book "The Beginner's Guide to IDAPython" (https://leanpub.com/IDAPython-Book) and some FireEye Flare-On Challenge Honor Roll pages.
• 🤔 I’m looking for help with business development in Vietnam.
• 💬 Ask me about any Cyber Security questions if you need Cyber Security Consulting (securing accounts/systems, system security assessments, cyber-security maturity assessment, suspicious/malicious file examination,...) or have a malware/hacking outbreak and need an incident compromise assessment (how and when a hacker got into your system, what post-exploitation activities they did in your system,...), malware remediation help, securing your systems and digital assets.
• 📫 How to reach me: [phone] (WhatsApp, Viber, Signal), LinkedIn (https://www.linkedin.com/in/trietptm/), Twitter DM (https://twitter.com/MinhTrietPT) or reaching me via our company Facebook page for our reverse engineering online courses: https://www.facebook.com/novasec.vn .

GitHub Stats

cs468's Issues

Dynamically Imported Functions will not work when loading

I don't believe that functions that are not in the import table of a
program will be loaded when using the load method of hooking.

Attaching to a process already running may behave correctly but I have no
confirmed.  However, we will be loading malware so this needs to be fixed.

Proposed solution: Hook GetProcAddress and watch for imports of send(),
recv(), etc...  This should allow us to hook dynamic imports but I imagine
a small number of malware may have tricks around this technique.

Original issue reported on code.google.com by [email protected] on 24 Mar 2010 at 6:43

PyDbg process does not detach when SIGINT received

A SIGINT (Ctrl-C) is currently not handled by our program and will not
detach from the hooked program.  This causes the hooked program to crash
the next time it tries to call the hooked function (SEH probably is set to
handle BPs by passing to our program which is now terminated).

Original issue reported on code.google.com by [email protected] on 24 Mar 2010 at 6:45