Tag Archives: PE

Application shimming vs Import Table recovery

Posted on June 27, 2019 by hasherezade

In this post I am sharing a case that I investigated recently, during the tests of my application, PE-sieve. It demonstrates how the shims applied by the operating system can disrupt Imports recovery. Continue reading →

Posted in Programming, Uncategorized | Tagged , , , , , , | 1 Comment

Process Doppelgänging – a new way to impersonate a process

Posted on December 18, 2017 by hasherezade

Recently at Black Hat Europe conference, Tal Liberman and Eugene Kogan form enSilo lab presented a new technique called Process Doppelgänging. The video from the talk is available here. (Also, it is worth mentioning that Tal Liberman is an author … Continue reading →

Posted in Malware, Programming, Techniques | Tagged , | 8 Comments

Import all the things! Solving FlareOn4 Challenge 3 with libPeConv

Posted on November 24, 2017 by hasherezade

Recently I started making a small library for loading and converting PE files (libpeconv, available on my GitHub). The library is still on early stages of development, so please don’t judge and don’t use it in any serious projects. The … Continue reading →

Posted in CrackMe, Programming, Tools | Tagged , , , | 3 Comments

Introducing PE_unmapper

Posted on December 2, 2016 by hasherezade

Recently I wrote a small tool, that can be used as a helper in malware analysis. Various malware types unpack their core modules in memory, load them and run. In order to unpack them fast, we can let the malware … Continue reading →

Posted in Malware, Tools, Tutorial | Tagged , | 1 Comment

Introducing PE-bear: a new viewer/editor for PE files

Posted on July 9, 2013 by hasherezade

Hi! Today I would like to introduce my new project – PE-bear. In short words – it is a viewer/editor for PE32 and PE64 files. You may ask – why the hell another PE reversing tool? Well, I started developing … Continue reading →

Posted in PE-bear, Tools | Tagged , , , , , , | 4 Comments