English - Yavuz Han

[EN] WDK Tips - Some errors and solutions

If I talk about this error, I would like to state that I did not meet for the first time. For several reasons, I had to delete my virtual machines on the computer. But before this action, it was working well. So I did the same steps to create my lab again.

English

[EN] Dump Analysis Using Radare and Windbg

Main idea is to get executable file from the dump. When I try with WinDbg, there was a problem related with the SDK (even with last version) and some missing Dll files. It was also some plugins need to be install. I had some problems with

English

[EN] Intel PIN: Dynamic Binary Analysis tool

PIN is dynamic binary analysis tool for x86/64 and MIC instruction -set architectures. I started to use it for tracing and deobfuscating malware.

English

[EN] Emotet malware technical analysis

When we look at the import section of the PE Bear output, based on IAT information, we can see that there are several different Window DLL is loading; ; kernel32.dll, user32.dll, gdi32.dll, advapi32.dll, shell32.dll and shlwapi.dll. We can also take a look at our malicious file on IDA Pro before

English

[EN] Hermes Ransomware Technical Analysis

At the end of January 2018, the KrCERT published CVE-2018-4878 of a Adobe flash player 0-Day. According to the published vulnerability, this vulnerability exist in Adobe Flash Player 28.0.0.137 and below. The vulnerability was distributed via malicious Office documents

English

[EN] My lab environment and the tools I use

There is a few options for disassemblers tools. I was decided to use IDA Pro. But there is one negative side for me. If I remember right, it was supporting x86 architecture last year (2017). I do not know what happend and they stopped to support. Actually that

English

[EN] How to enable PowerShell in Win7?

After a long time, I wrote a short article. I created new virtual lab environment with win7x86. Then I tried to run a script that ended with .ps1 on PowerShell but there was a some errors. The main reason for the mistake is as follows:

English

[EN] Windows Kernel Exploitation – Setting up the Environment

I set up two different Windows OS like previous one and the second step is to set the Serial Port. It was easier to set up Serial Ports in VirtualBox than in Vmware. I was using Windows10Prox64 as a debugger. When I try to use Windbg on this