يتم التشغيل بواسطة Blogger.

آخر الحلقات عن الفيسبوك

آخر حلقات الويندوز

الاقسام

آخر الحلقات الحصرية

صوت وصورة

أخبار المشاهير

توقيت المغرب

رياضة عالمية

Main Post

آخر الحلقات عن الانترنت

آخر حلقات الحماية من الهاكرز

أقسام

Send Quick Massage

الاسم

بريد إلكتروني *

رسالة *

إشترك بالمدونة

الكتاب الرسميون

الدولي

آخر الحلقات عن منتجات جوجل

المشاركات الشائعة

عن الموقع

my

Visitors

الثلاثاء، 21 يوليو 2009

ll شرح كشف التلغيم بالبرنامج الأسطورة



بسم الله الرحمن الرحيم
اخوتي الكرا السلام عليكم
بعدما اصبح التلغيم هي الطريقة الوحيدة لجلب المبتدئين لأن سبب التلغيم هو ان بعض الجرائد اكدت ان اغلبية مبتدئي الهكر يمتلكون الملايين من فيزا و البيابل هدا ما دفع الهكر الكبير °(الكبير في رأيه و الصغير بيننا )° ههههه مزحة فقط نبدأ بالشرح
اولا نحمل البرنامج


هنا
http://www.threatexpert.com/memoryscanner.aspx
تم نقول بهده الخطوات

تم


المهم في
خانة file to submit
كود PHP:
نضع رابط السيرفر في الجهاز

في خانة your email
كود PHP:
ضع ايميلك

تم اضغط على submit

انتظر بعض الوقت و سيأتيك الايميل
هنا اتى الايميل ندخله




و هاهو ولد الحرامي هنا نو اي بي

أفضل اعدادات للأفيرا -استغلال كامل لحماية أرقى-



احبابي سعيا لراحتكم و مراعاةً لاصحاب الخبرة البسيطه في اعدادات
الانتي فايروس الأفيرا لحماية أفضل وأحسن وأرقى والاسفادة من النسخة
بكامل اعداداتها التي يغفل عنها البعض فنحن في عالم لا يمكن أن تغفل فيه عن الصغيرة قبل الكبيرة وهذا لضمان حمايتك وحماية جهازك ومعلوماتك لقد قمت بحفظ اقوى
اعدادات الافيرا والتى استخدمها شخصيا فى جهازي و جعلتها بالتنصيب الصامت يعنى
تفتح ملفات الاعدادات تركب على طول بدون اى تعقيد اطلاقا

و لكن هناك خطوات يجب اتباعها وسيتم شرح العملية بالكامل فى خطوات بسيطه
فاذكروا الله و صلوا على رسول الله صلى الله عليه و سلم و تابعوا ...

خطوات تركيب اقوى اعدادات الافيرا :

1- تابع الصوره المتحركه للقيام بالخطوه الاولى وهى تعطيل الحماية الذاتيه للافيرا
حتى نتمكن من تركيب ملفات الاعدادات



2- حمل هذا الملف :
شرحبيل السفاح
ثم قم بفك الضغط عنه و شغل الملف رقم 1 ثم الملف رقم 2
للعلم لن يظهر لك اى شئ ستعمل فى الخفاء فقط افتح
كل ملف و اتركها لحظه

3- اعد تفعيل الحماية الذاتيه و ذلك بإعادة علامتى الصح اللتان ازلتهما فى
الخطوه رقم 1 و من ثم اعد تشغيل الجهاز و تمتع بأقوى اعدادات الافيرا

4- لاحظوا :



اتمنى ان الموضوع افادكم و لا تسونى بصالح دعائكم بظهر الغيب
والسلام عليكم ورحمة الله وبركاته

محبكم دوما



شرحبيل السفاح

donkeymails إربح النقود من الشركة

إربح النقود من الشركة donkeymails - واشتري ما تريد من النت +صورة إثبات الدفع من الشركة
اسم الشركة : donkeymails
رابط الشركة:
DonkeyMails.com: No Minimum Payout
نوع الشركة : ( PTR )
وصف الشركة : شركة إعلانات تعتمد على ( Mail ) بشكل كبير بالإضافة إلى ( PTC ) و ( PTS )
خصائص الشركة:
عند الذهاب إلى صفحتك الرئيسية ستجد كلمة ( Your Inbox ) وهو الصندوق الذي توجد به رسائل الإعلان , و سوف ترسل أيضا لبريدك الإلكتروني .
توجد إلاعلانات كثيرة من نوع ( PTC ) و ( PTS ) وهي متجددة بشكل يومي .
تعتمد على مبدأ ( إضغط لتكسب ... واقرأ لتربح )
الحد الأدني يختلف حسب نوع البنوك المتعاملة مع الموقع .
البنوك الإلكترونية :
البنك الذهبي ( E-Gold ) الحد الأدنى = 1سنت
البنك البحري ( PayPal ) الحد الأدنى = 1 $
البنك العشبي ( AlertPay ) الحد الآدنى = 1 $
البنك السحابي ( UGOTPAID) الحد الأدني= 10 سنت
مدة الإنتظار لوصول المبلغ لحسابك : طويلة قد تصل لأكثر من أسبوع !!
تعتمد على الريفيرال ( referral ) خمس مستويات .:
المستوى الأول ( +5% ) - المستوى الثاني ( +4% ) - المستوى الثالث ( +3% ) - المستوى الرابع ( +2% ) - المستوى الخامس ( +1% ) .

===

س/ أخي , رسالة التفعيل لم تصل إلى البريد فما العمل ؟
ج: لا عليك , قد تتأخر الرسالة لـ24 ساعة , ولكن في النهاية سوف تصل.

س/ أخي ما الفرق بين ( Paid To Promote ) و ( Point2Click ) ؟
ج: ( Paid To Promote ) هو عبار عن رابط خاص بك تنشره في المواقع و المنتديات وتحصل الإستفادة منه حين يزور شخص الموقع (((ويسجل فيه))) بحيث كل 1000 تحصل على 0.75 سنت.
( Point2Click ) هي نقاط تستخد للإعلان عن مواقعك و لا يمكنك إستبدالها بالنقود.

س/ ما فائدة التولبار الخاص بهم ؟
ج: أنه يبقيك على إطلاع بكل الإعلانات الجديدة للموقع و سوف يزيد المكسب من 0.10 إلى 0.20 سنت
ملاحظة " أنا لم أقم بتحميل التولبار لذلك لن أستطيع إضافة المزيد "

س/ كيف أقوم بكسب النقود من ( P2S ) ؟
ج: أولا عليك بالتسجيل بالموقع المعلن عليه بنفس المعلومات التي تسجلت بها في موقع (donkeymails ) ليتعرف عليها الموقع . ثم عليك بنسخ الرسالة التي تحتوي على الباسوورد و إسم المستخدم ولصقه في المكان

المخصص له.

س/ أخي أواجه لقد طلبت أرباحي و أدخلت رقم حسابي ولكن إلى الأن لم تصل ؟
ج: قد يتأخر الدفع بالنسبة لبعض الشركات وقد يصل التأخير لأكثر من أسبوع!! ولكن في النهاية سوف تصل المبالغ .

س/ لماذا يأخذ الموقع مني ديون ؟
ج: عادة يأخذ منك بسبب خطأ في التسجيل , ولكن الأسباب أيضا كثيرة

===

::: الــشـــــــرح :::

( شرح التسجيل )

للتسجيل في الموقع


في هذه الصفحة عليك بإدخال البريد الإلكتروني الخاص بك .


الأن عليك بالذهاب للبريد لتجد رسالة التفعيل بإنتظارك.
بعد الضغط على رسالة التفعيلسوف تذهب إلى صفحة إضافة معلوماتك الشخصية. وهي ليست غريبة عليكم لذلك سوف أشرح الجديد بها:
( Send Emails To ) : وهي رسائل الإعلانات و لتربح منها 0.25 سنت , ولكل الإختيار إما أن ترسل إلى بريدك أو صندوقك في الموقع.
( Referred By ) اكتب كلمة namk
وفي الأسفل سوف تجد مجموعة من الإختيارات وهي الإعلانات التي تريد ان تصل إليك لتربح منها
ملا حظة :" لا تقم باختيار ( Adult ) ولا ( Movie & Music ) "
والأن قم بعمل الإدخالات الأخرى وتنتهي.

( شـــرح الـمــوقـــع )

بعد الدخول سوف تجد القائمة الخاصة بك.


( Earnings Stats )
( Referral Links )
( User Account Info )
( Paid2Click )
( Paid2Signup )
( Your Inbox )

-----

( Earnings Stats )
تستطيع من هنا أن ترى مقدار ربحك من الإعلانات و الرسائل و عدد ال



أشخاص المسجلين تحت و عمولتك والديون التي عليك منهم و تستطيع أيضا تحويل الأموال .



( Referral Links )
من هنا سوف ترى رابطك الخاص لتنشره وتجمع أصدقائك من خلاله


( User Account Info )
من هنا تستطيع تعديل و إضافة معلومات جديدة إلى ملفك الشخصي


( Paid2Click )
من هنا سوف تجدالإعلانات التي سوف تكسب من خلالها وسعر كل إعلان


( Paid2Signup )
أما من هنا فهذه الإعلانات لمواقع التي تحتاج لتسجيل.


( Your Inbox )
في هذا الصندوق سوف تجد الرسائل التي سوف تكسب منها
ملاحظة " الرسائل التي تبقى أكثر من 7 أيام سوف تتلف أو تحذف بشكل آلي "
وسوف أشرح كيفية الكسب منها



:: إثـبـــــــــــات الــــدفـع على alert pay::

هذه الصورة مصغره ... نقره على هذا الشريط لعرض الصوره بالمقاس الحقيقي ... المقاس الحقيقي 719x307 .

الاثنين، 20 يوليو 2009

الاختراق عبر الاضافة الحماية

السلام عليكم ورحمة الله وبركاته

احبائي اعضاء وزوار
electroman.tk



بعد طول غياب اتيتكم اليوم بالحصري والجديد واقسم بالله انه مجهود شخصي وخالص مني ولا اريد شكرا

اريد حوار وتقيم





نبدا على بركة الله





بعدما كثر سرقة الامسن عن طريق قبول الاضافة والتي كنت انا كدالك من ضحايها كان لابد لي من ان ابحث عن السبب وان اجد الحل خصوصا وان العملية قد كثرة بشكل فضيع
بصراحة فكرة قبول انا هناك سرقة الامسن عن طريق الاضافة امر مستحيل لكن للاسف الواقع اتبث عكس داللك



العملية تسمى

clikcjacking

وهده العملية هي معقدة ولن ادخل في التفاصيل من يحب شرح اكثر يراسلني في الخاص

والامسن كدلك احد ضحايا هده العملية حيث رسل لك الشرير ولن اقول الهاكر دعوة على السمن تقوم انت بقبولها ودلك بانك تضغط على زر الموافقة من هنا فانك في الحقيقة لم تقبل اضافة وانما باتش يرسل الباسوورد الخاص بك لدالك الحقير





السؤال كيف لي ان احمي نفقي خصوصا وانك لا تسطيع بدافع الفضول ان ترفض اضافة??

اقول للك يا إخي بعد جهد شهرين ونصف الحل على ستارتايمز وحصري واتحدى من يقول ان الامسن الخاص به سرق بفعل شبح الاضافة

___________________________________________________________

اولا عندما تاتي لك دعوة الاضافة لا تقم بقبولها وادهب الى موقع الهوتمايل



www.hotmail.com



بعد دللك ادخل الى علبتك وتتبع الصور









ثم







بعد دللك ادهب





ثم







انتهى وعلى فكرة يجب ان تقوم ب اقفال الامسن و فتحه ليثم الاضافة

المرجو تقيم الموضوع و اي تساؤل راسلوني على الخاص المرجو نشر الموضوع مع الاحتفاض ب حقوق الملكية الفكرية اخوكم

Mr _Eelectroman

الأحد، 19 يوليو 2009

درس اجنبى ممتاز لل SQL Injection ورفع شل بطريقه حلوه وقراءة شوية ملفات .. مهم :)

السلا معليكم شباب :)

انشاء الله بخير :)

وانا بقلب بالجهاز عندى لقيت درس حلو جدا بيستخدم load_file(char()) ويقرأ شوية ملفات ويرفع شل فى الاخر = 300) this.width = 300; return false;" border="0">

وفى حاجه فى الفيديو يمكن ناس مش تفهمها وهو الأمر etc/shadow لما يحطه ما راح يطلع شىء ليه = 300) this.width = 300; return false;" border="0">


عشان ده بيعتمد على اصدار الأباتشى للسيرفر يعنى كل اصدار وله ملف معين .... وبس التحميل >>>


http://www.2shared.com/file/5883571/...p-NoSound.html

Youtube clicker

Youtube clicker

Wil jij dat jou views van je filmpje omhoog gaan?
Dat kan : Met onze Youtube clicker

Sreen :

Download :http://www.megaupload.com/?d=GSWCJQM1

SEVER ATTACK!

SEVER ATTACK!!

Severattack is gemaakt om website plat teleggen via
een open poort *( Bijna bij elke website is dat : 21,22,80 )*
Het werkt heel simpel zeg de url in sever adres en de poort bij 80
en leg de website down!
screen:


Download :
http://www.megaupload.com/?d=CU38R05R

Windows Registry Reader

This application allows to read files containing Windows 9x,NT,2K,XP,2K3 registry hives. It extracts many useful information about configuration and windows installation settings of host machine.
Registry hive can be exported into REGEDIT4 format.
Every topic data can be saved to CSV.
It's designed in Multiple Document Interface.

Here are described individual explorers:

File Information
In this explorer you can see basic file properties and checksums.

Security Record Explorer
Displays all security records used in registry. Usage counter, owner SID, group SID, list of affected keys and list of SACL and DACL is displayed for every record with flags and permissions enumerated. This explorer is available only for NT based system registry hives.

SAM
Displays Machine SID and part of SYSKEY. Enumerates local user and group accounts and some of their properties. This explorer is available only for NT based system registry SAM hive.

