Hex-Rays Blog

While analyzing a program quite often we want to know if it uses any crypto algorithm. Knowing the algorithm name would be useful too. Here is the plugin which can help us answer these questions.

The last week Ero Carrera in his blog linked to this spectacular site:

A decompiler is commonly viewed as a tool to recover the source code of a program, the same way as a disassembler is a tool to convert a binary executable program to an assembler text. This is true in some cases but only in some.

I restored the old configuration and the blog will continue its normal operation now. The hotfix can not be downloaded from the site anymore but its source code is still available. Thank you all for the support! I’d like to say thank you once more to the guys who mirrored the files! P.S. Next week we will […]

The new version is suitable for automated setup (for example, in logon scripts).

It seems that many users installed the hotfix for the WMF vulnerability on their machines.

This week a new vulnerability was found in Windows: http://www.microsoft.com/technet/security/advisory/912840.mspx Browsing the web was not safe anymore, regardless of the browser. Microsoft will certainly come up with a thouroughly tested fix for it in the future, but meanwhile I developed a temporary fix – I badly needed it.

So far this is the absolute record for the binary size of one division/remainder/multiplication operation:

Suppose our goal is to dissect a new program. The ultimate method of analysis is single stepping the program of interest. Each executed instruction must be single stepped at least once so we won’t miss anything important.

How do you spell “I love you” in Greek?…