Comments on: Introducting D-Pin Purr v1.0 – 32bit Edition http://www.alex-ionescu.com/?p=35 Windows Internals, Thoughts on Security, and Reverse Engineering Sun, 13 Jun 2010 14:53:54 -0400 http://wordpress.org/?v=2.9.2 hourly 1 By: Bitmix http://www.alex-ionescu.com/?p=35#comment-46995 Bitmix Wed, 21 Apr 2010 18:43:21 +0000 http://www.alex-ionescu.com/?p=35#comment-46995 <strong>Bitmix...</strong> Радует, что ваш блог постоянно развивается. Такие посты только прибавляют популярности. http://questiontourism.ru/ .... Bitmix…

Радует, что ваш блог постоянно развивается. Такие посты только прибавляют популярности. http://questiontourism.ru/ ….

]]> By: Telebuzz http://www.alex-ionescu.com/?p=35#comment-46982 Telebuzz Thu, 15 Apr 2010 23:32:17 +0000 http://www.alex-ionescu.com/?p=35#comment-46982 <strong>Telebuzz...</strong> Я подписался на RSS ленту, но сообщения почему-то в виде каких-то иероглифов :( Как это исправить? http://woman911.ru/ .... Telebuzz…

Я подписался на RSS ленту, но сообщения почему-то в виде каких-то иероглифов :( Как это исправить? http://woman911.ru/ ….

]]> By: dpcowx http://www.alex-ionescu.com/?p=35#comment-46808 dpcowx Tue, 14 Apr 2009 17:29:12 +0000 http://www.alex-ionescu.com/?p=35#comment-46808 Hi Alex, The download link seems dead. Can you please update? Thanks, Danny Hi Alex,

The download link seems dead. Can you please update?

Thanks,
Danny

]]> By: ¿Quien vigila al vigilante? « Noticias del web http://www.alex-ionescu.com/?p=35#comment-46804 ¿Quien vigila al vigilante? « Noticias del web Wed, 04 Feb 2009 21:32:26 +0000 http://www.alex-ionescu.com/?p=35#comment-46804 [...] anuncian que han roto esa protección. El investigador de seguridad que lo ha roto ha publicado la utilidad para proteger y desproteger archivos en Vista, pero no publica las [...] [...] anuncian que han roto esa protección. El investigador de seguridad que lo ha roto ha publicado la utilidad para proteger y desproteger archivos en Vista, pero no publica las [...]

]]> By: HOWTO: Protect and unprotect Vista’s DRM-protected processes! « wblog3 http://www.alex-ionescu.com/?p=35#comment-46799 HOWTO: Protect and unprotect Vista’s DRM-protected processes! « wblog3 Sun, 25 Jan 2009 10:20:12 +0000 http://www.alex-ionescu.com/?p=35#comment-46799 [...] 25, 2009 I could only find two previous attempts at doing this - D-Pin Purr, which is heavily obfuscated, and this PDF which contains the solution but doesn’t present [...] [...] 25, 2009 I could only find two previous attempts at doing this – D-Pin Purr, which is heavily obfuscated, and this PDF which contains the solution but doesn’t present [...]

]]> By: Randnotiz: Noch ein Argument gegen DRM - Bibliothekarisch.de - Ehemals Chaoslinie.de http://www.alex-ionescu.com/?p=35#comment-46786 Randnotiz: Noch ein Argument gegen DRM - Bibliothekarisch.de - Ehemals Chaoslinie.de Wed, 19 Nov 2008 20:17:04 +0000 http://www.alex-ionescu.com/?p=35#comment-46786 [...] Lage sein, DRM-geschützte Prozesse bei “Bedarf” ein- und auszuschalten. In seinem Weblog zeigt er entsprechende Screenshots, die die einwandfreie Funktion der Software belegen [...] [...] Lage sein, DRM-geschützte Prozesse bei “Bedarf” ein- und auszuschalten. In seinem Weblog zeigt er entsprechende Screenshots, die die einwandfreie Funktion der Software belegen [...]

