top of page
Writer's pictureinojmikelcamalelo

Sig Maker Для Ollydbg: A Comprehensive Tutorial on Signature Creation and Usage



resume.exe is an advanced shellcode injector of which we had encountered only one sample as of the writing of this article. Before it gets down to business, this malware, like many other samples we have seen from Winnti, checks the current year. Current processes are checked and the malware will not run if any of the following are active: ollydbg.exeProcessHacker.exeFiddler.exewindbg.exetcpview.exeidaq.exeidaq64.exetcpdump.exeWireshark.exe.




Sig Maker Для Ollydbg



I started from the player crash, it reported that it crash in igdumdim32.dll @0x59c4EA0C, the igdumdim32.dll and igdumdim64.dll is the Intel's user space graphics drivers' core file, the Intel's graphics has a small kernel part called miniports, it only open the tunnel between userspace application and the hardware, the real working part is in the DLL, like 3D function, video acceleration and Direct draw. Use a debuger like ollydbg to debug it I found it's a function do some setting work: 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments

Couldn’t Load Comments
It looks like there was a technical problem. Try reconnecting or refreshing the page.
bottom of page