Category Archives: Tools

Python scripting for WinDbg: a quick introduction to PyKd

Posted on January 6, 2022 by hasherezade

PyKd is a plugin for WinDbg allowing to deploy Python scripts . It can be very helpful i.e. for tracing and deobfuscation of obfuscated code. In this small tutorial I will demonstrate how to install it and make everything work. … Continue reading →

Posted in Tools, Tutorial | 6 Comments

PE-bear – version 0.3.9 available

Posted on January 13, 2019 by hasherezade

[UPDATE] This release introduced some stability issues, fixed in 0.3.9.5 Hello! Several months have passed since I released PE-bear 0.3.8. Since it was my old, abandoned project, I did not plan to start developing it again. Initially, I got convinced … Continue reading →

Posted in PE-bear, Tools | 6 Comments

Hook the planet! Solving FlareOn4 Challenge6 with libPeConv

Posted on December 1, 2017 by hasherezade

Recently I started making a small library for loading and manipulating PE files (libpeconv – it’s open source, available on my GitHub). In my previous post, I demonstrated how the Challenge 3 from FlareOn4 could be solved with it’s help: … Continue reading →

Posted in CrackMe, Programming, Tools | Tagged , , , | Leave a comment

Import all the things! Solving FlareOn4 Challenge 3 with libPeConv

Posted on November 24, 2017 by hasherezade

Recently I started making a small library for loading and converting PE files (libpeconv, available on my GitHub). The library is still on early stages of development, so please don’t judge and don’t use it in any serious projects. The … Continue reading →

Posted in CrackMe, Programming, Tools | Tagged , , , | 3 Comments

Introducing PE_unmapper

Posted on December 2, 2016 by hasherezade

Recently I wrote a small tool, that can be used as a helper in malware analysis. Various malware types unpack their core modules in memory, load them and run. In order to unpack them fast, we can let the malware … Continue reading →

Posted in Malware, Tools, Tutorial | Tagged , | 1 Comment

Anti-Petya live CD (the fastest Stage1 key decoder)

Posted on April 20, 2016 by hasherezade

❗❗❗ATTENTION❗❗❗ Please use the  LATEST version of the decoder, available here: https://github.com/hasherezade/petya_key UPDATE: 17-th July a new version of Petya has been released. At the moment, there is no way to decrypt the disk. Don’t let the infection reach the … Continue reading →

Posted in Malware, Malware Decryptor, Tools | 5 Comments

Petya key decoder

Posted on March 31, 2016 by hasherezade

❗❗❗ATTENTION❗❗❗ Please use the  LATEST version of the decoder, available here: https://github.com/hasherezade/petya_key CODE Sourcecodes of my applications related to recovery from Petya attacks Key decoder for multiple Petyas based on Janus’ masterkey Petya Green – app for brutforce attack on … Continue reading →

Posted in Malware, Malware Decryptor, Tools | 21 Comments

DMA Unlocker

Posted on February 18, 2016 by hasherezade

I managed to crack some of the variants of DMA Locker ransomware (version with RSA key), described [here]. For those who are hit by this version , there is an experimental decryptor for it. More details and updates you can … Continue reading →

Posted in Malware, Malware Decryptor, Tools | Leave a comment

Introducing PE-bear: a new viewer/editor for PE files

Posted on July 9, 2013 by hasherezade

Hi! Today I would like to introduce my new project – PE-bear. In short words – it is a viewer/editor for PE32 and PE64 files. You may ask – why the hell another PE reversing tool? Well, I started developing … Continue reading →

Posted in PE-bear, Tools | Tagged , , , , , , | 4 Comments