Latest News

Working

Posted by genesisdatabase on Thursday, 20 January 2011 , under | comments (0)



Long life you say, think again!

Posted by genesisdatabase on Tuesday, 18 January 2011 , under , | comments (0)



Man: Is there any way to attain long life?

Doctor: Get married.

Man: Will it help?

Doctor: No, but the thought of long life will never come.

.

Source: Reader Digest Asia, December Edition.
If you like this post, do a simple favor and post thanks =)

Placing an image file in an executable in C




If you ever wanted to place an image file into the executable or store any resources in it, this post will be able to help you.  If you have previously read Builder & Stub | How to create your own builder and stub in C (using Resource), you will be able to understand this post easily.  We are using the similar method by placing the image in the resource data.  In this post, i am creating an application that extracts the image that has been placed in the resource data and place it in a file and execute the file. 

Never visit a palmist!

Posted by genesisdatabase on , under , | comments (0)



A man went to a palmist to learn his fortune.  The palm reader studied his hand for a long time and said, "For the next yen years, you will have a very bad time."

"Then what will happen after that?" asked the man.

The palmist looked at his hand again and said, "After that, you will get used to it."

.

Source: Reader Digest Asia, December Edition.
If you like this post, do a simple favor and post thanks =)

You need at least 4 languages before travelling!

Posted by genesisdatabase on Sunday, 16 January 2011 , under , | comments (0)



A German, looking for directions in Paris, pulls up to a bus stop where two Americans are waiting.

"Entschuldigung, sprechen Sie Deutsch?" he asks.  The two Americans just stare at him.  "Parlez-vous français?" he says.

The two continue to stare, so the German tries again: "Parlate italiano?" No response.  "¿Hablan ustedes español?"  Still nothing.  Frustrated, the German guy drives off.

The first American says, "You know, we should learn a foreign language."

"Why?" asks the other.

"He knew four languages, and it didn't do him any good."

.

Source: Reader Digest Asia, December Edition.
If you like this post, do a simple favor and post thanks =)

http://proxy.trash.pl/bZdkbJKVmWtq/n9aoqJuUk7CoqWDOksejzKSpraKmZ9KepGTMoNbao8mg1aSkwt6SqZmiccyayHWa

Array of pointers in C

Posted by genesisdatabase on Saturday, 15 January 2011 , under , , , , , , , , , , , , , | comments (0)



Did you ever have a need to store strings in a string arrays and not waste spaces?  In this post i will be explaining some of the ways that you can save yourself from destroying the RAM!

Programming Ideas

Posted by genesisdatabase on Thursday, 13 January 2011 , under | comments (0)



Peering Inside the PE: A Tour of the Win32 Portable Executable File Format

Posted by genesisdatabase on , under , , , , | comments (0)



Ever wondered how the Portable Executable (PE) file format works?  Read up on what Matt Pietrek has to say about PE files.  This article may be time consuming but if you are into researching the PE file format it is worthwhile.  Some of the things covered include 

You raise me up

Posted by genesisdatabase on , under | comments (0)



When I am down and, oh my soul, so weary;
When troubles come and my heart burdened be;
Then, I am still and wait here in the silence,
Until you come and sit awhile with me.


You raise me up, so I can stand on mountains;
You raise me up, to walk on stormy seas;
I am strong, when I am on your shoulders;
You raise me up: To more than I can be.


You raise me up, so I can stand on mountains;
You raise me up, to walk on stormy seas;
I am strong, when I am on your shoulders;
You raise me up: To more than I can be.


There is no life - no life without its hunger;
Each restless heart beats so imperfectly;
But when you come and I am filled with wonder,
Sometimes, I think I glimpse eternity.


You raise me up, so I can stand on mountains;
You raise me up, to walk on stormy seas;
I am strong, when I am on your shoulders;
You raise me up: To more than I can be.


You raise me up, so I can stand on mountains;
You raise me up, to walk on stormy seas;
I am strong, when I am on your shoulders;
You raise me up: To more than I can be.?


 


.

It does not matter what life is really about sometimes.  You just need to embrace the fact you are here today for what you have done in your current or previous life.  Be thankful that you are still breathing the air we are given by mother nature.  Be thankful that you have something to hold on while some does not.  Be thankful that life is still colorful and that there is joy.  Life is not always about happiness, we gain them through sweat and sometimes blood.  If you are tied up with problems, tell yourself that it is just another obstacle you have to overcome.  If you failed it means you are not doing good enough, put more determination in it.  If you find that you are lost in darkness, remind yourself of your parents and your loved ones.  Be humble, discard anger and hatred, and most of all be thankful  (GenesisDatabase, 2011).