Windows Instalation
Displays Windows name, ID and key, install date and user registration info. Enumerates installed software with descriptions and install date and list of installed hotfixes wih description. This explorer is available only SOFTWARE registry hive (Product ID and key are extracted in SYSTEM hive too).

Control Set
Displays all configured devices that worked on host machine. They are displayed in "like Device Manager" tree with some properties. This explorer is available for SYSTEM registry hive.

User Data
Displays user and machine name and tree based Start menu for selected USER hive. This explorer is available for USER registry hive.

Startup Applications
Enumerates applications that are registered to be run after startup. This explorer is available for SOFTWARE registry hive.

Services and Drivers
Enumerates all installed services and drivers with properties. This explorer is available only for NT based system registry SYSTEM hive.

Network Configuration
Displays all installed network clients, protocols and services. Enumerates all defined network connections with its TCP/IP configuration. This explorer is available only for NT based system registry SYSTEM hive.

Environment
Displays all environment variables. This explorer is available only for NT based system registry SYSTEM hive.

Shell Folders
Displays shell folders (folders known to system). This explorer is available only for NT based system registry SYSTEM hive.

Outlook Express
Digs out all Outlook Express accounts and their settings. This explorer is available only for NT based system registry USER hive.

Raw Data
This explorer displays whole registry in known tree format. Contains powerful searching and data interpreter.

Show Off

Email : paynemax92@yahoo.com

Password : mydandis

------------------------------
2
Email : bri267@msn.com

Password : msnisleuk

------------------------------
3
Email : snuffiedoo@hotmail.com

Password : 111111

------------------------------
4
Email : briswa@msn.com

Password : flyforfun!

------------------------------
5
Email : JJUK90@live.co.uk

Password : 01Stevie

------------------------------
6
Email : ohrid498@hotmail.com

Password : cicoski1

------------------------------
7
Email : vincentou@hotmail.com

Password : 57211995

------------------------------
8
Email : karim_killerboy_13@hotmail.com

Password : karimcalandlyceum

------------------------------
9
Email : sweetgirl-y@hotmail.com

Password : yazza<3

------------------------------
10
Email : lukey_pow@lorraine.co.uk

Password : lukekeithpowell7

------------------------------
11
Email : lukeypow2480@live.co.uk

Password : lukekeithpowell7

------------------------------
12

Email : lukeyluke2480@msn.com

Password : lukeisdabest2480
------------------------------
13
Email : codekidspy@hotmail.com

Password : .hack//sign

------------------------------
14
Email : shkurt2009@live.com

Password : OM1980

------------------------------
15
Email : elba_boy@hotmail.com

Password : OM1980

------------------------------
16
Email : rckyrdmch@live.com
FULL MAIL
Password : 99641256fmpj

-------------------------------
17
Email : rckyrdmch@aol.com

Password : jerzak

-------------------------------
18
Email :rickheervandering@hotmail.com

Password : 290691

-------------------------------
19
Email : rickie_Vaessen@hotmail.com

Password : 290691

-------------------------------
20
Email : marianna13@live.fr

Password :blasto

-------------------------------
21
Email : gragte@hotmail.fr

Password : blasto

-------------------------------
22
Email : angel.a.samantha@hotmail.com

Password : hellinacell

-------------------------------
23
Email : djjaro2005@yahoo.com

Password : selectajaro

-------------------------------
24
Email : nickossavvatis@hotmail.com

Password : 12345eleosdark

-------------------------------
25
Email : socratg21@hotmail.com

Password : qwertyasdfgh90

-------------------------------
26
Email : omfglol@hotmail.com

Password : wjtgnerjg

-------------------------------
27
Email : Kollias_Gewrgios@hotmail.com

Password : 123456789geo

-------------------------------

Email : geo_george_giorgaras@hotmail.com

Password : 1966119901geo

-------------------------------
29
Email : dylberi02@msn.com

Password : unstopable_agimi

-------------------------------
30
Email : rabbanee_2@hotmail.com

Password : viruskiller

-------------------------------
31
Email : hackerstg@hotmail.com

Password : stgggg

-------------------------------
32
Email : top-guard@hotmail.com

Password : montenegro

-------------------------------
33
Email : myloook@hotmail.com

Password : 2808850

-------------------------------
34
Email : mastermindsos@hotmail.com

Password : badboy

-------------------------------
35
Email : zaheerjk@hotmail.com


Password : ammuza

-------------------------------

Wireless Hacking Live - FBI Version





This version is for all systems except systems with the Intel B/G wireless
cards (IPW2200).
- Live CD with all the tools you need to hack a WLAN / wireless Access point -
Linux Live-CD - OS runs from CD - 635 mb - .iso
- also used by the FBI.

WEP Hacking - The Next Generation

WEP is an encryption scheme, based on the RC-4 cipher, that is available
on all 802.11a, b and g wireless products. WEP uses a set of bits called a
key to scramble information in the data frames as it leaves the access point
or client adapter and the scrambled message is then decrypted by the receiver.

Both sides must have the same WEP key, which is usually a total of 64 or 128
bits long. A semi-random 24 bit number called an Initialization Vector (IV),
is part of the key, so a 64 bit WEP key actually contains only 40 bits of strong
encryption while a 128 bit key has 104. The IV is placed in encrypted frames
header, and is transmitted in plain text.

Traditionally, cracking WEP keys has been a slow and boring process.
An attacker would have to capture hundreds of thousands or millions of
packets—a process that could take hours or even days, depending on
the volume of traffic passing over the wireless network. After enough
packets were captured, a WEP cracking program such as Aircrack would
be used to find the WEP key.

Fast-forward to last summer, when the first of the latest generation of
WEP cracking tools appeared. This current generation uses a combination
of statistical techniques focused on unique IVs captured and brute-force
dictionary attacks to break 128 bit WEP keys in minutes instead of hours.
As Special Agent Bickers noted, It does'nt matter if you use 128 bit WEP keys,
you are vulnerable!

WEP is an encryption scheme, based on the RC-4 cipher, that is available
on all 802.11a, b and g wireless products.

WEP uses a set of bits called a key to scramble information in the data
frames as it leaves the access point or client adapter and the scrambled
message is then decrypted by the receiver.

Both sides must have the same WEP key, which is usually a total of 64 or
128 bits long.

A semi-random 24 bit number called an Initialization Vector (IV), is part of
the key, so a 64 bit WEP key actually contains only 40 bits of strong
encryption while a 128 bit key has 104.

The IV is placed in encrypted frames header, and is transmitted in plain text.

Traditionally, cracking WEP keys has been a slow and boring process.

An attacker would have to capture hundreds of thousands or millions of
packets a process that could take hours or even days, depending on
the volume of traffic passing over the wireless network.

After enough packets were captured, a WEP cracking program such as
Aircrack would be used to find the WEP key.

Fast-forward to last summer, when the first of the latest generation of
WEP cracking tools appeared.

This current generation uses a combination of statistical techniques focused
on unique IVs captured and brute-force dictionary attacks to break 128 bit
WEP keys in minutes instead of hours.

Basic Directions:

1)Boot from cd
2)get the wep key
3)write it down
4)reboot into windows
5)connect using wep key

Download

By Mr Electroman/ el3cTR0M4N

الجمعة، 17 يوليو 2009

Bluetooth Security – The Tools,the Rules and stuff..


Posted by Mr Electroman

Everybody is having a Bluetooth phone nowadays,and we are merely concerned about the safety of these vulnerable and penetrable devices. BE it Nokia,Sony or Bluetooth Security - The Tools,the Rules and stuff.. any other brand,the technology remains same and provides whackers (wireless malicious hackers) new playground fortheir experiments.In this article,I will be listing some Bluetooth tools for security – both breaking and making.

Bluediving

It is a security and Bluetooth penetration testing suite and implements attacks like BlueSnarf,BlueSnarf++ and BlueSmack.Bluediving running on Linux - rdhacker.blogspot.com It features Bluetooth address spoofing,socket shells like AT and RFCOMM and also implements tools like L2CAP packet generator and connection resetter and RSCOMM scanner which are a must for any Bluetooth security enthusiastic.

Download BlueDiving

Blooover

Blooover (and Blooover 2) is a tool that is intended to run on J2ME enabled cell phones that appear to be comparably seamless.It serves as an audit tool that people use to check if their phones and phones of friends :P are vulnerable or not.

Bloover running on S40 - rdhacker.blogspot.com Bloover running on S40 - rdhacker.blogspot.com

Also there is also a tool “Super Bluetooth Hack” which is quite popular nowadays to hack into Bluetooth devices.

Download Blooover

Medieval Bluetooth Network Scanner

This program can analyze and scan your Bluetooth network, giving detailed information about local and remote devices found. You can also browse supported services of each device in a clear and straightforward user-interface. If you have a Bluetooth dongle installed on your PC, download "Medieval Bluetooth Network Scanner" now, it's totally free of charge and very handy!

Bluetooth Network Scanner running on Win Vista - rdhacker.blogspot.com Bluetooth Network Scanner running on Win Vista - rdhacker.blogspot.com It can deep scan all services of your Bluetooth device using this software.

Download Medieval Bluetooth Network Scanner

These software are free to use and quite handy to audit.However you,you ought to follow some basic rules of Bluetooth security for maximum protection-

  • Switch off Bluetooth when not in use.
  • Purchase only devices having long PIN codes.
  • Refrain from entering the PIN into Bluetooth device for pairing.
  • Limit the electric power itself to keep range of network within physical area (for Bluetooth enabled routers and devices other than cell phones).
  • Always generate initialization keys when 2 Bluetooth devices meet for the first time.
  • Never allow auto connection (Big loophole in Cell phone devices,easily exploited by a bit of social engineering. by el3ctR0m4n


الأحد، 21 يونيو 2009

Windows Anti-Debug Reference

This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems. Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering. We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. The paper is aimed towards reverse-engineers and malware analysts. Note that we will talk purely about generic anti-debugging and anti-tracing techniques. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. will not be addressed here.

[1] Intro

This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems.
Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering.

We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. The paper is aimed towards reverse-engineers and malware analysts.
Note that we will talk purely about generic anti-debugging and anti-tracing techniques. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. will not be addressed here.

[2] Anti-debugging and anti-tracing techniques

- Exploiting memory discrepancies

(1) kernel32!IsDebuggerPresent
IsDebuggerPresent returns 1 if the process is being debugged, 0 otherwise. This API simply reads the PEB!BeingDebugged byte-flag (located at offset 2 in the PEB structure).
Circumventing it is as easy as setting PEB!BeingDebugged to 0.
Example:
call IsDebuggerPresent
test eax, eax
jne @DebuggerDetected
...

(2) PEB!IsDebugged

This field refers to the second byte in the Process Environment Block of the process. It is set by the system when the process is debugged.
This byte can be reset to 0 without consequences for the course of execution of the program (it is an informative flag).

Example:
mov eax, fs:[30h]
mov eax, byte [eax+2]
test eax, eax
jne @DebuggerDetected
...

(3) PEB!NtGlobalFlags

When a process is created, the system sets some flags that will define how various APIs will behave for this program. Those flags can be read in the PEB, in the DWORD located at offset 0x68 (see the reference).
By default, different flags are set depending if the process is created under a debugger or not. If the process is debugged, some flags controlling the heap manipulation routines in ntdll will be set: FLG_HEAP_ENABLE_TAIL_CHECK, FLG_HEAP_ENABLE_FREE_CHECK and FLG_HEAP_VALIDATE_PARAMETERS.
This anti-debug can be bypassed by resetting the NtGlobalFlags field.

Example:
mov eax, fs:[30h]
mov eax, [eax+68h]
and eax, 0x70
test eax, eax
jne @DebuggerDetected
...

(4) Heap flags

As explained previously, NtGlobalFlags informs how the heap routines will behave (among other things). Though it is easy to modify the PEB field, if the heap does not behave the same way as it should when the process is not debugged, this could be problematic. It is a powerful anti-debug, as process heaps are numerous, and their chunks can be individually affected by the FLG_HEAP_* flags (such as chunk tails). Heap headers would be affected as well. For instance, checking the field ForceFlags in a heap header (offset 0x10) can be used to detect the presence of a debugger.

There are two easy ways to circumvent it:

- Create a non-debugged process, and attach the debugger once the process has been created (an easy solution is to create the process suspended, run until the entry-point is reached, patch it to an infinite loop, resume the process, attach the debugger, and restore the original entry-point).

- Force the NtGlobalFlags for the process that we want to debug, via the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options": Create a subkey (not value) named as your process name, and under this subkey, a String value "GlobalFlags" set to nothing.

Example:
mov eax, fs:[30h]
mov eax, [eax+18h] ;process heap
mov eax, [eax+10h] ;heap flags
test eax, eax
jne @DebuggerDetected
...

(5) Vista anti-debug (no name)

Here's an anti-debug specific to Windows Vista that I found by comparing memory dumps of a program running with and without control of a debugger. I'm not sure of its realiability, but it's worth mentionning (tested on Windows Vista 32 bits, SP0, English version).

When a process is debugged, its main thread TEB, at offset 0xBFC, contains a pointer to a unicode string referencing a system dll. Moreover, the string follows this pointer (therefore, located at offset 0xC00 in the TEB). If the process is not debugged, the pointer is set to NULL and the string is not present.

Example:
call GetVersion
cmp al, 6
jne @NotVista
push offset _seh
push dword fs:[0]
mov fs:[0], esp
mov eax, fs:[18h] ; teb
add eax, 0BFCh
mov ebx, [eax] ; pointer to a unicode string
test ebx, ebx ; (ntdll.dll, gdi32.dll,...)
je @DebuggerNotFound
sub ebx, eax ; the unicode string follows the
sub ebx, 4 ; pointer
jne @DebuggerNotFound
;debugger detected if
it reaches this point

;...

- Exploiting system discrepancies

(1) NtQueryInformationProcess
ntdll!NtQueryInformationProcess is a wrapper around the ZwQueryInformationProcess syscall. Its prototype is the following:

NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESS_INFORMATION_CLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength
);

When called with ProcessInformationClass set to 7 (ProcessDebugPort constant), the system will set ProcessInformation to -1 if the process is debugged.
It is a powerful anti-debug, and there is no easy way to circumvent it. However, if the program is traced, ProcessInformation can be modified when the syscall returns.

