1.
SYMTEX-Explosive Firewall Subversion
File Format: PDF/Adobe Acrobat - View as HTML And so was skywing :) kd> !chkimg -ss .text -d nt. 80501060-80501067 8 bytes - nt!KiServiceTable+30. [ 62 96 5c 80 12 96 5c 80:f8 58 7a 82 78 3c 7a 82 ] ...
2.
libloader -- In-Memory Remote Library Injection shellcode * Jarkko ...
LoadLibrary, eax ; Save the VMA push HASH_GetProcAddress ; Here we go again.. push ebx call find_function add esp, 8 mov ctx. ...
3.
4.
5.
6.
7.
8.
9.
10.