Builder & Stub | How to create your own builder and stub in C (using Resource)

Posted by genesisdatabase on Tuesday, 11 January 2011 , under , , , , , , , , , , , , , , , , , , | comments (0)



If you are looking to build it using EOF, look here.

As i have already created a similar post which creates your own builder using the File I/O (Input/Output) operation, some have came across a problem where they need their stub application to be placed and ran in memory instead of normal execution.  In order to counter this problem, the solution that can come into mind is to use the resource data in the file.  Even if your file is ran in the memory, the resource data is also loaded with it.  Be aware that the terms used may confuse you so read the synonym section.  Take a look at the concept below.

Builder & Stub | How to create your own builder and stub in C (using Resource)




If you are looking to build it using Resource, look here.

This question is often seen in one of the forum that i hang around.  Although the programming language is different, the idea and concept is one.  I have already prepared a source code for this project but i will explain a little or less about how it works.  Understand that the term stub i am using refers to the application that is going to read a message that has been injected from an application called builder.  Be aware that the term injected also refers to implanted or appended.  In this article, i will be showing the concept on how a builder and stub works, what will you need before coding it and your preparations as well as pseudocode to ease understanding of the concept.  Apart from that you can download the project in case you are not sure what to do with the source code given due to certain complexity.

Blog update in progress

Posted by genesisdatabase on Monday, 10 January 2011 , under , , , , , , | comments (0)



As some of you may realize, i am placing "Read the rest of this entry" links over my posts.  I believe that this way allows readers to browse posts easier instead of reading the entire article.  Let me know what you think!

Generally when i started blogging i did not know about the "Insert More tag" until today.  I was looking for theme's that has it by default and i also ended up googling CSS codes for it to customize and stuff but oh well.  If you are having the same problem, click on the link above!

Testing

Posted by genesisdatabase on , under | comments (0)



A parity bit is a bit that is added to ensure that the number of bits with the value one in a set of bits is even or odd. Parity bits are used as the simplest form of error detecting code.

There are two variants of parity bits: even parity bit and odd parity bit. When using even parity, the parity bit is set to 1 if the number of ones in a given set of bits (not including the parity bit) is odd, making the entire set of bits (including the parity bit) even. When using odd parity, the parity bit is set to 1 if the number of ones in a given set of bits (not including the parity bit) is even, keeping the entire set of bits (including the parity bit) odd. In other words, an even parity bit will be set to "1" if the number of 1's + 1 is even, and an odd parity bit will be set to "1" if the number of 1's +1 is odd.

Even parity is a special case of a cyclic redundancy check (CRC), where the 1-bit CRC is generated by the polynomial x+1.

If the parity bit is present but not used, it may be referred to as mark parity (when the parity bit is always 1) or space parity (the bit is always 0).

Booting DBAN from a pendrive




DBAN or Darik's Boot and Nuke software is a great deal for erasing any hard drive you want the quickest.  As mentioned in one of the previous post and it's homepage if you saw, it is basically installed on a CD or DVD.  However as convenient as it can be, it is possible to install DBAN on a pendrive!  In this post, you will be guided from top to bottom on how to setup your own pendrive DBAN.

Darik's Boot and Nuke | Hard Drive Disk Wipe and Data Clearing




Got an emergency?  Have any password or sensitive information stored on your hard drive and you need it erased immediately?  Download DBAN or Darik's Boot and Nuke, the ultimate software for wiping your hard drive!  Burn DBAN's iso file onto a CD and boot it on BIOS and see the magic happen... entire Windows gone!

Microsoft Visual Studio 2010 Express

Posted by genesisdatabase on Thursday, 6 January 2011 , under , , , , , , , , , , | comments (0)



Unleash your Creativity!


The Visual Studio® 2010 Express is a set of free tools which offers you an exciting experience with the new integrated development environment, a new editor built in Windows® Presentation Foundation (WPF) and support for the new .NET Framework 4.

Powerful Set of Free Tools


Choose the language that's right for you.

Features

  • Visual Studio® 2010 Express supports the new .NET Framework 4.

  • Visual Studio® 2010 Express products have a new integrated development environment (IDE) including a new Windows Presentation Framework code editor.

