Introducting D-Pin Purr v1.0 – 32bit Edition

As promised in my earlier blog post, I’ve finalized the utility and made it available for download here. I won’t be releasing source code for the moment because I don’t want to encourage people to start adding this kind of code into their own malware programs, nor to encourage the Symantec folks to start unprotecting every process on the system.

So until then, have fun with the tool, whether it is to explore previously protected processes, or to try out various system and application behaviour when certain processes are made protected. Here’s a screenshot of audiodg.exe after being unprotected. Try it on your own system to see the before/after difference.

22 Replies to “Introducting D-Pin Purr v1.0 – 32bit Edition”

  1. Pingback: Ayyas
  2. Why the program deletes the drmkaud.sys and not
    crusoe.sys:drmkaud.sys when finishing?
    Also I’m curious, what is the meaning of 12th bit
    of dword @offset 224h in EPROCESS ?
    Lock/unlock proc?

  3. So, how do I download and try this applet??? Do not seem to find download button here??? Thanx

  4. the word here is actually a link. =P

    don’t worry, i understand that it’s hard to notice a four letter link.

  5. I don’t know if the application does what it says but it runs without error on Windows XP :p

  6. @dfranklin – I had to create [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and add a REG_DWORD value named Type. Once I did that, dpinpurr worked. Previously, it displayed the same error (“[C0000034] – Internal error.”).

  7. @dfranklin – I got the same error, until I created [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and added a REG_DWORD named “Type”.

  8. Hi Alex, thanks for the info on protected processes and your POC tool. Unfortunately, I am unable to download the tool (dpinpurr.zip) from the link provided. Seems as though the link is broken? I am in the process of writing a white paper on user-mode memory scanning (on 32-bit and 64-bit Windows) for malicious content, which requires enumerating all processes and reading their virtual address space (commit pages). I would like to try out the tool on protected processes on Vista. Also, how do you go about reading a protected process’s address space in Vista from user-mode? or kernel-mode? For memory scanning on Vista, in case of protected process, would it be useful to simply un-protect the process, read its virtual address space and then protect it back again? If the memory content is found to be malicious, it could then be flagged as malicious.

    Regards,
    Eric Kumar
    http://fightmalware.blogspot.com

  9. Pingback: Telebuzz
  10. Pingback: Bitmix

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.