Defeating malware’s Anti-VM techniques (CPUID-Based Instructions)

  Introduction You should by now be aware of everything, cause the topic’s title clearly describes the contents of this post. As you know, almost all of the modern malware programs use some bunch of packers or protectors and using such tools cause malware to be weaponized with Anti-VM techniques which makes it impossible for […]

Inside Windows Page Frame Number (PFN) – Part 2

Converting Physical Address to Virtual Address and  Virtual Address to Physical Address MmGetVirtualForPhysical (PA -> VA) One of the purposes of using PFN database is for converting physical address to virtual address but in Windows, you can simply call nt!MmGetVirtualForPhysical and convert your physical address to virtual address, you can see a complete list of Memory […]

PyKD Tutorial – part 2

  Breakpoints Breakpoints are such useful things and can give you the power of analyzing programs in a better and easier way by using PyKD. In the API Reference they introduce setBp function in the following way :

As you can see, setBp can give a pointer as its first argument and a python function as the […]