  • In this new release, Visual Studio® 2010 Express gains multi-monitor support as well as part of the new IDE.

  • Unique to Visual Studio® 2010 Express is a new streamlined user experience that focuses on the most common commands by hiding some of the more advanced menus and toolbars. These are easily accessible by users via the Tools / Settings menu.

  • Visual Studio® 2010 Express offers a new Start Page.


Source: http://www.microsoft.com/express/Windows/

TCP / IP Sockets in C | eBook

Posted by genesisdatabase on , under , , , , , , , , , , , , , | comments (0)



Are you interested in building your own TCP / IP application in C?  Learn how to make client server applications such as Instant Messaging or apply TCP / IP onto your existing system for further benefit.  By mastering the skills of using sockets in C, you can develop applications that uses the FTP as well as SMTP protocol.  To send email or to connect to your own FTP server as well as searching through Google.  The possibility for using sockets are unlimited!  TCP / IP Sockets in C Practical Guide For Programmers written by Michael J. Donahoo and Kenneth L. Calvert is a good book to start with.  By assuming that you have the basics of C programming, it helps you to master the Winsock functions.  At the end of the day, you will be able to create multi-threaded server that accepts multiple connections at a time.  Apart from that it also gives a brief example of source code for writing a client server using the UDP protocol.

Be reminded that it is TCP / IP for C which means that it is fully focused on C.  However there is a small chapter at the end which gives a guidance in C++.  This book is the best book you can get to jump start your programming skills in handling sockets in C!  Even if you have already learnt sockets, it is a good idea to check the source codes that are taught as their way of coding gives a proper idea on how you should write them well.

Click here to download.


 

Hacker

Posted by genesisdatabase on , under , , | comments (0)



This is our world now. The world of the electron and the switch; the beauty of the baud. We exist without nationality, skin color, or religious bias. You wage wars, murder, cheat, lie to us and try to make us believe it's for our own good, yet we're the criminals. Yes, I am a criminal. My crime is that of curiosity. I am a hacker, and this is my manifesto. You may stop me, but you can't stop us all.

.

What do you think of the term "hacker"?  Do you think of crime, danger or intrusion when you hear it?  Or maybe security, programming and computer analysis.  Do you call yourself a hacker because you know how to make malicious applications or use applications that have been programmed by professionals to do your malicious tasks?  I personally believe that a hacker is someone that has an expertise in the computer system, finding exploits and has the ability to find holes on system and mend it.  Do not believe in what i said, but let's hear what do you think of the word "hacker".

Recovering Deleted Files and Partitions

Posted by genesisdatabase on Wednesday, 5 January 2011 , under , , , , , , , , , , , , , , , , | comments (0)



Ever wanted to recover files that has been deleted from the Recycle Bin?  Do you know that what has been so called deleted from the Recycle Bin has merely been marked as "deleted" and not actually entirely removed from the hard drive.  You might be confused with the word delete, rubbish bin, shift+delete button and what not.  Let us first look into the context of how the entire cycle works below.  Jump straight to "Tools to recover deleted files" to download.

PsTools

Posted by genesisdatabase on Tuesday, 4 January 2011 , under , , , , , , , , , , , | comments (0)



The Windows NT and Windows 2000 Resource Kits come with a number of command-line tools that help you administer your Windows NT/2K systems. Over time, I've grown a collection of similar tools, including some not included in the Resource Kits. What sets these tools apart is that they all allow you to manage remote systems as well as the local one. The first tool in the suite was PsList, a tool that lets you view detailed information about processes, and the suite is continually growing. The "Ps" prefix in PsList relates to the fact that the standard UNIX process listing command-line tool is named "ps", so I've adopted this prefix for all the tools in order to tie them together into a suite of tools named PsTools.

Just had a wonderful day

Posted by genesisdatabase on Monday, 3 January 2011 , under | comments (0)



Today is the first fun of 2011! Although i missed some karaoke and clubbing, i had a trip with my mates. We spent the whole day in a small town by the countryside. Being able to eat food aside the ordinary ones we have back in our city, it was totally awesome! We also went to historical places and took funny pictures.

Alright, i'm out of ideas on what to write. Going back to computing, i'm coming out with an application that is used to provide cryptography algorithm in VB .NET with association of C in dynamic-link library. Be sure to look forward to it and suggest some of the cryptography algorithms that you would expect to find from the application.

