EnglishFrenchGermanItalianPortugueseSpanish

Building the next generation file system for Windows: ReFS

We wanted to continue our dialog about data storage by talking about the next generation file system being introduced in Windows 8. Today, NTFS is the most widely used, advanced, and feature rich file system in broad use. But when you’re reimagining Windows, as we are for Windows 8, we don’t rest on past [...]

Share

Windows Kernel-mode GS Cookies and 1 bit of entropy

Today, I would like to present the results of the research, performed by me and Gynvael Coldwind, during the last three or four weeks – an almost forty-page long article, entitled “Exploiting the otherwise non-exploitable: Windows Kernel-mode GS cookies subverted” (yes, that’s an obvious reference to the “Exploiting the otherwise non-exploitable on Windows” by Skywing [...]

Share

Stuxnet Memory Analysis and IOC creation

The stuxnet malware has been making the press recently for two reasons. First it contains two drivers signed with a legitimate (at the time) cert. Second is it’s targeting SCADA systems. The malware is cool for a host of other geeky reasons. Nick Harbour, Stephen Davis, and I started looking at the malware Sunday [...]

Share

Getting Started with the Windows Driver Development Environment

Getting started with Microsoft Windows device drivers can be difficult, even for experienced developers. This paper presents an overview of the debugging and testing tools that developers use to create a device driver for Windows operating systems. In particular, the paper examines ways to find and fix bugs early in development, to help you produce [...]

Share

How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive when capturing a system memory dump

Prior to Windows Vista and Windows Server 2008 we had to keep a large page file on the system drive (typically drive C:) in order to properly capture system memory dumps for troubleshooting. This presented problems as systems with very large amounts of RAM became more common, resulting in requirements for very large amounts [...]

Share

ATM Skimmers, Part II

Крайне забавные картинки про скиммеры, рекомендую.

via ATM Skimmers, Part II.

Share

Hex-Rays plugin contest

We are happy to announce the results of our first Hex-Rays plugin contest! The submitted files are very interesting. We are sure that you too will find them useful and increasing your productivity.

While we had no difficulties determining the first winner, the second place was not that obvious, both [...]

Share

Hex-Rays Decompiler primer

The Hex-Rays Decompiler 1.0 was released more than two years ago. Since then it has improved a lot and does a great job decompiling real-life code, but sometimes there are additional things that you might wish to do with its output. For that purpose we have released the Hex-Rays Decompiler SDK and several sample plugins. [...]

Share

Windows 7 Kernel Architecture Changes

Windows 7 introduces a new set of dll files containing exported functions of many well-known WIN32 APIs. All these filenames begins with ‘api-ms-win-core’ prefix, followed by the functions category name. For example, api-ms-win-core-localregistry-l1-1-0.dll contains the exported names for all Registry functions, api-ms-win-core-file-l1-1-0.dll contains the exported names for all file-related functions, api-ms-win-core-localization-l1-1-0.dll contains the exported names [...]

Share

Your Botnet is My Botnet

Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security threats on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to harvest sensitive information (such as bank account and credit card data) [...]

Share