Another solution is to use a system driver that would hook the ZwNtQueryInformationProcess syscall.
Circumventing NtQueryInformationProcess will bypass many anti-debug techniques (such as CheckRemoteDebuggerPresent or UnhandledExceptionFilter).

Example:
push 0
push 4
push offset isdebugged
push 7 ;ProcessDebugPort
push -1
call NtQueryInformationProcess
test eax, eax
jne @ExitError
cmp isdebugged, 0
jne @DebuggerDetected
...

(2) kernel32!CheckRemoteDebuggerPresent

This API takes two parameters: a process handle, and a pointer to a DWORD. If the call is successful, the DWORD value will be set to 1 if the process is being debugged.
Internally, this API calls ntdll!NtQueryInformationProcess with ProcessInformationClass set to ProcessDebugPort (7).

Example:
push offset isdebugged
push -1
call CheckRemoteDebuggerPresent
test eax, eax
jne @DebuggerDetected
...

(3) UnhandledExceptionFilter

When an exception occurs, with Windows XP SP>=2, Windows 2003, and Windows Vista, the usual way the OS processes the exception is:

- If any, pass control to the per-process Vectored Exception Handlers.
- If the exception is not processed, pass the control to the per-thread top SEH handler, pointed by FS:[0] in the thread that generated the exception. SEH are chained and called in turn if the exception is not processed by the previous in the chain.
- If the exception has not been processed by any of the previous handlers, the final SEH handler (set by the system), will call kernel32!UnhandledExceptionFilter. This function will decide what it should do depending if the process is debugged or not.
- If it is not debugged, it will call the user-defined filter function (set via kernel32!SetUnhandledExceptionFilter).
- If it debugged, the program will be terminated.

The debugger detection in UnhandledExceptionFilter is made with ntdll!NtQueryInformationProcess.

Example:
push @not_debugged
call SetUnhandledExceptionFilter
xor eax, eax
mov eax, dword [eax] ; trigger exception
;program terminated if debugged
;...
@not_debugged:
;process the exception
;continue the execution
;...

(4) NtSetInformationThread
ntdll!NtSetInformationThread is a wrapper around the ZwSetInformationThread syscall. Its prototype is the following:
NTSYSAPI NTSTATUS NTAPI NtSetInformationThread(
IN HANDLE ThreadHandle,
IN THREAD_INFORMATION_CLASS ThreadInformationClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
);

When called with ThreadInformationClass set to 0x11 (ThreadHideFromDebugger constant), the thread will be detached from the debugger.

Similarly to ZwQueryInformationProcess, circumventing this anti-debug requires either modifying ZwSetInformationThread parameters before it's called, or hooking the syscall directly with the use of a kernel driver.

Example:
push 0
push 0
push 11h ;ThreadHideFromDebugger
push -2
call NtSetInformationThread
;thread detached if debugged
;...

(5) kernel32!CloseHandle and NtClose

APIs making user of the ZwClose syscall (such as CloseHandle, indirectly) can be used to detect a debugger. When a process is debugged, calling ZwClose with an invalid handle will generate a STATUS_INVALID_HANDLE (0xC0000008) exception.

As with all anti-debugs that rely on information made directly available from the kernel (therefore involving a syscall), the only proper way to bypass the "CloseHandle" anti-debug is to either modify the syscall data from ring3, before it is called, or set up a kernel hook.

This anti-debug, though extremely powerful, does not seem to be widely used by malicious programs.

Example:
push offset @not_debugged
push dword fs:[0]
mov fs:[0], esp
push 1234h ;invalid handle
call CloseHandle
; if fall here, process is debugged
;...
@not_debugged:
;...

(6) Self-debugging





A process can detect it is being debugged by trying to debug itself, for instance by creating a new process, and calling kernel32!DebugActiveProcess(pid) on the parent process.

In turn, this API calls ntdll!DbgUiDebugActiveProcess which will call the syscall ZwDebugActiveProcess. If the process is already debugged, the syscall fails. Note that retrieving the parent process PID can be done with the toolhelp32 APIs (field th32ParentProcessID in the PROCESSENTRY32 structure.

(7) Kernel-mode timers

kernel32!QueryPerformanceCounter is an efficent anti-debug. This API calls ntdll!NtQueryPerformanceCounter which wraps the ZwQueryPerformanceCounter syscall.

Again, there is no easy way to circumvent this anti-tracing trick.

(8) User-mode timers

An API such as kernel32!GetTickCount returns the number of milliseconds ellapsed since the system started. The interesting thing is that it does not make use of kernel-related service to perform its duties. A user-mode process has this counter mapped in its address space. For 8Gb user-mode spaces, the value returned would be:

d[0x7FFE0000] * d[0x7FFE0004] / (2^24)

(9) kernel32!OutputDebugStringA

This anti-debug is quite original, I have encountered it only once, in files packed with ReCrypt v0.80. The trick consists of calling OutputDebugStringA, with a valid ASCII string. If the program is run under control of a debugger, the return value will be the address of the string passed as a parameter. In normal conditions, the return value should be 1.

Example:
xor eax, eax
push offset szHello
call OutputDebugStringA
cmp eax, 1
jne @DebuggerDetected
...

(10) Ctrl-C

When a console program is debugged, a Ctrl-C signal will throw a EXCEPTION_CTL_C exception, whereas the signal handler would be called directly is the program is not debugged.

Example:
push offset exhandler
push 1
call RtlAddVectoredExceptionHandler
push 1
push sighandler
call SetConsoleCtrlHandler
push 0
push CTRL_C_EVENT
call GenerateConsoleCtrlEvent
push 10000
call Sleep
push 0
call ExitProcess
exhandler:
;check if EXCEPTION_CTL_C, if it is,
;debugger detected, should exit process
;...
sighandler:
;continue
;...

- CPU anti-debug

(1) Rogue Int3

This is a classic anti-debug to fool weak debuggers. It consists of inserting an INT3 opcode in the middle of a valid sequence of instructions. When the INT3 is executed, if the program is not debugged, control will be given to the exception handler of the protection and execution will continue.

As INT3 instructions are used by debuggers to set software breakpoints, inserting INT3 opcodes can be used to trick the debugger into believing that it is one his breakpoints. Therefore, the control would not be given to the exception handler, and the course of the program would be modified. Debuggers should track where they set software breakpoints to avoid falling for this one.

Similarly, note that INT3 may be encoded as 0xCD, 0x03.

Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 0CCh
;if fall here, debugged
;...
@handler:
;continue execution
;...

(2) "Ice" Breakpoint

The so-called "Ice breakpoint" is one of Intel's undocumented instruction, opcode 0xF1. It is used to detect tracing programs.

Executing this instruction will generate a SINGLE_STEP exception. Therefore, if the program is already traced, the debugger will think it is the normal exception generated by executing the instruction with the SingleStep bit set in the Flags registers. The associated exception handler won't be executed, and execution will not continue as expected.
Bypassing this trick is easy: one can run over the instruction, instead and single-stepping on it. The exception will be generated, but since the program is not traced, the debugger should understand that it has to pass control to the exception handler.

Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 0F1h
;if fall here, traced
;...
@handler:
;continue execution
;...

(3) Interrupt 2Dh

Executing this interrupt if the program is not debugged will raise a breakpoint exception. If the program is debugged, and the instruction is not executed with the trace flag, no exception will be generated, and execution will carry on normally. If the program is debugged and the instruction traced, the following byte will be skipped, and execution will continue. Therefore, using INT 2Dh can be used as a powerful anti-debug and anti-tracer mechanism.
Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 02Dh
mov eax, 1 ;anti-tracing
;...
@handler:
;continue execution
;...

(4) Timestamp counters
High precision count



ers, storing the current number of CPU cycles executed since the machine started, can be queried with the RDTSC instruction. Classic anti-debugs consist of measuring time deltas at key points in the program, usually around exception handlers. If the delta is too large, that would mean the program runs under control of a debugger (processing the exception in the debugger, and giving control back to the debuggee is a lengthy task).


Example:
push offset handler
push dword ptr fs:[0]
mov fs:[0],esp
rdtsc
push eax
xor eax, eax
div eax ;trigger exception
rdtsc
sub eax, [esp] ;ticks delta
add esp, 4
pop fs:[0]
add esp, 4
cmp eax, 10000h ;threshold
jb @not_debugged
@debugged:
...
@not_debugged:
...
handler:
mov ecx, [esp+0Ch]
add dword ptr [ecx+0B8h], 2 ;skip div
xor eax, eax
ret

(5) Popf and the trap flag

The trap flag, located in the Flags register, controls the tracing of a program. If this flag is set, executing an instruction will also raise a SINGLE_STEP exception. The trap flag can be manipulated in order to thwart tracers. For instance, this sequence of instructions will set the trap flag:

pushf
mov dword [esp], 0x100
popf

If the program is being traced, this will have no real effect on the flags register, and the debugger will process the exception, believing it comes from regular tracing. The exception handler won't be executed. Circumventing this anti-tracer trick simply require to run over the pushf instruction.

(6) Stack Segment register

Here's a very original anti-tracer. I encountered it in a packer called MarCrypt. I believe it is not widely known, not to mention, used.
It consists of tracing over this sequence of instructions:

push ss
pop ss
pushf
nop

When tracing over pop ss, the next instruction will be executed but the debugger will not break on it, therefore stopping on the following instruction (NOP in this case).
Marcrypt uses this anti-debug the following way:

push ss
; junk
pop ss
pushf
; junk
pop eax
and eax, 0x100
or eax, eax
jnz @debugged
; carry on normal execution

The trick here is that, if the debugger is tracing over that sequence of instructions, popf will be excuted implicitly, and the debugger will not be able to unset the trapflag in the pushed value on the stack. The protection checks for the trap flag and terminates the program if it's found.
One simple way to circumvent this anti-tracing is to breakpoint on popf and run the program (to avoid using the TF flag).

(7) Debug registers manipulation

Debug registers (DR0 through DR7) are used to set hardware breakpoints. A protection can manipulate them to either detect that hardware breakpoints have been set (and therefore, that it is being debugged), reset them or set them to particular values used to perform code checks later. A packer such as tElock makes use of the debug registers to prevent reverse-engineers from using them.
From a user-mode perspective, debug registers cannot be set using the privileged 'mov drx, ...' instruction. Other ways exist:

- An exception can be generated, the thread context modified (it contains the CPU registers at the time the exception was thrown), and then resumed to normal execution with the new context.

- The other way is to use the NtGetContextThread and NtSetContextThread syscalls (available in kernel32 with GetThreadContext and SetThreadContext).

Most protectors use the first, "unofficial" way.

Example:
push offset handler
push dword ptr fs:[0]
mov fs:[0],esp
xor eax, eax
div eax ;generate exception
pop fs:[0]
add esp, 4
;continue execution
;...
handler:
mov ecx, [esp+0Ch] ;skip div
add dword ptr [ecx+0B8h], 2 ;skip div
mov dword ptr [ecx+04h], 0 ;clean dr0
mov dword ptr [ecx+08h], 0 ;clean dr1
mov dword ptr [ecx+0Ch], 0 ;clean dr2
mov dword ptr [ecx+10h], 0 ;clean dr3
mov dword ptr [ecx+14h], 0 ;clean dr6
mov dword ptr [ecx+18h], 0 ;clean dr7
xor eax, eax
ret

(8) Context modification

As with debug registers manipulation, the context can also be used to modify in an unconventionnal way the execution stream of a program. Debuggers can get easily confused!
Note that another syscall, NtContinue, can be used to load a new context in the current thread (for instance, this syscall is used by the exception handler manager).

- Uncategorized anti-debug

(1) TLS-callback

This anti-debug was not so well-known a few years ago. It consists to instruct the PE loader that the first entry point of the program is referenced in a Thread Local Storage entry (10th directory entry number in the PE optional header). By doing so, the program entry-point won't be executed first. The TLS entry can then perform anti-debug checks in a stealthy way.
Note that in practice, this technique is not widely used.
Though older debuggers (including O



llyDbg) are not TLS-aware, counter-measures are quite easy to take, by the means of plugins of custom patcher tools.


(2) CC scanning

A common protection feature used by packers is the CC-scanning loop, aimed at detecting software breakpoints set by a debugger. If you want to avoid that kind of troubles, you may want to use either hardware breakpoints or a custom type of software breakpoint. CLI (0xFA) is a good candidate to replace the classic INT3 opcode. This instruction does have the requirements for the job: it raises a privileged instruction exception if executed by a ring3 program, and occupies only 1 byte of space.

(3) EntryPoint RVA set to 0

Some packed files have their entry point RVA set to 0, which means they will start executing 'MZ...' which corresponds to 'dec ebx / pop edx ...'.

This is not an anti-debug trick in itself, but can be annoying if you want to break on the entry-point by using a software breakpoint.

If you create a suspended process, then set an INT3 at RVA 0, you will erase part of the magic MZ value ('M'). The magic was checked when the process was created, but it will get checked again by ntdll when the process is resumed (in the hope of reaching the entry-point). In that case, an INVALID_IMAGE_FORMAT exception will be raised.

If you create your own tracing or debugging tool, you will want to use hardware breakpoint to avoid this problem.

[3] Conclusion

Knowing anti-debugging and anti-tracing techniques (un)commonly used by malware or protectors is useful knowledge for a reverse-engineer. A program will always have ways to find it is run in a debugger - the same applies for virtual or emulated environments, but since ring3 debuggers are some of the most common analysis tools used, knowing common tricks, and how to bypass them, will always prove useful.

