Copyright (C) 2012-2014, Protean Security

All rights reserved.

The Visual Studio Projects repository contain the following projects described below!

• dga

  Code samples for domain generation algorithm (DGA) article.

• createfile

  A project that was used in the The Sysenter Instruction and 0x2e Interrupt article.

• createremotethread

  A project that uses CreateRemoteThread function to inject a DLL into chosen process's address space.

• dllinject

  The DLL that can be injected into some process so it can hook the IAT import table.

• dlltest

  This is a sample DLL that was used in the article accessible here: Api Hooking Detours.

• flags

  A very simple program for reverse engineering where you can see the difference between creating an object on stack versus the heap.

• helloworld

  This is a "Hello World" project that uses a software interrupt to instruct a debugger to pause execution just before the printf statement is reached. Basically it uses the __asm { int 0x3 }; code block.

• hookidt

  Windows kernel driver that hooks IDT descriptors and runs arbitrary function when the chosen interrupt is invoked.

• hookmsr

  Windows kernel driver that hooks MSR entries and runs arbitrary function when the sysenter instruction is used for system calls.

• hookssdt

  Windows kernel driver that hooks SSDT system calls, which is able to hook arbitrary system calls regardless of whether they're being called with "int 0x2e" or sysenter.

• isdebuggerpresent

  A project that uses IsDebuggerPresent function that can detect whether a debugger is being used to debug the current program. There are two articles where this project is relevant: Anti-Debugging: Detecting System Debugger

• kerneldebug

  A simple project that uses the NtQueryInformationProcess function to get information from the process.

• linearsweep

  This program was used in the following article Linear Sweep vs Recursive Disassembling Algorithm

• setwindowshookex

  A project that uses SetWindowsHookEx function to inject a DLL into chosen process's address space.