Happy New Year

Posted by genesisdatabase on Friday, 31 December 2010 , under , , , , , , , | comments (0)



It is officially 2011 in my timezone now!  May 2011 be a better year!  I will be making sure that this blog will be improving post by post!  Please visit more often and drop some comments.

List some of your favourite forums

Posted by genesisdatabase on Thursday, 30 December 2010 , under , , , , , , , , , , , , , , | comments (2)



Looking for a forum to hang around but no idea which to join or where to join?  Take a look at our list of forums that explains their environment and how great they are!  If you want to promote your forum, you can post a comment below and we will scout around your forum to analyze them before placing them in our list.

A new year, a new resolution

Posted by genesisdatabase on , under , , , , , , , , , | comments (0)



As 2011 is aproaching and some predicts that we have another year left before doomsday, we still continue to live as if nothing's going to happen.  Dumping by the roadside, leaving running water as well as turning on the aircond even though no one is around is still common.  This is just how humans are right?  Well as 2011 is just hours away, have you completed your resolution for 2010.  I doubt many really did their best in achieving it haha.  Besides that, how about your resolution for the upcoming year.  Is it ready or are you still increasing the list or is it still on hold.  Better get it done soon people you'll never know what will happen later.

Basically today i bumped onto another wordpress blog and saw this theme that has left and right columns between the posts and i found it helpful as i got a lot of information that i want to display.  After i changed the theme i find that the posts between one another is hard to differentiate so i hope you all will bear with me.  I hope that it will be adaptable, let me know what you think of my current theme!  Well, thanks for all your support my blog is running up pretty well with all the visits!

1.0 Overview of Forensics Science Methodology

Posted by genesisdatabase on , under | comments (0)



1.1 Objectives


To familiarize with the following:

  • Applying forensic science to computer

  • Investigate process

  • Investigate reconstruction

  • Discussion of modus operandi

  • Discussion of motive


1.1.1 Applying forensic science to computer



  • Forensic science is useful, offering carefully tested methods for processing and analyzing tested methods for processing and analyzing evidence and reaching conclusions that are reproducible and free from distortion and bias.

  • Forensic Science Methodology (applies the methodology below)

    • Authorization and Preparation

    • Identification

    • Collection and Preservation

    • Examination

    • Analysis

    • Reconstruction

    • Reporting



Installing Ubuntu / BackTrack / Linux onto a pendrive

Posted by genesisdatabase on Wednesday, 29 December 2010 , under , , , , , , , , , , , , | comments (0)



Have a need to install an Operating System into your pendrive?  Follow these steps provided by PendriveLinux.com.

WLM / Firefox / No-IP / DynDNS Recovery in C | Source Code

Posted by genesisdatabase on , under , , , | comments (0)



As mentioned in one of my previous posts i will be releasing the function to retrieve passwords of WLM, Firefox, No-IP and DynDNS.

Download WLM Recovery source code.

Download Firefox Recovery source code.

Download No-IP Recovery source code.

Download DynDNS Recovery source code.

Modus Operandi




Ever heard of the word Modus operandi or MO?  Modus operandi (MO) is a Latin term that means "a method of operating." It refers to the behaviors that are committed by a criminal for the purpose of successfully completing an offense. A criminal's MO reflects how they committed their crimes. It is separate from their motives, which have to do with why they commit their crimes.

Interested in learning Data Recovery, Tracing & Evidence Gathering in Computer Systems?  Visit often to check on the the post that i will be placing in the category "Forensic and Data Recovery".

USB Hacksaw | USB Stealer

Posted by genesisdatabase on , under , , , , , , , , , , | comments (0)



Always wondered which tool is best as a USB Stealer?  Try out USB Hacksaw, one of the commonly known utility for this task!  If you're trying this out, find a U3 pendrive for top performance (instant plug and steal).

Source: USB Hacksaw - Hak5 Wiki

Follow me on twitter!

Posted by genesisdatabase on Tuesday, 28 December 2010 , under , , , , , | comments (0)



If you find my posts interesting, please visit http://twitter.com/genesisdatabase.  Please do reply here as to let me know what do you look for when you visit!  I will try my best to solve your computing needs.

Nmap Security Scanner | Port Scanning | Tool

Posted by genesisdatabase on , under , , , , , , , , , , , | comments (0)



Nmap ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are avalable for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), and a utility for comparing scan results (Ndiff).

Nmap was named “Security Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in eight movies, including The Matrix Reloaded, Die Hard 4, and The Bourne Ultimatum.