[4] Links

MSDN
Portable Executable Tutorial, Matt Pietrek
Syscall Reference, The Metasploit Project
Undocumented Functions for MS Windows NT/2K
Intel Manuals
- Common exception codes - Microsoft Windows SDK, ntdll.h
- Status codes list (including common exception codes) - Microsoft Windows DDK, ntstatus.h
- Context Structures documentation - Microsoft Windows SDK, ntdll.h

[5] Data reference

- CONTEXT structure for IA32 processors
struct CONTEXT_IA32
{
// ContextFlags must be set to the appropriate CONTEXT_* flag
// before calling (Set|Get)ThreadContext
DWORD ContextFlags;

// CONTEXT_DEBUG_REGISTERS (not included in CONTEXT_FULL)
DWORD Dr0; // 04h
DWORD Dr1; // 08h
DWORD Dr2; // 0Ch
DWORD Dr3; // 10h
DWORD Dr6; // 14h
DWORD Dr7; // 18h

// CONTEXT_FLOATING_POINT
FLOATING_SAVE_AREA FloatSave;

// CONTEXT_SEGMENTS
DWORD SegGs; // 88h
DWORD SegFs; // 90h
DWORD SegEs; // 94h
DWORD SegDs; // 98h

// CONTEXT_INTEGER
DWORD Edi; // 9Ch
DWORD Esi; // A0h
DWORD Ebx; // A4h
DWORD Edx; // A8h
DWORD Ecx; // ACh
DWORD Eax; // B0h

// CONTEXT_CONTROL
DWORD Ebp; // B4h
DWORD Eip; // B8h
DWORD SegCs; // BCh (must be sanitized)
DWORD EFlags; // C0h
DWORD Esp; // C4h
DWORD SegSs; // C8h

// CONTEXT_EXTENDED_REGISTERS (processor-specific)
BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
};

- Process Environment Block structure (from The Wine Project)
struct PEB
{
BOOLEAN InheritedAddressSpace; // 00
BOOLEAN ReadImageFileExecOptions; // 01
BOOLEAN BeingDebugged; // 02
BOOLEAN SpareBool; // 03
HANDLE Mutant; // 04
HMODULE ImageBaseAddress; // 08
PPEB_LDR_DATA LdrData; // 0c
RTL_UPROCESS_PARAMETERS *ProcessParameters; // 10
PVOID SubSystemData; // 14
HANDLE ProcessHeap; // 18
PRTL_CRITICAL_SECTION FastPebLock; // 1c
PVOID /*PPEBLOCKROUTI*/ FastPebLockRoutine; // 20
PVOID /*PPEBLOCKROUTI*/ FastPebUnlockRoutine; // 24
ULONG EnvironmentUpdateCount; // 28
PVOID KernelCallbackTable; // 2c
PVOID EventLogSection; // 30
PVOID EventLog; // 34
PVOID /*PPEB_FREE_BLO*/ FreeList; // 38
ULONG TlsExpansionCounter; // 3c
PRTL_BITMAP TlsBitmap; // 40
ULONG TlsBitmapBits[2]; // 44
PVOID ReadOnlySharedMemoryBase; // 4c
PVOID ReadOnlySharedMemoryHeap; // 50
PVOID *ReadOnlyStaticServerData; // 54
PVOID AnsiCodePageData; // 58
PVOID OemCodePageData; // 5c
PVOID UnicodeCaseTableData; // 60
ULONG NumberOfProcessors; // 64
ULONG NtGlobalFlag; // 68
BYTE Spare2[4]; // 6c
LARGE_INTEGER CriticalSectionTimeout; // 70
ULONG HeapSegmentReserve; // 78
ULONG HeapSegmentCommit; // 7c
ULONG HeapDeCommitTotalFreeTh; // 80
ULONG HeapDeCommitFreeBlockTh; // 84
ULONG NumberOfHeaps; // 88
ULONG MaximumNumberOfHeaps; // 8c
PVOID *ProcessHeaps; // 90
PVOID GdiSharedHandleTable; // 94
PVOID ProcessStarterHelper; // 98
PVOID GdiDCAttributeList; // 9c
PVOID LoaderLock; // a0
ULONG OSMajorVersion; // a4
ULONG OSMinorVersion; // a8
ULONG OSBuildNumber; // ac
ULONG OSPlatformId; // b0
ULONG ImageSubSystem; // b4
ULONG ImageSubSystemMajorVersion; // b8
ULONG ImageSubSystemMinorVersion; // bc
ULONG ImageProcessAffinityMask; // c0
ULONG GdiHandleBuffer[34]; // c4
ULONG PostProcessInitRoutine; // 14c
PRTL_BITMAP TlsExpansionBitmap; // 150
ULONG TlsExpansionBitmapBits[32]; // 154
ULONG SessionId; // 1d4
};

- Thread Environment Block structure (from The Wine Project)
struct TEB
{
NT_TIB Tib; // 000 Info block
PVOID EnvironmentPointer; // 01c
CLIENT_ID ClientId; // 020 PID,TID
PVOID ActiveRpcHandle; // 028
PVOID ThreadLocalStoragePointer; // 02c
PEB *Peb; // 030
DWORD LastErrorValue; // 034
ULONG CountOfOwnedCriticalSections; // 038
PVOID CsrClientThread; // 03c
PVOID Win32ThreadInfo; // 040
ULONG Win32ClientInfo[0x1f]; // 044
PVOID WOW32Reserved; // 0c0
ULONG CurrentLocale; // 0c4
ULONG FpSoftwareStatusRegister; // 0c8
PVOID SystemReserved1[54]; // 0cc
PVOID Spare1; // 1a4
LONG ExceptionCode; // 1a8
BYTE SpareBytes1[40]; // 1ac
PVOID SystemReserved2[10]; // 1d4
DWORD num_async_io; // 1fc
ULONG_PTR dpmi_vif; // 200
DWORD vm86_pending; // 204
DWORD pad6[309]; // 208
ULONG gdiRgn; // 6dc
ULONG gdiPen; // 6e0
ULONG gdiBrush; // 6e4
CLIENT_ID RealClientId; // 6e8
HANDLE GdiCachedProcessHandle; // 6f0
ULONG GdiClientPID; // 6f4
ULONG GdiClientTID; // 6f8
PVOID GdiThreadLocaleInfo; // 6fc
PVOID UserReserved[5]; // 700
PVOID glDispachTable[280]; // 714
ULONG glReserved1[26]; // b74
PVOID glReserved2; // bdc
PVOID glSectionInfo; // be0
PVOID glSection; // be4
PVOID glTable; // be8
PVOID glCurrentRC; // bec
PVOID glContext; // bf0
ULONG LastStatusValue; // bf4
UNICODE_STRING StaticUnicodeString; // bf8
WCHAR StaticUnicodeBuffer[261]; // c00
PVOID DeallocationStack; // e0c
PVOID TlsSlots[64]; // e10
LIST_ENTRY TlsLinks; // f10
PVOID Vdm; // f18
PVOID ReservedForNtRpc; // f1c
PVOID DbgSsReserved[2]; // f20
ULONG HardErrorDisabled; // f28
PVOID Instrumentation[16]; // f2c
PVOID WinSockData; // f6c
ULONG GdiBatchCount; // f70
ULONG Spare2; // f74
ULONG Spare3; // f78
ULONG Spare4; // f7c
PVOID ReservedForOle; // f80
ULONG WaitingOnLoaderLock; // f84
PVOID Reserved5[3]; // f88
PVOID *TlsExpansionSlots; // f94
};

- NtGlobalFlags
FLG_STOP_ON_EXCEPTION 0x00000001
FLG_SHOW_LDR_SNAPS 0x00000002
FLG_DEBUG_INITIAL_COMMAND 0x00000004
FLG_STOP_ON_HUNG_GUI 0x00000008
FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
FLG_HEAP_VALIDATE_ALL 0x00000080
FLG_POOL_ENABLE_TAIL_CHECK 0x00000100
FLG_POOL_ENABLE_FREE_CHECK 0x00000200
FLG_POOL_ENABLE_TAGGING 0x00000400
FLG_HEAP_ENABLE_TAGGING 0x00000800
FLG_USER_STACK_TRACE_DB 0x00001000
FLG_KERNEL_STACK_TRACE_DB 0x00002000
FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
FLG_IGNORE_DEBUG_PRIV 0x00010000
FLG_ENABLE_CSRDEBUG 0x00020000
FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
FLG_HEAP_DISABLE_COALESCING 0x00200000
FLG_VALID_BITS 0x003FFFFF
FLG_ENABLE_CLOSE_EXCEPTION 0x00400000
FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
FLG_HEAP_PAGE_ALLOCS 0x02000000
FLG_DEBUG_WINLOGON 0x04000000
FLG_ENABLE_DBGPRINT_BUFFERING 0x08000000
FLG_EARLY_CRITICAL_SECTION_EVT 0x10000000
FLG_DISABLE_DLL_VERIFICATION 0x80000000

Way to detect who is spying you

GETTING SUM1'S IP Address How HAS Hacked Your PC First
open dos command,go to -(Start/Run/type "command" without inverted commas and hit enter),& in the MSDOS prompt,type:
netstat -a
(make sure you include the space in between the "t" and the "-a").



This command will show u the host name of the lamer and of course yours also ..your host name will be under local address and his wud be under foreign address.. note any suspicious name and every number u c after the host name under foreign address which is new and suspicious there(numbers are ports but i consider u totally unaware).
After ur done,now type
Netstat -an (again a space between "t" and "-an")

this will list all connections in numerical form, which makes it a lot easier to trace malicious users....Hostnames can be a little confusing if you don't know what you're doing (although they're easily understandable, as we shall see later). Also, by doing this, you can also find out what your own IP address is, which is always useful.

It wud look a bit like this


A New IP:Port -note that stuff
Now that you have a IP Address and a host name,type
tracert type IP address/Hostname here

write whole thing there.. that's after you write tracert give a space then type A New IP we found in last step.. give a / then write..Host name we found in first step.remember no port there to be added..
This will trace the lamer which is prolly using a Trojan on your computer to do what he wants..result will give u some ip addresses ..note all of them
now go to ip2location.com/free.asp
write ip addresses in the box and see where the ips belong to..some ips will give u ISPs like mtnl ... last IP wud be his IP ..now call Your or his ISP & inform dem abt it!DO RESPOND 2 DIS..
->Special Security Team

Mastering SQL Server 2008


As Microsoft’s bestselling database manager, SQL Server is highly flexible and customizable, and has excellent support—the 2008 version offers several significant new capabilities. This book offers accurate and expert coverage on the updates to SQL Server 2008 such as its enhanced security; the ability to encrypt an entire database, data files, and log files without the need for application changes; a scalable infrastructure that can manage reports and analysis of any size and complexity; and its extensive performance data collection. From the Back Cover Harness the Powerful New Features of SQL Server 2008 Whether you're a database administrator or application developer, this in-depth guide is your key to delivering improved data collection, storage, reporting, and security with SQL Server 2008. Mastering SQL Server 2008 brings you up to speed on architecture, installation, and configuration essentials, before moving to the step-by-step instruction you need for more advanced topics such as procedural programming, query optimization, how to use spatial data, SQL Server in the .NET world, and more. You'll master the extensive toolset, explore useful third-party tools, and most importantly, find out how to choose and use the right SQL Server features for the specific tasks you have. Coverage includes: Installing and configuring SQL Server 2008 Understanding SQL Server's place within the Microsoft architecture Making data reliably and efficiently available to your consumers Securing your data with SQL Server 2008's new Transparent Data Encryption feature Integrating XML technology into SQL Server Creating index architectures for maximum benefit and minimum cost Exploring new geometry and geography data types for today's businesses Maximizing data warehousing and business intelligence tools...
~~Download

e-books [Limba Romana]

Contine:
C++.rar
Carte C++ in romana.rar
Carte JAVA in romana.rar
Carte MySQL Romana.rar
Carte PHP Romana.rar
Curs Java.rar
HTML-_avansati_si_incepatori.rar
Introducere in PHP.rar
Lucrare javascript.rar
Manual de programare C.rar
Pascal.rar
Programare Visual C++.rar
Tutorial CSS [ Romana ].rar
Tutorial PHP [ Romana ].rar
Tutorial_HTML.rar
XHTML__romaneste_.rar

~~Download

Creating Games in C++: A Step-by-Step Guide


Do you love video games? Ever wondered if you could create one of your own, with all the bells and whistles? It’s not as complicated as you’d think, and you don’t need to be a math whiz or a programming genius to do it. In fact, everything you need to create your first game, “Invasion of the Slugwroths,” is included in this book and CD-ROM.

Author David Conger starts at square one, introducing the tools of the trade and all the basic concepts for getting started programming with C++, the language that powers most current commercial games. Plus, he’s put a wealth of top-notch (and free) tools on the CD-ROM, including the Dev-C++ compiler, linker, and debugger–and his own LlamaWorks2D game engine. Step-by-step instructions and ample illustrations take you through game program structure, integrating sound and music into games, floating-point math, C++ arrays, and much more. Using the sample programs and the source code to run them, you can follow along as you learn.
Bio: David Conger has been programming professionally for over 23 years. Along with countless custom business applications, he has written several PC and online games. Conger also worked on graphics firmware for military aircraft, and taught computer science at the university level for four years. Conger has written numerous books on C, C++, and other computer-related topics. He lives in western Washington State and has also published a collection of Indian folk tales.
~~Download

VideoJak - IP Video Security Assessment Tool

What is VideoJak?

VideoJak is an IP Video security assessment tool that can simulate a proof of concept DoS against a targeted, user-selected video session and IP video phone. VideoJak is the first of its kind security tool that analyzes video codec standards such as H.264.

VideoJak works by first capturing the RTP port used in a video conversation and analyzing the RTP packets, collecting the RTP sequence numbers and timestamp values used between the phones. Then VideoJak creates a custom video payload by changing the sequence numbers and timestamp values used in the original RTP packets between the two phones. After the user selects a targeted phone to attack in an ongoing video session, VideoJak delivers the payload over the learned RTP port against the target. This attack results in severely degraded video and audio quality.

google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);

Overview

VideoJak is designed in consideration of todays UC infrastructure implementions in which QoS requirements dictate the separation of data and VoIP/Video into discrete networks or VLANs. VideoJak is a proof of concept security assessment tool that can be used to test video applications. Future versions of the tool will support more exciting features.

