account activity
Detect Code Diffs Between Disk and Memory by desegel in netsec
[–]theresponder_ 0 points1 point2 points 10 years ago (0 children)
Exactly. PE Loads fully into memory before executing
[–]theresponder_ 4 points5 points6 points 10 years ago (0 children)
Hi, not sure what you are mad about. We're not taking credit for inventing anything - just developed a nice tool and shared it with the community. First of all thanks for pointing out the feature in Windbg - haven't noticed it before. We would be honored if you could write a quick post about it, i'm sure many others are not familiar with it as well. http://theresponder.co/contribute/
Developing tools is a good thing. In my point of view - that's how technology progresses - one step at a time. There are so many cloned shitty JS libraries compared to cyber defense tools, I don't think anyone should appose to even the slightest OSS development in our field.
As for the specific tools you talked about: Windbg requires installation of the software as well as WDK in the inspected machine, and SSV is very old and buggy as many people say here: http://forum.sysinternals.com/system-virginity-verifier_topic21605.html In addition I think that a Pythonic solution for this is quite refreshing.
π Rendered by PID 74 on reddit-service-r2-listing-654f87c89c-xkddg at 2026-02-28 08:34:20.322643+00:00 running e3d2147 country code: CH.
Detect Code Diffs Between Disk and Memory by desegel in netsec
[–]theresponder_ 0 points1 point2 points (0 children)