]]> By: ericuday http://www.alex-ionescu.com/?p=35#comment-24844 ericuday Mon, 21 Jan 2008 02:39:33 +0000 http://www.alex-ionescu.com/?p=35#comment-24844 Hi Alex, thanks for the info on protected processes and your POC tool. Unfortunately, I am unable to download the tool (dpinpurr.zip) from the link provided. Seems as though the link is broken? I am in the process of writing a white paper on user-mode memory scanning (on 32-bit and 64-bit Windows) for malicious content, which requires enumerating all processes and reading their virtual address space (commit pages). I would like to try out the tool on protected processes on Vista. Also, how do you go about reading a protected process's address space in Vista from user-mode? or kernel-mode? For memory scanning on Vista, in case of protected process, would it be useful to simply un-protect the process, read its virtual address space and then protect it back again? If the memory content is found to be malicious, it could then be flagged as malicious. Regards, Eric Kumar http://fightmalware.blogspot.com Hi Alex, thanks for the info on protected processes and your POC tool. Unfortunately, I am unable to download the tool (dpinpurr.zip) from the link provided. Seems as though the link is broken? I am in the process of writing a white paper on user-mode memory scanning (on 32-bit and 64-bit Windows) for malicious content, which requires enumerating all processes and reading their virtual address space (commit pages). I would like to try out the tool on protected processes on Vista. Also, how do you go about reading a protected process’s address space in Vista from user-mode? or kernel-mode? For memory scanning on Vista, in case of protected process, would it be useful to simply un-protect the process, read its virtual address space and then protect it back again? If the memory content is found to be malicious, it could then be flagged as malicious.

Regards,
Eric Kumar
http://fightmalware.blogspot.com

]]> By: molotov http://www.alex-ionescu.com/?p=35#comment-11970 molotov Wed, 05 Sep 2007 12:41:47 +0000 http://www.alex-ionescu.com/?p=35#comment-11970 @dfranklin - I got the same error, until I created [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and added a REG_DWORD named "Type". @dfranklin – I got the same error, until I created [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and added a REG_DWORD named “Type”.

]]> By: molotov http://www.alex-ionescu.com/?p=35#comment-11816 molotov Tue, 04 Sep 2007 03:07:07 +0000 http://www.alex-ionescu.com/?p=35#comment-11816 @dfranklin - I had to create [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and add a REG_DWORD value named Type. Once I did that, dpinpurr worked. Previously, it displayed the same error ("[C0000034] - Internal error."). @dfranklin – I had to create [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and add a REG_DWORD value named Type. Once I did that, dpinpurr worked. Previously, it displayed the same error (“[C0000034] – Internal error.”).

]]> By: Зеркало: Кузнецов Виталий [MSP] http://www.alex-ionescu.com/?p=35#comment-5943 Зеркало: Кузнецов Виталий [MSP] Mon, 04 Jun 2007 15:34:41 +0000 http://www.alex-ionescu.com/?p=35#comment-5943 <strong>Защищенные процессы Висты оказались не слишком защищенными</strong> Алекс Ионеску (Alex Ionescu) выложил в открытый доступ утилиту, позволяющую прои Защищенные процессы Висты оказались не слишком защищенными

Алекс Ионеску (Alex Ionescu) выложил в открытый доступ утилиту, позволяющую прои

]]> WordPress database error You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), for query INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_site_transient_timeout_theme_roots', '1284044812', 'yes') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`) made by require, require_once, require_once, require_once, get_template_directory, get_theme_root, get_theme_roots, get_themes, set_site_transient, add_site_option, add_option WordPress database error You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), for query INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_site_transient_theme_roots', 'a:2:{s:7:\"classic\";s:7:\"/themes\";s:7:\"default\";s:7:\"/themes\";}', 'yes') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`) made by require, require_once, require_once, require_once, get_template_directory, get_theme_root, get_theme_roots, get_themes, set_site_transient, add_site_option, add_option