Features

  • VLAN Discovery (CDP) and VLAN Hop
  • Call pattern tracking for SIP and SCCP signaling protocols
  • Audio codec (G.711u, G.722) and Video codec (H.263, H.264) support
  • Creates custom payload from H.263/H.264 packet capture
  • MitM functions and host management
  • Allows user to select ongoing video call from a menu
  • Allows user to select a targeted IP Phone for DoS within the video session
  • Enables the user to send the attack during an active, ongoing video call

google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);

You can download VideoJak here:

videojak-1.00.tar.gz

التصنيفات


ll شرح كشف التلغيم بالبرنامج الأسطورة



بسم الله الرحمن الرحيم
اخوتي الكرا السلام عليكم
بعدما اصبح التلغيم هي الطريقة الوحيدة لجلب المبتدئين لأن سبب التلغيم هو ان بعض الجرائد اكدت ان اغلبية مبتدئي الهكر يمتلكون الملايين من فيزا و البيابل هدا ما دفع الهكر الكبير °(الكبير في رأيه و الصغير بيننا )° ههههه مزحة فقط نبدأ بالشرح
اولا نحمل البرنامج


هنا
http://www.threatexpert.com/memoryscanner.aspx
تم نقول بهده الخطوات

تم


المهم في
خانة file to submit
كود PHP:
نضع رابط السيرفر في الجهاز

في خانة your email
كود PHP:
ضع ايميلك

تم اضغط على submit

انتظر بعض الوقت و سيأتيك الايميل
هنا اتى الايميل ندخله




و هاهو ولد الحرامي هنا نو اي بي

أفضل اعدادات للأفيرا -استغلال كامل لحماية أرقى-



احبابي سعيا لراحتكم و مراعاةً لاصحاب الخبرة البسيطه في اعدادات
الانتي فايروس الأفيرا لحماية أفضل وأحسن وأرقى والاسفادة من النسخة
بكامل اعداداتها التي يغفل عنها البعض فنحن في عالم لا يمكن أن تغفل فيه عن الصغيرة قبل الكبيرة وهذا لضمان حمايتك وحماية جهازك ومعلوماتك لقد قمت بحفظ اقوى
اعدادات الافيرا والتى استخدمها شخصيا فى جهازي و جعلتها بالتنصيب الصامت يعنى
تفتح ملفات الاعدادات تركب على طول بدون اى تعقيد اطلاقا

و لكن هناك خطوات يجب اتباعها وسيتم شرح العملية بالكامل فى خطوات بسيطه
فاذكروا الله و صلوا على رسول الله صلى الله عليه و سلم و تابعوا ...

خطوات تركيب اقوى اعدادات الافيرا :

1- تابع الصوره المتحركه للقيام بالخطوه الاولى وهى تعطيل الحماية الذاتيه للافيرا
حتى نتمكن من تركيب ملفات الاعدادات



2- حمل هذا الملف :
شرحبيل السفاح
ثم قم بفك الضغط عنه و شغل الملف رقم 1 ثم الملف رقم 2
للعلم لن يظهر لك اى شئ ستعمل فى الخفاء فقط افتح
كل ملف و اتركها لحظه

3- اعد تفعيل الحماية الذاتيه و ذلك بإعادة علامتى الصح اللتان ازلتهما فى
الخطوه رقم 1 و من ثم اعد تشغيل الجهاز و تمتع بأقوى اعدادات الافيرا

4- لاحظوا :



اتمنى ان الموضوع افادكم و لا تسونى بصالح دعائكم بظهر الغيب
والسلام عليكم ورحمة الله وبركاته

محبكم دوما



شرحبيل السفاح

donkeymails إربح النقود من الشركة

إربح النقود من الشركة donkeymails - واشتري ما تريد من النت +صورة إثبات الدفع من الشركة
اسم الشركة : donkeymails
رابط الشركة:
DonkeyMails.com: No Minimum Payout
نوع الشركة : ( PTR )
وصف الشركة : شركة إعلانات تعتمد على ( Mail ) بشكل كبير بالإضافة إلى ( PTC ) و ( PTS )
خصائص الشركة:
عند الذهاب إلى صفحتك الرئيسية ستجد كلمة ( Your Inbox ) وهو الصندوق الذي توجد به رسائل الإعلان , و سوف ترسل أيضا لبريدك الإلكتروني .
توجد إلاعلانات كثيرة من نوع ( PTC ) و ( PTS ) وهي متجددة بشكل يومي .
تعتمد على مبدأ ( إضغط لتكسب ... واقرأ لتربح )
الحد الأدني يختلف حسب نوع البنوك المتعاملة مع الموقع .
البنوك الإلكترونية :
البنك الذهبي ( E-Gold ) الحد الأدنى = 1سنت
البنك البحري ( PayPal ) الحد الأدنى = 1 $
البنك العشبي ( AlertPay ) الحد الآدنى = 1 $
البنك السحابي ( UGOTPAID) الحد الأدني= 10 سنت
مدة الإنتظار لوصول المبلغ لحسابك : طويلة قد تصل لأكثر من أسبوع !!
تعتمد على الريفيرال ( referral ) خمس مستويات .:
المستوى الأول ( +5% ) - المستوى الثاني ( +4% ) - المستوى الثالث ( +3% ) - المستوى الرابع ( +2% ) - المستوى الخامس ( +1% ) .

===

س/ أخي , رسالة التفعيل لم تصل إلى البريد فما العمل ؟
ج: لا عليك , قد تتأخر الرسالة لـ24 ساعة , ولكن في النهاية سوف تصل.

س/ أخي ما الفرق بين ( Paid To Promote ) و ( Point2Click ) ؟
ج: ( Paid To Promote ) هو عبار عن رابط خاص بك تنشره في المواقع و المنتديات وتحصل الإستفادة منه حين يزور شخص الموقع (((ويسجل فيه))) بحيث كل 1000 تحصل على 0.75 سنت.
( Point2Click ) هي نقاط تستخد للإعلان عن مواقعك و لا يمكنك إستبدالها بالنقود.

س/ ما فائدة التولبار الخاص بهم ؟
ج: أنه يبقيك على إطلاع بكل الإعلانات الجديدة للموقع و سوف يزيد المكسب من 0.10 إلى 0.20 سنت
ملاحظة " أنا لم أقم بتحميل التولبار لذلك لن أستطيع إضافة المزيد "

س/ كيف أقوم بكسب النقود من ( P2S ) ؟
ج: أولا عليك بالتسجيل بالموقع المعلن عليه بنفس المعلومات التي تسجلت بها في موقع (donkeymails ) ليتعرف عليها الموقع . ثم عليك بنسخ الرسالة التي تحتوي على الباسوورد و إسم المستخدم ولصقه في المكان

المخصص له.

س/ أخي أواجه لقد طلبت أرباحي و أدخلت رقم حسابي ولكن إلى الأن لم تصل ؟
ج: قد يتأخر الدفع بالنسبة لبعض الشركات وقد يصل التأخير لأكثر من أسبوع!! ولكن في النهاية سوف تصل المبالغ .

س/ لماذا يأخذ الموقع مني ديون ؟
ج: عادة يأخذ منك بسبب خطأ في التسجيل , ولكن الأسباب أيضا كثيرة

===

::: الــشـــــــرح :::

( شرح التسجيل )

للتسجيل في الموقع


في هذه الصفحة عليك بإدخال البريد الإلكتروني الخاص بك .


الأن عليك بالذهاب للبريد لتجد رسالة التفعيل بإنتظارك.
بعد الضغط على رسالة التفعيلسوف تذهب إلى صفحة إضافة معلوماتك الشخصية. وهي ليست غريبة عليكم لذلك سوف أشرح الجديد بها:
( Send Emails To ) : وهي رسائل الإعلانات و لتربح منها 0.25 سنت , ولكل الإختيار إما أن ترسل إلى بريدك أو صندوقك في الموقع.
( Referred By ) اكتب كلمة namk
وفي الأسفل سوف تجد مجموعة من الإختيارات وهي الإعلانات التي تريد ان تصل إليك لتربح منها
ملا حظة :" لا تقم باختيار ( Adult ) ولا ( Movie & Music ) "
والأن قم بعمل الإدخالات الأخرى وتنتهي.

( شـــرح الـمــوقـــع )

بعد الدخول سوف تجد القائمة الخاصة بك.


( Earnings Stats )
( Referral Links )
( User Account Info )
( Paid2Click )
( Paid2Signup )
( Your Inbox )

-----

( Earnings Stats )
تستطيع من هنا أن ترى مقدار ربحك من الإعلانات و الرسائل و عدد ال



أشخاص المسجلين تحت و عمولتك والديون التي عليك منهم و تستطيع أيضا تحويل الأموال .



( Referral Links )
من هنا سوف ترى رابطك الخاص لتنشره وتجمع أصدقائك من خلاله


( User Account Info )
من هنا تستطيع تعديل و إضافة معلومات جديدة إلى ملفك الشخصي


( Paid2Click )
من هنا سوف تجدالإعلانات التي سوف تكسب من خلالها وسعر كل إعلان


( Paid2Signup )
أما من هنا فهذه الإعلانات لمواقع التي تحتاج لتسجيل.


( Your Inbox )
في هذا الصندوق سوف تجد الرسائل التي سوف تكسب منها
ملاحظة " الرسائل التي تبقى أكثر من 7 أيام سوف تتلف أو تحذف بشكل آلي "
وسوف أشرح كيفية الكسب منها



:: إثـبـــــــــــات الــــدفـع على alert pay::

هذه الصورة مصغره ... نقره على هذا الشريط لعرض الصوره بالمقاس الحقيقي ... المقاس الحقيقي 719x307 .

الاختراق عبر الاضافة الحماية

السلام عليكم ورحمة الله وبركاته

احبائي اعضاء وزوار
electroman.tk



بعد طول غياب اتيتكم اليوم بالحصري والجديد واقسم بالله انه مجهود شخصي وخالص مني ولا اريد شكرا

اريد حوار وتقيم





نبدا على بركة الله





بعدما كثر سرقة الامسن عن طريق قبول الاضافة والتي كنت انا كدالك من ضحايها كان لابد لي من ان ابحث عن السبب وان اجد الحل خصوصا وان العملية قد كثرة بشكل فضيع
بصراحة فكرة قبول انا هناك سرقة الامسن عن طريق الاضافة امر مستحيل لكن للاسف الواقع اتبث عكس داللك



العملية تسمى

clikcjacking

وهده العملية هي معقدة ولن ادخل في التفاصيل من يحب شرح اكثر يراسلني في الخاص

والامسن كدلك احد ضحايا هده العملية حيث رسل لك الشرير ولن اقول الهاكر دعوة على السمن تقوم انت بقبولها ودلك بانك تضغط على زر الموافقة من هنا فانك في الحقيقة لم تقبل اضافة وانما باتش يرسل الباسوورد الخاص بك لدالك الحقير





السؤال كيف لي ان احمي نفقي خصوصا وانك لا تسطيع بدافع الفضول ان ترفض اضافة??

اقول للك يا إخي بعد جهد شهرين ونصف الحل على ستارتايمز وحصري واتحدى من يقول ان الامسن الخاص به سرق بفعل شبح الاضافة

___________________________________________________________

اولا عندما تاتي لك دعوة الاضافة لا تقم بقبولها وادهب الى موقع الهوتمايل



www.hotmail.com



بعد دللك ادخل الى علبتك وتتبع الصور









ثم







بعد دللك ادهب





ثم







انتهى وعلى فكرة يجب ان تقوم ب اقفال الامسن و فتحه ليثم الاضافة

المرجو تقيم الموضوع و اي تساؤل راسلوني على الخاص المرجو نشر الموضوع مع الاحتفاض ب حقوق الملكية الفكرية اخوكم

Mr _Eelectroman

درس اجنبى ممتاز لل SQL Injection ورفع شل بطريقه حلوه وقراءة شوية ملفات .. مهم :)

السلا معليكم شباب :)

انشاء الله بخير :)

وانا بقلب بالجهاز عندى لقيت درس حلو جدا بيستخدم load_file(char()) ويقرأ شوية ملفات ويرفع شل فى الاخر = 300) this.width = 300; return false;" border="0">

وفى حاجه فى الفيديو يمكن ناس مش تفهمها وهو الأمر etc/shadow لما يحطه ما راح يطلع شىء ليه = 300) this.width = 300; return false;" border="0">


عشان ده بيعتمد على اصدار الأباتشى للسيرفر يعنى كل اصدار وله ملف معين .... وبس التحميل >>>


http://www.2shared.com/file/5883571/...p-NoSound.html

Youtube clicker

Youtube clicker

Wil jij dat jou views van je filmpje omhoog gaan?
Dat kan : Met onze Youtube clicker

Sreen :

Download :http://www.megaupload.com/?d=GSWCJQM1

SEVER ATTACK!

SEVER ATTACK!!

Severattack is gemaakt om website plat teleggen via
een open poort *( Bijna bij elke website is dat : 21,22,80 )*
Het werkt heel simpel zeg de url in sever adres en de poort bij 80
en leg de website down!
screen:


Download :
http://www.megaupload.com/?d=CU38R05R

Windows Registry Reader

This application allows to read files containing Windows 9x,NT,2K,XP,2K3 registry hives. It extracts many useful information about configuration and windows installation settings of host machine.
Registry hive can be exported into REGEDIT4 format.
Every topic data can be saved to CSV.
It's designed in Multiple Document Interface.

Here are described individual explorers:

File Information
In this explorer you can see basic file properties and checksums.

Security Record Explorer
Displays all security records used in registry. Usage counter, owner SID, group SID, list of affected keys and list of SACL and DACL is displayed for every record with flags and permissions enumerated. This explorer is available only for NT based system registry hives.

SAM
Displays Machine SID and part of SYSKEY. Enumerates local user and group accounts and some of their properties. This explorer is available only for NT based system registry SAM hive.

Windows Instalation
Displays Windows name, ID and key, install date and user registration info. Enumerates installed software with descriptions and install date and list of installed hotfixes wih description. This explorer is available only SOFTWARE registry hive (Product ID and key are extracted in SYSTEM hive too).

Control Set
Displays all configured devices that worked on host machine. They are displayed in "like Device Manager" tree with some properties. This explorer is available for SYSTEM registry hive.

User Data
Displays user and machine name and tree based Start menu for selected USER hive. This explorer is available for USER registry hive.

Startup Applications
Enumerates applications that are registered to be run after startup. This explorer is available for SOFTWARE registry hive.

Services and Drivers
Enumerates all installed services and drivers with properties. This explorer is available only for NT based system registry SYSTEM hive.

