How to spoof your debug(softICE&OllyDBG) ?

reverse engineering時曾碰過此情形，當exe執行時沒什麼特別問題，直到載入debug後跳出這樣的框架。

Bad or unknown format of 32-bit executable file'D:t.exe'
 

DDK build for VC 6.0

Tools→Options→Directories

Executable files
    "D:\WINDDK\3790.1830\BIN\X86"

Include files

    "D:\WINDDK\3790.1830\inc\wxp"
    "D:\WINDDK\3790.1830\inc\crt"
    "D:\WINDDK\3790.1830\inc\ddk\wxp"
    "D:\WINDDK\3790.1830\inc\ddk\wdm\wxp"

Library files
    "D:\WINDDK\3790.1830\LIB\WXP\I386"

PE structure

[11/02/24]ImageShack pulls plug on hotlinking to unregistered domains(ImageShack新策略)&青蛙解凍大全

一、兩個禮拜前在逛論壇網站時看到有關圖文文章即頻頻出現「冷凍青蛙」圖

這是作者在寫作插圖時將圖片上傳至國外一家有名的免費圖片上傳空間ImageShack來置入文章所發生的事，在各大論壇、拍賣、部落格上可以看到一大片的「冷凍青蛙」，至於為什麼？這是ImageShack公司的新改革，以下新聞文章引用於vr-zone.com。

Free image hosting services are a dime a dozen, so migrating over to another service should be as easy as pie, should it not? After all, the only thing one has to do is to download the entire photo album from the original hoster, extract the images from within and re-upload them into the new image hoster.

[Analyze] Worm/Piloyd.au / Win32.Viking.AR [無極殺手]

有一天網路上收集資料不小心中了這款,

起初啟動Expor.exe,透過Expor.exe,間接隨機生成調用xmlprov.dll,ntmssvc.dll,mspmsnsv.dll,tapisrv.dll,
最後加載驅動並將常規防毒軟體、工具關閉(如360),
好奇為什麼殺不太掉,於是看了下,