<DaotrongChuong> I have some questions I used the pro version of IDA but now it comes out GHIDRA version of the US Department of Homeland Security and I know that this security department they are the most powerful security department in the world No one can match but in your opinion, this application with IDA PRO is the best, can anyone give me an opinion, thank you very much or I will use both programs.
<apkunpacker> why you saying same thing in all groups ? (re @DaotrongChuong: I have some questions I used the pro version of IDA but now it comes out GHIDRA version of the US Department of Homeland Security and I know that this security department they are the most powerful security department in the world No one can match but in your opinion, this application with IDA PRO is the best, can anyone give me an opinion, thank you very much or I will use both programs.)
<GroupAnonymousBot> Read the pin message. (re @DaotrongChuong: I have some questions I used the pro version of IDA but now it comes out GHIDRA version of the US Department of Homeland Security and I know that this security department they are the most powerful security department in the world No one can match but in your opinion, this application with IDA PRO is the best, can anyone give me an opinion, thank you very much or I will use both programs.)
<DaotrongChuong> I'm sorry that I think each group is different. I'm really sorry and I won't let it happen again and again. Thanks for reminding .
<uafAdmin> I am doing malware analysis and this particular malware creates multiple RWX regions, decrypts code and writes to them. But the issue is it doesn't jump on starting of page, rather it jumps/calls somewhere in the middle of the page and then executes further. Since I don't know where it jumps/calls, I am looking for some plugin/reference on how to break if code starts executing from middle of page.
<uafAdmin> I guess one way would be change the memory protections of the RWX pages to PAGE_NOACCESS and then manually investigating there but if there's an already existing plugin/solution for that, please let me know. That would really help. :D
<mrexodia> You might be able to use memory breakpoints (re @uafAdmin: I guess one way would be change the memory protections of the RWX pages to PAGE_NOACCESS and then manually investigating there but if there's an already existing plugin/solution for that, please let me know. That would really help. :D)
<brigadir15> > rax: {rax} formats to rax: 4C76
And now I need to log memory content. Something like this:
{mem;1@ebp}
Works fine, but I need to show 1 byte from dereferenced ebp :-(
And now I need to log memory content. Something like this:
{mem;1@ebp}
Works fine, but I need to show 1 byte from dereferenced ebp :-(
<brigadir15> Oh, @[ebp] worked fine... Sorry for bothering :-)
<brigadir15> Yes, it would be nice to have an example for such case in the documentation!
<mrexodia> Yep! You can click “edit this page” (re @brigadir15: Since the documentation is on GitHub, could/should I propose a patch for an example?)
<bilka00> sample - this vmprotect 3.5:
<Mwha> Email list avaliable, Contact me price low
<kaens> @mrexodia , that is
<Mwha> /report (re @kaens: /report)
<kaens> Explains the low price. Matches the intelligence.
<apkunpacker> can you send this sample in dm please , which show false detection for VMP in die? (re @bilka00: )
<bilka00> I can’t this one, but now I’ll pack Hello world. (re @apkunpacker: can you send this sample in dm please , which show false detection for VMP in die?)
<mrexodia> Read the rules (re @bilka00: I can’t this one, but now I’ll pack Hello world.)
<bilka00> That there is a sample to throw here? (this is not a crack, this is just an example) (re @mrexodia: Read the rules)
<mrexodia> But it’s not about x64dbg
<mrexodia> Feel free to DM each other
<CL4X0> Like i set a memory breakpoint on a section of memory and I break on a jmp
But,when I scroll up,there is no jmp,it is changed into something else
Making it impossible to set a soft breakpoint in that jmp
But,when I scroll up,there is no jmp,it is changed into something else
Making it impossible to set a soft breakpoint in that jmp
<mrexodia> You can use B to manually mark things as data and it will disassemble correctly
<CL4X0> Okay thanks,I will try and see
<CL4X0> Your debugger is really impressive
<Atn> Try next door
<kaens> Are you making x86 chip music or something xD
<CL4X0> @[telegram] SHINOLAA#0000 this thing is not available as a vst yet lol