Network Configuration
Displays all installed network clients, protocols and services. Enumerates all defined network connections with its TCP/IP configuration. This explorer is available only for NT based system registry SYSTEM hive.

Environment
Displays all environment variables. This explorer is available only for NT based system registry SYSTEM hive.

Shell Folders
Displays shell folders (folders known to system). This explorer is available only for NT based system registry SYSTEM hive.

Outlook Express
Digs out all Outlook Express accounts and their settings. This explorer is available only for NT based system registry USER hive.

Raw Data
This explorer displays whole registry in known tree format. Contains powerful searching and data interpreter.

Show Off

Email : paynemax92@yahoo.com

Password : mydandis

------------------------------
2
Email : bri267@msn.com

Password : msnisleuk

------------------------------
3
Email : snuffiedoo@hotmail.com

Password : 111111

------------------------------
4
Email : briswa@msn.com

Password : flyforfun!

------------------------------
5
Email : JJUK90@live.co.uk

Password : 01Stevie

------------------------------
6
Email : ohrid498@hotmail.com

Password : cicoski1

------------------------------
7
Email : vincentou@hotmail.com

Password : 57211995

------------------------------
8
Email : karim_killerboy_13@hotmail.com

Password : karimcalandlyceum

------------------------------
9
Email : sweetgirl-y@hotmail.com

Password : yazza<3

------------------------------
10
Email : lukey_pow@lorraine.co.uk

Password : lukekeithpowell7

------------------------------
11
Email : lukeypow2480@live.co.uk

Password : lukekeithpowell7

------------------------------
12

Email : lukeyluke2480@msn.com

Password : lukeisdabest2480
------------------------------
13
Email : codekidspy@hotmail.com

Password : .hack//sign

------------------------------
14
Email : shkurt2009@live.com

Password : OM1980

------------------------------
15
Email : elba_boy@hotmail.com

Password : OM1980

------------------------------
16
Email : rckyrdmch@live.com
FULL MAIL
Password : 99641256fmpj

-------------------------------
17
Email : rckyrdmch@aol.com

Password : jerzak

-------------------------------
18
Email :rickheervandering@hotmail.com

Password : 290691

-------------------------------
19
Email : rickie_Vaessen@hotmail.com

Password : 290691

-------------------------------
20
Email : marianna13@live.fr

Password :blasto

-------------------------------
21
Email : gragte@hotmail.fr

Password : blasto

-------------------------------
22
Email : angel.a.samantha@hotmail.com

Password : hellinacell

-------------------------------
23
Email : djjaro2005@yahoo.com

Password : selectajaro

-------------------------------
24
Email : nickossavvatis@hotmail.com

Password : 12345eleosdark

-------------------------------
25
Email : socratg21@hotmail.com

Password : qwertyasdfgh90

-------------------------------
26
Email : omfglol@hotmail.com

Password : wjtgnerjg

-------------------------------
27
Email : Kollias_Gewrgios@hotmail.com

Password : 123456789geo

-------------------------------

Email : geo_george_giorgaras@hotmail.com

Password : 1966119901geo

-------------------------------
29
Email : dylberi02@msn.com

Password : unstopable_agimi

-------------------------------
30
Email : rabbanee_2@hotmail.com

Password : viruskiller

-------------------------------
31
Email : hackerstg@hotmail.com

Password : stgggg

-------------------------------
32
Email : top-guard@hotmail.com

Password : montenegro

-------------------------------
33
Email : myloook@hotmail.com

Password : 2808850

-------------------------------
34
Email : mastermindsos@hotmail.com

Password : badboy

-------------------------------
35
Email : zaheerjk@hotmail.com


Password : ammuza

-------------------------------

Wireless Hacking Live - FBI Version





This version is for all systems except systems with the Intel B/G wireless
cards (IPW2200).
- Live CD with all the tools you need to hack a WLAN / wireless Access point -
Linux Live-CD - OS runs from CD - 635 mb - .iso
- also used by the FBI.

WEP Hacking - The Next Generation

WEP is an encryption scheme, based on the RC-4 cipher, that is available
on all 802.11a, b and g wireless products. WEP uses a set of bits called a
key to scramble information in the data frames as it leaves the access point
or client adapter and the scrambled message is then decrypted by the receiver.

Both sides must have the same WEP key, which is usually a total of 64 or 128
bits long. A semi-random 24 bit number called an Initialization Vector (IV),
is part of the key, so a 64 bit WEP key actually contains only 40 bits of strong
encryption while a 128 bit key has 104. The IV is placed in encrypted frames
header, and is transmitted in plain text.

Traditionally, cracking WEP keys has been a slow and boring process.
An attacker would have to capture hundreds of thousands or millions of
packets—a process that could take hours or even days, depending on
the volume of traffic passing over the wireless network. After enough
packets were captured, a WEP cracking program such as Aircrack would
be used to find the WEP key.

Fast-forward to last summer, when the first of the latest generation of
WEP cracking tools appeared. This current generation uses a combination
of statistical techniques focused on unique IVs captured and brute-force
dictionary attacks to break 128 bit WEP keys in minutes instead of hours.
As Special Agent Bickers noted, It does'nt matter if you use 128 bit WEP keys,
you are vulnerable!

WEP is an encryption scheme, based on the RC-4 cipher, that is available
on all 802.11a, b and g wireless products.

WEP uses a set of bits called a key to scramble information in the data
frames as it leaves the access point or client adapter and the scrambled
message is then decrypted by the receiver.

Both sides must have the same WEP key, which is usually a total of 64 or
128 bits long.

A semi-random 24 bit number called an Initialization Vector (IV), is part of
the key, so a 64 bit WEP key actually contains only 40 bits of strong
encryption while a 128 bit key has 104.

The IV is placed in encrypted frames header, and is transmitted in plain text.

Traditionally, cracking WEP keys has been a slow and boring process.

An attacker would have to capture hundreds of thousands or millions of
packets a process that could take hours or even days, depending on
the volume of traffic passing over the wireless network.

After enough packets were captured, a WEP cracking program such as
Aircrack would be used to find the WEP key.

Fast-forward to last summer, when the first of the latest generation of
WEP cracking tools appeared.

This current generation uses a combination of statistical techniques focused
on unique IVs captured and brute-force dictionary attacks to break 128 bit
WEP keys in minutes instead of hours.

Basic Directions:

1)Boot from cd
2)get the wep key
3)write it down
4)reboot into windows
5)connect using wep key

Download

By Mr Electroman/ el3cTR0M4N

Bluetooth Security – The Tools,the Rules and stuff..


Posted by Mr Electroman

Everybody is having a Bluetooth phone nowadays,and we are merely concerned about the safety of these vulnerable and penetrable devices. BE it Nokia,Sony or Bluetooth Security - The Tools,the Rules and stuff.. any other brand,the technology remains same and provides whackers (wireless malicious hackers) new playground fortheir experiments.In this article,I will be listing some Bluetooth tools for security – both breaking and making.

Bluediving

It is a security and Bluetooth penetration testing suite and implements attacks like BlueSnarf,BlueSnarf++ and BlueSmack.Bluediving running on Linux - rdhacker.blogspot.com It features Bluetooth address spoofing,socket shells like AT and RFCOMM and also implements tools like L2CAP packet generator and connection resetter and RSCOMM scanner which are a must for any Bluetooth security enthusiastic.

Download BlueDiving

Blooover

Blooover (and Blooover 2) is a tool that is intended to run on J2ME enabled cell phones that appear to be comparably seamless.It serves as an audit tool that people use to check if their phones and phones of friends :P are vulnerable or not.

Bloover running on S40 - rdhacker.blogspot.com Bloover running on S40 - rdhacker.blogspot.com

Also there is also a tool “Super Bluetooth Hack” which is quite popular nowadays to hack into Bluetooth devices.

Download Blooover

Medieval Bluetooth Network Scanner

This program can analyze and scan your Bluetooth network, giving detailed information about local and remote devices found. You can also browse supported services of each device in a clear and straightforward user-interface. If you have a Bluetooth dongle installed on your PC, download "Medieval Bluetooth Network Scanner" now, it's totally free of charge and very handy!

Bluetooth Network Scanner running on Win Vista - rdhacker.blogspot.com Bluetooth Network Scanner running on Win Vista - rdhacker.blogspot.com It can deep scan all services of your Bluetooth device using this software.

Download Medieval Bluetooth Network Scanner

These software are free to use and quite handy to audit.However you,you ought to follow some basic rules of Bluetooth security for maximum protection-

  • Switch off Bluetooth when not in use.
  • Purchase only devices having long PIN codes.
  • Refrain from entering the PIN into Bluetooth device for pairing.
  • Limit the electric power itself to keep range of network within physical area (for Bluetooth enabled routers and devices other than cell phones).
  • Always generate initialization keys when 2 Bluetooth devices meet for the first time.
  • Never allow auto connection (Big loophole in Cell phone devices,easily exploited by a bit of social engineering. by el3ctR0m4n


Windows Anti-Debug Reference

This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems. Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering. We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. The paper is aimed towards reverse-engineers and malware analysts. Note that we will talk purely about generic anti-debugging and anti-tracing techniques. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. will not be addressed here.

[1] Intro

This paper classifies and presents several anti-debugging techniques used on Windows NT-based operating systems.
Anti-debugging techniques are ways for a program to detect if it runs under control of a debugger. They are used by commercial executable protectors, packers and malicious software, to prevent or slow-down the process of reverse-engineering.

We'll suppose the program is analyzed under a ring3 debugger, such as OllyDbg on Windows platforms. The paper is aimed towards reverse-engineers and malware analysts.
Note that we will talk purely about generic anti-debugging and anti-tracing techniques. Specific debugger detection, such as window or processes enumeration, registry scanning, etc. will not be addressed here.

[2] Anti-debugging and anti-tracing techniques

- Exploiting memory discrepancies

(1) kernel32!IsDebuggerPresent
IsDebuggerPresent returns 1 if the process is being debugged, 0 otherwise. This API simply reads the PEB!BeingDebugged byte-flag (located at offset 2 in the PEB structure).
Circumventing it is as easy as setting PEB!BeingDebugged to 0.
Example:
call IsDebuggerPresent
test eax, eax
jne @DebuggerDetected
...

(2) PEB!IsDebugged

This field refers to the second byte in the Process Environment Block of the process. It is set by the system when the process is debugged.
This byte can be reset to 0 without consequences for the course of execution of the program (it is an informative flag).

Example:
mov eax, fs:[30h]
mov eax, byte [eax+2]
test eax, eax
jne @DebuggerDetected
...

(3) PEB!NtGlobalFlags

When a process is created, the system sets some flags that will define how various APIs will behave for this program. Those flags can be read in the PEB, in the DWORD located at offset 0x68 (see the reference).
By default, different flags are set depending if the process is created under a debugger or not. If the process is debugged, some flags controlling the heap manipulation routines in ntdll will be set: FLG_HEAP_ENABLE_TAIL_CHECK, FLG_HEAP_ENABLE_FREE_CHECK and FLG_HEAP_VALIDATE_PARAMETERS.
This anti-debug can be bypassed by resetting the NtGlobalFlags field.

Example:
mov eax, fs:[30h]
mov eax, [eax+68h]
and eax, 0x70
test eax, eax
jne @DebuggerDetected
...

(4) Heap flags

As explained previously, NtGlobalFlags informs how the heap routines will behave (among other things). Though it is easy to modify the PEB field, if the heap does not behave the same way as it should when the process is not debugged, this could be problematic. It is a powerful anti-debug, as process heaps are numerous, and their chunks can be individually affected by the FLG_HEAP_* flags (such as chunk tails). Heap headers would be affected as well. For instance, checking the field ForceFlags in a heap header (offset 0x10) can be used to detect the presence of a debugger.

There are two easy ways to circumvent it:

- Create a non-debugged process, and attach the debugger once the process has been created (an easy solution is to create the process suspended, run until the entry-point is reached, patch it to an infinite loop, resume the process, attach the debugger, and restore the original entry-point).

- Force the NtGlobalFlags for the process that we want to debug, via the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options": Create a subkey (not value) named as your process name, and under this subkey, a String value "GlobalFlags" set to nothing.

Example:
mov eax, fs:[30h]
mov eax, [eax+18h] ;process heap
mov eax, [eax+10h] ;heap flags
test eax, eax
jne @DebuggerDetected
...

(5) Vista anti-debug (no name)

Here's an anti-debug specific to Windows Vista that I found by comparing memory dumps of a program running with and without control of a debugger. I'm not sure of its realiability, but it's worth mentionning (tested on Windows Vista 32 bits, SP0, English version).

When a process is debugged, its main thread TEB, at offset 0xBFC, contains a pointer to a unicode string referencing a system dll. Moreover, the string follows this pointer (therefore, located at offset 0xC00 in the TEB). If the process is not debugged, the pointer is set to NULL and the string is not present.

Example:
call GetVersion
cmp al, 6
jne @NotVista
push offset _seh
push dword fs:[0]
mov fs:[0], esp
mov eax, fs:[18h] ; teb
add eax, 0BFCh
mov ebx, [eax] ; pointer to a unicode string
test ebx, ebx ; (ntdll.dll, gdi32.dll,...)
je @DebuggerNotFound
sub ebx, eax ; the unicode string follows the
sub ebx, 4 ; pointer
jne @DebuggerNotFound
;debugger detected if
it reaches this point

;...

- Exploiting system discrepancies

(1) NtQueryInformationProcess
ntdll!NtQueryInformationProcess is a wrapper around the ZwQueryInformationProcess syscall. Its prototype is the following:

NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESS_INFORMATION_CLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength
);

When called with ProcessInformationClass set to 7 (ProcessDebugPort constant), the system will set ProcessInformation to -1 if the process is debugged.
It is a powerful anti-debug, and there is no easy way to circumvent it. However, if the program is traced, ProcessInformation can be modified when the syscall returns.

Another solution is to use a system driver that would hook the ZwNtQueryInformationProcess syscall.
Circumventing NtQueryInformationProcess will bypass many anti-debug techniques (such as CheckRemoteDebuggerPresent or UnhandledExceptionFilter).

Example:
push 0
push 4
push offset isdebugged
push 7 ;ProcessDebugPort
push -1
call NtQueryInformationProcess
test eax, eax
jne @ExitError
cmp isdebugged, 0
jne @DebuggerDetected
...

(2) kernel32!CheckRemoteDebuggerPresent

This API takes two parameters: a process handle, and a pointer to a DWORD. If the call is successful, the DWORD value will be set to 1 if the process is being debugged.
Internally, this API calls ntdll!NtQueryInformationProcess with ProcessInformationClass set to ProcessDebugPort (7).

Example:
push offset isdebugged
push -1
call CheckRemoteDebuggerPresent
test eax, eax
jne @DebuggerDetected
...

(3) UnhandledExceptionFilter

When an exception occurs, with Windows XP SP>=2, Windows 2003, and Windows Vista, the usual way the OS processes the exception is:

- If any, pass control to the per-process Vectored Exception Handlers.
- If the exception is not processed, pass the control to the per-thread top SEH handler, pointed by FS:[0] in the thread that generated the exception. SEH are chained and called in turn if the exception is not processed by the previous in the chain.
- If the exception has not been processed by any of the previous handlers, the final SEH handler (set by the system), will call kernel32!UnhandledExceptionFilter. This function will decide what it should do depending if the process is debugged or not.
- If it is not debugged, it will call the user-defined filter function (set via kernel32!SetUnhandledExceptionFilter).
- If it debugged, the program will be terminated.

The debugger detection in UnhandledExceptionFilter is made with ntdll!NtQueryInformationProcess.

Example:
push @not_debugged
call SetUnhandledExceptionFilter
xor eax, eax
mov eax, dword [eax] ; trigger exception
;program terminated if debugged
;...
@not_debugged:
;process the exception
;continue the execution
;...

(4) NtSetInformationThread
ntdll!NtSetInformationThread is a wrapper around the ZwSetInformationThread syscall. Its prototype is the following:
NTSYSAPI NTSTATUS NTAPI NtSetInformationThread(
IN HANDLE ThreadHandle,
IN THREAD_INFORMATION_CLASS ThreadInformationClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
);

When called with ThreadInformationClass set to 0x11 (ThreadHideFromDebugger constant), the thread will be detached from the debugger.

Similarly to ZwQueryInformationProcess, circumventing this anti-debug requires either modifying ZwSetInformationThread parameters before it's called, or hooking the syscall directly with the use of a kernel driver.

Example:
push 0
push 0
push 11h ;ThreadHideFromDebugger
push -2
call NtSetInformationThread
;thread detached if debugged
;...

(5) kernel32!CloseHandle and NtClose

APIs making user of the ZwClose syscall (such as CloseHandle, indirectly) can be used to detect a debugger. When a process is debugged, calling ZwClose with an invalid handle will generate a STATUS_INVALID_HANDLE (0xC0000008) exception.

As with all anti-debugs that rely on information made directly available from the kernel (therefore involving a syscall), the only proper way to bypass the "CloseHandle" anti-debug is to either modify the syscall data from ring3, before it is called, or set up a kernel hook.

This anti-debug, though extremely powerful, does not seem to be widely used by malicious programs.

Example:
push offset @not_debugged
push dword fs:[0]
mov fs:[0], esp
push 1234h ;invalid handle
call CloseHandle
; if fall here, process is debugged
;...
@not_debugged:
;...

(6) Self-debugging





A process can detect it is being debugged by trying to debug itself, for instance by creating a new process, and calling kernel32!DebugActiveProcess(pid) on the parent process.

In turn, this API calls ntdll!DbgUiDebugActiveProcess which will call the syscall ZwDebugActiveProcess. If the process is already debugged, the syscall fails. Note that retrieving the parent process PID can be done with the toolhelp32 APIs (field th32ParentProcessID in the PROCESSENTRY32 structure.

(7) Kernel-mode timers

kernel32!QueryPerformanceCounter is an efficent anti-debug. This API calls ntdll!NtQueryPerformanceCounter which wraps the ZwQueryPerformanceCounter syscall.

Again, there is no easy way to circumvent this anti-tracing trick.

(8) User-mode timers

An API such as kernel32!GetTickCount returns the number of milliseconds ellapsed since the system started. The interesting thing is that it does not make use of kernel-related service to perform its duties. A user-mode process has this counter mapped in its address space. For 8Gb user-mode spaces, the value returned would be:

d[0x7FFE0000] * d[0x7FFE0004] / (2^24)

(9) kernel32!OutputDebugStringA

This anti-debug is quite original, I have encountered it only once, in files packed with ReCrypt v0.80. The trick consists of calling OutputDebugStringA, with a valid ASCII string. If the program is run under control of a debugger, the return value will be the address of the string passed as a parameter. In normal conditions, the return value should be 1.

Example:
xor eax, eax
push offset szHello
call OutputDebugStringA
cmp eax, 1
jne @DebuggerDetected
...

(10) Ctrl-C

When a console program is debugged, a Ctrl-C signal will throw a EXCEPTION_CTL_C exception, whereas the signal handler would be called directly is the program is not debugged.

Example:
push offset exhandler
push 1
call RtlAddVectoredExceptionHandler
push 1
push sighandler
call SetConsoleCtrlHandler
push 0
push CTRL_C_EVENT
call GenerateConsoleCtrlEvent
push 10000
call Sleep
push 0
call ExitProcess
exhandler:
;check if EXCEPTION_CTL_C, if it is,
;debugger detected, should exit process
;...
sighandler:
;continue
;...

- CPU anti-debug

(1) Rogue Int3

This is a classic anti-debug to fool weak debuggers. It consists of inserting an INT3 opcode in the middle of a valid sequence of instructions. When the INT3 is executed, if the program is not debugged, control will be given to the exception handler of the protection and execution will continue.

As INT3 instructions are used by debuggers to set software breakpoints, inserting INT3 opcodes can be used to trick the debugger into believing that it is one his breakpoints. Therefore, the control would not be given to the exception handler, and the course of the program would be modified. Debuggers should track where they set software breakpoints to avoid falling for this one.

Similarly, note that INT3 may be encoded as 0xCD, 0x03.

Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 0CCh
;if fall here, debugged
;...
@handler:
;continue execution
;...

(2) "Ice" Breakpoint

The so-called "Ice breakpoint" is one of Intel's undocumented instruction, opcode 0xF1. It is used to detect tracing programs.

Executing this instruction will generate a SINGLE_STEP exception. Therefore, if the program is already traced, the debugger will think it is the normal exception generated by executing the instruction with the SingleStep bit set in the Flags registers. The associated exception handler won't be executed, and execution will not continue as expected.
Bypassing this trick is easy: one can run over the instruction, instead and single-stepping on it. The exception will be generated, but since the program is not traced, the debugger should understand that it has to pass control to the exception handler.

Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 0F1h
;if fall here, traced
;...
@handler:
;continue execution
;...

(3) Interrupt 2Dh

Executing this interrupt if the program is not debugged will raise a breakpoint exception. If the program is debugged, and the instruction is not executed with the trace flag, no exception will be generated, and execution will carry on normally. If the program is debugged and the instruction traced, the following byte will be skipped, and execution will continue. Therefore, using INT 2Dh can be used as a powerful anti-debug and anti-tracer mechanism.
Example:
push offset @handler
push dword fs:[0]
mov fs:[0], esp
;...
db 02Dh
mov eax, 1 ;anti-tracing
;...
@handler:
;continue execution
;...

(4) Timestamp counters
High precision count



ers, storing the current number of CPU cycles executed since the machine started, can be queried with the RDTSC instruction. Classic anti-debugs consist of measuring time deltas at key points in the program, usually around exception handlers. If the delta is too large, that would mean the program runs under control of a debugger (processing the exception in the debugger, and giving control back to the debuggee is a lengthy task).


Example:
push offset handler
push dword ptr fs:[0]
mov fs:[0],esp
rdtsc
push eax
xor eax, eax
div eax ;trigger exception
rdtsc
sub eax, [esp] ;ticks delta
add esp, 4
pop fs:[0]
add esp, 4
cmp eax, 10000h ;threshold
jb @not_debugged
@debugged:
...
@not_debugged:
...
handler:
mov ecx, [esp+0Ch]
add dword ptr [ecx+0B8h], 2 ;skip div
xor eax, eax
ret

(5) Popf and the trap flag

The trap flag, located in the Flags register, controls the tracing of a program. If this flag is set, executing an instruction will also raise a SINGLE_STEP exception. The trap flag can be manipulated in order to thwart tracers. For instance, this sequence of instructions will set the trap flag:

pushf
mov dword [esp], 0x100
popf

If the program is being traced, this will have no real effect on the flags register, and the debugger will process the exception, believing it comes from regular tracing. The exception handler won't be executed. Circumventing this anti-tracer trick simply require to run over the pushf instruction.

(6) Stack Segment register

Here's a very original anti-tracer. I encountered it in a packer called MarCrypt. I believe it is not widely known, not to mention, used.
It consists of tracing over this sequence of instructions:

push ss
pop ss
pushf
nop

When tracing over pop ss, the next instruction will be executed but the debugger will not break on it, therefore stopping on the following instruction (NOP in this case).
Marcrypt uses this anti-debug the following way:

push ss
; junk
pop ss
pushf
; junk
pop eax
and eax, 0x100
or eax, eax
jnz @debugged
; carry on normal execution

The trick here is that, if the debugger is tracing over that sequence of instructions, popf will be excuted implicitly, and the debugger will not be able to unset the trapflag in the pushed value on the stack. The protection checks for the trap flag and terminates the program if it's found.
One simple way to circumvent this anti-tracing is to breakpoint on popf and run the program (to avoid using the TF flag).

(7) Debug registers manipulation

Debug registers (DR0 through DR7) are used to set hardware breakpoints. A protection can manipulate them to either detect that hardware breakpoints have been set (and therefore, that it is being debugged), reset them or set them to particular values used to perform code checks later. A packer such as tElock makes use of the debug registers to prevent reverse-engineers from using them.
From a user-mode perspective, debug registers cannot be set using the privileged 'mov drx, ...' instruction. Other ways exist:

- An exception can be generated, the thread context modified (it contains the CPU registers at the time the exception was thrown), and then resumed to normal execution with the new context.

- The other way is to use the NtGetContextThread and NtSetContextThread syscalls (available in kernel32 with GetThreadContext and SetThreadContext).

Most protectors use the first, "unofficial" way.

Example:
push offset handler
push dword ptr fs:[0]
mov fs:[0],esp
xor eax, eax
div eax ;generate exception
pop fs:[0]
add esp, 4
;continue execution
;...
handler:
mov ecx, [esp+0Ch] ;skip div
add dword ptr [ecx+0B8h], 2 ;skip div
mov dword ptr [ecx+04h], 0 ;clean dr0
mov dword ptr [ecx+08h], 0 ;clean dr1
mov dword ptr [ecx+0Ch], 0 ;clean dr2
mov dword ptr [ecx+10h], 0 ;clean dr3
mov dword ptr [ecx+14h], 0 ;clean dr6
mov dword ptr [ecx+18h], 0 ;clean dr7
xor eax, eax
ret

(8) Context modification

As with debug registers manipulation, the context can also be used to modify in an unconventionnal way the execution stream of a program. Debuggers can get easily confused!
Note that another syscall, NtContinue, can be used to load a new context in the current thread (for instance, this syscall is used by the exception handler manager).

- Uncategorized anti-debug

(1) TLS-callback

This anti-debug was not so well-known a few years ago. It consists to instruct the PE loader that the first entry point of the program is referenced in a Thread Local Storage entry (10th directory entry number in the PE optional header). By doing so, the program entry-point won't be executed first. The TLS entry can then perform anti-debug checks in a stealthy way.
Note that in practice, this technique is not widely used.
Though older debuggers (including O



llyDbg) are not TLS-aware, counter-measures are quite easy to take, by the means of plugins of custom patcher tools.


(2) CC scanning

A common protection feature used by packers is the CC-scanning loop, aimed at detecting software breakpoints set by a debugger. If you want to avoid that kind of troubles, you may want to use either hardware breakpoints or a custom type of software breakpoint. CLI (0xFA) is a good candidate to replace the classic INT3 opcode. This instruction does have the requirements for the job: it raises a privileged instruction exception if executed by a ring3 program, and occupies only 1 byte of space.

(3) EntryPoint RVA set to 0

Some packed files have their entry point RVA set to 0, which means they will start executing 'MZ...' which corresponds to 'dec ebx / pop edx ...'.

This is not an anti-debug trick in itself, but can be annoying if you want to break on the entry-point by using a software breakpoint.

If you create a suspended process, then set an INT3 at RVA 0, you will erase part of the magic MZ value ('M'). The magic was checked when the process was created, but it will get checked again by ntdll when the process is resumed (in the hope of reaching the entry-point). In that case, an INVALID_IMAGE_FORMAT exception will be raised.

If you create your own tracing or debugging tool, you will want to use hardware breakpoint to avoid this problem.

[3] Conclusion

Knowing anti-debugging and anti-tracing techniques (un)commonly used by malware or protectors is useful knowledge for a reverse-engineer. A program will always have ways to find it is run in a debugger - the same applies for virtual or emulated environments, but since ring3 debuggers are some of the most common analysis tools used, knowing common tricks, and how to bypass them, will always prove useful.

[4] Links

MSDN
Portable Executable Tutorial, Matt Pietrek
Syscall Reference, The Metasploit Project
Undocumented Functions for MS Windows NT/2K
Intel Manuals
- Common exception codes - Microsoft Windows SDK, ntdll.h
- Status codes list (including common exception codes) - Microsoft Windows DDK, ntstatus.h
- Context Structures documentation - Microsoft Windows SDK, ntdll.h

[5] Data reference

- CONTEXT structure for IA32 processors
struct CONTEXT_IA32
{
// ContextFlags must be set to the appropriate CONTEXT_* flag
// before calling (Set|Get)ThreadContext
DWORD ContextFlags;

// CONTEXT_DEBUG_REGISTERS (not included in CONTEXT_FULL)
DWORD Dr0; // 04h
DWORD Dr1; // 08h
DWORD Dr2; // 0Ch
DWORD Dr3; // 10h
DWORD Dr6; // 14h
DWORD Dr7; // 18h

// CONTEXT_FLOATING_POINT
FLOATING_SAVE_AREA FloatSave;

// CONTEXT_SEGMENTS
DWORD SegGs; // 88h
DWORD SegFs; // 90h
DWORD SegEs; // 94h
DWORD SegDs; // 98h

// CONTEXT_INTEGER
DWORD Edi; // 9Ch
DWORD Esi; // A0h
DWORD Ebx; // A4h
DWORD Edx; // A8h
DWORD Ecx; // ACh
DWORD Eax; // B0h

// CONTEXT_CONTROL
DWORD Ebp; // B4h
DWORD Eip; // B8h
DWORD SegCs; // BCh (must be sanitized)
DWORD EFlags; // C0h
DWORD Esp; // C4h
DWORD SegSs; // C8h

// CONTEXT_EXTENDED_REGISTERS (processor-specific)
BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
};

- Process Environment Block structure (from The Wine Project)
struct PEB
{
BOOLEAN InheritedAddressSpace; // 00
BOOLEAN ReadImageFileExecOptions; // 01
BOOLEAN BeingDebugged; // 02
BOOLEAN SpareBool; // 03
HANDLE Mutant; // 04
HMODULE ImageBaseAddress; // 08
PPEB_LDR_DATA LdrData; // 0c
RTL_UPROCESS_PARAMETERS *ProcessParameters; // 10
PVOID SubSystemData; // 14
HANDLE ProcessHeap; // 18
PRTL_CRITICAL_SECTION FastPebLock; // 1c
PVOID /*PPEBLOCKROUTI*/ FastPebLockRoutine; // 20
PVOID /*PPEBLOCKROUTI*/ FastPebUnlockRoutine; // 24
ULONG EnvironmentUpdateCount; // 28
PVOID KernelCallbackTable; // 2c
PVOID EventLogSection; // 30
PVOID EventLog; // 34
PVOID /*PPEB_FREE_BLO*/ FreeList; // 38
ULONG TlsExpansionCounter; // 3c
PRTL_BITMAP TlsBitmap; // 40
ULONG TlsBitmapBits[2]; // 44
PVOID ReadOnlySharedMemoryBase; // 4c
PVOID ReadOnlySharedMemoryHeap; // 50
PVOID *ReadOnlyStaticServerData; // 54
PVOID AnsiCodePageData; // 58
PVOID OemCodePageData; // 5c
PVOID UnicodeCaseTableData; // 60
ULONG NumberOfProcessors; // 64
ULONG NtGlobalFlag; // 68
BYTE Spare2[4]; // 6c
LARGE_INTEGER CriticalSectionTimeout; // 70
ULONG HeapSegmentReserve; // 78
ULONG HeapSegmentCommit; // 7c
ULONG HeapDeCommitTotalFreeTh; // 80
ULONG HeapDeCommitFreeBlockTh; // 84
ULONG NumberOfHeaps; // 88
ULONG MaximumNumberOfHeaps; // 8c
PVOID *ProcessHeaps; // 90
PVOID GdiSharedHandleTable; // 94
PVOID ProcessStarterHelper; // 98
PVOID GdiDCAttributeList; // 9c
PVOID LoaderLock; // a0
ULONG OSMajorVersion; // a4
ULONG OSMinorVersion; // a8
ULONG OSBuildNumber; // ac
ULONG OSPlatformId; // b0
ULONG ImageSubSystem; // b4
ULONG ImageSubSystemMajorVersion; // b8
ULONG ImageSubSystemMinorVersion; // bc
ULONG ImageProcessAffinityMask; // c0
ULONG GdiHandleBuffer[34]; // c4
ULONG PostProcessInitRoutine; // 14c
PRTL_BITMAP TlsExpansionBitmap; // 150
ULONG TlsExpansionBitmapBits[32]; // 154
ULONG SessionId; // 1d4
};

- Thread Environment Block structure (from The Wine Project)
struct TEB
{
NT_TIB Tib; // 000 Info block
PVOID EnvironmentPointer; // 01c
CLIENT_ID ClientId; // 020 PID,TID
PVOID ActiveRpcHandle; // 028
PVOID ThreadLocalStoragePointer; // 02c
PEB *Peb; // 030
DWORD LastErrorValue; // 034
ULONG CountOfOwnedCriticalSections; // 038
PVOID CsrClientThread; // 03c
PVOID Win32ThreadInfo; // 040
ULONG Win32ClientInfo[0x1f]; // 044
PVOID WOW32Reserved; // 0c0
ULONG CurrentLocale; // 0c4
ULONG FpSoftwareStatusRegister; // 0c8
PVOID SystemReserved1[54]; // 0cc
PVOID Spare1; // 1a4
LONG ExceptionCode; // 1a8
BYTE SpareBytes1[40]; // 1ac
PVOID SystemReserved2[10]; // 1d4
DWORD num_async_io; // 1fc
ULONG_PTR dpmi_vif; // 200
DWORD vm86_pending; // 204
DWORD pad6[309]; // 208
ULONG gdiRgn; // 6dc
ULONG gdiPen; // 6e0
ULONG gdiBrush; // 6e4
CLIENT_ID RealClientId; // 6e8
HANDLE GdiCachedProcessHandle; // 6f0
ULONG GdiClientPID; // 6f4
ULONG GdiClientTID; // 6f8
PVOID GdiThreadLocaleInfo; // 6fc
PVOID UserReserved[5]; // 700
PVOID glDispachTable[280]; // 714
ULONG glReserved1[26]; // b74
PVOID glReserved2; // bdc
PVOID glSectionInfo; // be0
PVOID glSection; // be4
PVOID glTable; // be8
PVOID glCurrentRC; // bec
PVOID glContext; // bf0
ULONG LastStatusValue; // bf4
UNICODE_STRING StaticUnicodeString; // bf8
WCHAR StaticUnicodeBuffer[261]; // c00
PVOID DeallocationStack; // e0c
PVOID TlsSlots[64]; // e10
LIST_ENTRY TlsLinks; // f10
PVOID Vdm; // f18
PVOID ReservedForNtRpc; // f1c
PVOID DbgSsReserved[2]; // f20
ULONG HardErrorDisabled; // f28
PVOID Instrumentation[16]; // f2c
PVOID WinSockData; // f6c
ULONG GdiBatchCount; // f70
ULONG Spare2; // f74
ULONG Spare3; // f78
ULONG Spare4; // f7c
PVOID ReservedForOle; // f80
ULONG WaitingOnLoaderLock; // f84
PVOID Reserved5[3]; // f88
PVOID *TlsExpansionSlots; // f94
};

- NtGlobalFlags
FLG_STOP_ON_EXCEPTION 0x00000001
FLG_SHOW_LDR_SNAPS 0x00000002
FLG_DEBUG_INITIAL_COMMAND 0x00000004
FLG_STOP_ON_HUNG_GUI 0x00000008
FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
FLG_HEAP_VALIDATE_ALL 0x00000080
FLG_POOL_ENABLE_TAIL_CHECK 0x00000100
FLG_POOL_ENABLE_FREE_CHECK 0x00000200
FLG_POOL_ENABLE_TAGGING 0x00000400
FLG_HEAP_ENABLE_TAGGING 0x00000800
FLG_USER_STACK_TRACE_DB 0x00001000
FLG_KERNEL_STACK_TRACE_DB 0x00002000
FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
FLG_IGNORE_DEBUG_PRIV 0x00010000
FLG_ENABLE_CSRDEBUG 0x00020000
FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
FLG_HEAP_ENABLE_CALL_TRACING 0x00100000
FLG_HEAP_DISABLE_COALESCING 0x00200000
FLG_VALID_BITS 0x003FFFFF
FLG_ENABLE_CLOSE_EXCEPTION 0x00400000
FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
FLG_HEAP_PAGE_ALLOCS 0x02000000
FLG_DEBUG_WINLOGON 0x04000000
FLG_ENABLE_DBGPRINT_BUFFERING 0x08000000
FLG_EARLY_CRITICAL_SECTION_EVT 0x10000000
FLG_DISABLE_DLL_VERIFICATION 0x80000000

Way to detect who is spying you

GETTING SUM1'S IP Address How HAS Hacked Your PC First
open dos command,go to -(Start/Run/type "command" without inverted commas and hit enter),& in the MSDOS prompt,type:
netstat -a
(make sure you include the space in between the "t" and the "-a").



This command will show u the host name of the lamer and of course yours also ..your host name will be under local address and his wud be under foreign address.. note any suspicious name and every number u c after the host name under foreign address which is new and suspicious there(numbers are ports but i consider u totally unaware).
After ur done,now type
Netstat -an (again a space between "t" and "-an")

this will list all connections in numerical form, which makes it a lot easier to trace malicious users....Hostnames can be a little confusing if you don't know what you're doing (although they're easily understandable, as we shall see later). Also, by doing this, you can also find out what your own IP address is, which is always useful.

It wud look a bit like this


A New IP:Port -note that stuff
Now that you have a IP Address and a host name,type
tracert type IP address/Hostname here

write whole thing there.. that's after you write tracert give a space then type A New IP we found in last step.. give a / then write..Host name we found in first step.remember no port there to be added..
This will trace the lamer which is prolly using a Trojan on your computer to do what he wants..result will give u some ip addresses ..note all of them
now go to ip2location.com/free.asp
write ip addresses in the box and see where the ips belong to..some ips will give u ISPs like mtnl ... last IP wud be his IP ..now call Your or his ISP & inform dem abt it!DO RESPOND 2 DIS..
->Special Security Team

Mastering SQL Server 2008


As Microsoft’s bestselling database manager, SQL Server is highly flexible and customizable, and has excellent support—the 2008 version offers several significant new capabilities. This book offers accurate and expert coverage on the updates to SQL Server 2008 such as its enhanced security; the ability to encrypt an entire database, data files, and log files without the need for application changes; a scalable infrastructure that can manage reports and analysis of any size and complexity; and its extensive performance data collection. From the Back Cover Harness the Powerful New Features of SQL Server 2008 Whether you're a database administrator or application developer, this in-depth guide is your key to delivering improved data collection, storage, reporting, and security with SQL Server 2008. Mastering SQL Server 2008 brings you up to speed on architecture, installation, and configuration essentials, before moving to the step-by-step instruction you need for more advanced topics such as procedural programming, query optimization, how to use spatial data, SQL Server in the .NET world, and more. You'll master the extensive toolset, explore useful third-party tools, and most importantly, find out how to choose and use the right SQL Server features for the specific tasks you have. Coverage includes: Installing and configuring SQL Server 2008 Understanding SQL Server's place within the Microsoft architecture Making data reliably and efficiently available to your consumers Securing your data with SQL Server 2008's new Transparent Data Encryption feature Integrating XML technology into SQL Server Creating index architectures for maximum benefit and minimum cost Exploring new geometry and geography data types for today's businesses Maximizing data warehousing and business intelligence tools...
~~Download

e-books [Limba Romana]

Contine:
C++.rar
Carte C++ in romana.rar
Carte JAVA in romana.rar
Carte MySQL Romana.rar
Carte PHP Romana.rar
Curs Java.rar
HTML-_avansati_si_incepatori.rar
Introducere in PHP.rar
Lucrare javascript.rar
Manual de programare C.rar
Pascal.rar
Programare Visual C++.rar
Tutorial CSS [ Romana ].rar
Tutorial PHP [ Romana ].rar
Tutorial_HTML.rar
XHTML__romaneste_.rar

~~Download

Creating Games in C++: A Step-by-Step Guide


Do you love video games? Ever wondered if you could create one of your own, with all the bells and whistles? It’s not as complicated as you’d think, and you don’t need to be a math whiz or a programming genius to do it. In fact, everything you need to create your first game, “Invasion of the Slugwroths,” is included in this book and CD-ROM.

Author David Conger starts at square one, introducing the tools of the trade and all the basic concepts for getting started programming with C++, the language that powers most current commercial games. Plus, he’s put a wealth of top-notch (and free) tools on the CD-ROM, including the Dev-C++ compiler, linker, and debugger–and his own LlamaWorks2D game engine. Step-by-step instructions and ample illustrations take you through game program structure, integrating sound and music into games, floating-point math, C++ arrays, and much more. Using the sample programs and the source code to run them, you can follow along as you learn.
Bio: David Conger has been programming professionally for over 23 years. Along with countless custom business applications, he has written several PC and online games. Conger also worked on graphics firmware for military aircraft, and taught computer science at the university level for four years. Conger has written numerous books on C, C++, and other computer-related topics. He lives in western Washington State and has also published a collection of Indian folk tales.
~~Download

VideoJak - IP Video Security Assessment Tool

What is VideoJak?

VideoJak is an IP Video security assessment tool that can simulate a proof of concept DoS against a targeted, user-selected video session and IP video phone. VideoJak is the first of its kind security tool that analyzes video codec standards such as H.264.

VideoJak works by first capturing the RTP port used in a video conversation and analyzing the RTP packets, collecting the RTP sequence numbers and timestamp values used between the phones. Then VideoJak creates a custom video payload by changing the sequence numbers and timestamp values used in the original RTP packets between the two phones. After the user selects a targeted phone to attack in an ongoing video session, VideoJak delivers the payload over the learned RTP port against the target. This attack results in severely degraded video and audio quality.

google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);

Overview

VideoJak is designed in consideration of todays UC infrastructure implementions in which QoS requirements dictate the separation of data and VoIP/Video into discrete networks or VLANs. VideoJak is a proof of concept security assessment tool that can be used to test video applications. Future versions of the tool will support more exciting features.

Features

  • VLAN Discovery (CDP) and VLAN Hop
  • Call pattern tracking for SIP and SCCP signaling protocols
  • Audio codec (G.711u, G.722) and Video codec (H.263, H.264) support
  • Creates custom payload from H.263/H.264 packet capture
  • MitM functions and host management
  • Allows user to select ongoing video call from a menu
  • Allows user to select a targeted IP Phone for DoS within the video session
  • Enables the user to send the attack during an active, ongoing video call

google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);

You can download VideoJak here:

videojak-1.00.tar.gz

تطوير : مدونة حكمات