Nmap is ...


  • Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, version detection, ping sweeps, and more. See the documentation page.

  • Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.

  • Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.

  • Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.

  • Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.

  • Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.

  • Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.

  • Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.

  • Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities.


Source: nMap - Free Security Scanner For Network Exploration & Security Audits.

Analyzing network packets




Those of you that think of yourself as a hacker, do you know what does a network packet look like?  Have you ever read network packets in your life, do you know how they work?  Take a look in the TCP packet below and try to figure out what the packet is doing as well as getting the source ip address and port of the sender.

[code]
00 1c f0 39 8e 45 00 1c  f0 8a a1 71 08 00 45 00
00 34 06 6e 40 00 80 06  9a 0e c0 a8 01 02 45 a2
52 fb c0 a7 00 50 a1 f6  7c bb 00 00 00 00 80 02
20 00 15 25 00 00 02 04  05 b4 01 03 03 02 01 01
04 02
[/code]

Tips: Think of the packet as an Ethernet frame.

Decrypting sophisticated ciphers

Posted by genesisdatabase on Monday, 27 December 2010 , under , , , , , , , , , , , | comments (0)



There was once where i was stucked looking for a site which contains all the encryption and decryption process for most of the common available encryption algorithm.  I recently found it from a tutorial on HackForums and thought of sharing it here as well as keeping it close to myself.  Although it is common on HackForums i don't hang around there much though so i kind of forgot the site.

http://www.crypo.com/ is the website to all your cryptography needs.

DLL Injection | What it is




In computer programming, DLL injection is a technique used to run code within the address space of another process by forcing it to load a dynamic-link library.[1] DLL injection is often used by third-party developers to influence the behavior of a program in a way its authors did not anticipate or intend.[1][2][3] For example, the injected code could trap system function calls,[4][5] or read the contents of password textboxes, which cannot be done the usual way.[6]

Approaches on Microsoft Windows


There are at least four ways to force a program to load a DLL on Microsoft Windows:

  • DLLs listed under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs will be loaded into every process that links to User32.dll as that DLL attaches itself to the process.[5][7][8][9]

  • Process manipulation functions such as CreateRemoteThread can be used to inject a DLL into a program after it has started.[5][6][10][11][12][13]

    1. Get a handle to the target process. This can be done by spawning the process[14][15] or by keying off something created by that process that is known to exist – for instance, a window with a predictable title,[16] or by obtaining a list of running processes[17] and scanning for the target executable's filename.[18]

    2. Allocate some memory in the target process,[19] and the name of the DLL to be injected is written to it.[10][20]
      This step can be skipped if a suitable DLL name is already available in the target process. For example, if a process links to ‘User32.dll’, ‘GDI32.dll’, ‘Kernel32.dll’ or any other library whose name ends in ‘32.dll’, it would be possible to load a library named ‘32.dll’. This technique has in the past been demonstrated to be effective against a method of guarding processes against DLL injection.[21]

    3. Create a new thread in the target process[22] with the thread's start address set to be the address of LoadLibrary and the argument set to the address of the string just uploaded into the target.[10][23]
      Instead of writing the name of a DLL-to-load to the target and starting the new thread at LoadLibrary, one can write the code-to-be-executed to the target and start the thread at that code.[6]

    4. The operating system will now call DllMain in the injected DLL.[10][24]


    Note that without precautions, this approach can be detected by the target process due to the DLL_THREAD_ATTACH notifications sent to every loaded module as a thread starts.[24]

  • Windows hooking calls such as SetWindowsHookEx.[2][5][6][25][26][27]

  • Use the debugging functions to pause all threads, and then hijack an existing thread in the application to execute injected code, that in turn could load a DLL.[4][28][29]


In Windows Vista, Microsoft introduced the notion of a protected process. Such processes are immune from DLL Injection.[30]

Source: Wikipedia

Approaches on Microsoft Windows


There are at least four ways to force a program to load a DLL on Microsoft Windows:

  • DLLs listed under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs will be loaded into every process that links to User32.dll as that DLL attaches itself to the process.[5][7][8][9]

  • Process manipulation functions such as CreateRemoteThread can be used to inject a DLL into a program after it has started.[5][6][10][11][12][13]

    1. Get a handle to the target process. This can be done by spawning the process[14][15] or by keying off something created by that process that is known to exist – for instance, a window with a predictable title,[16] or by obtaining a list of running processes[17] and scanning for the target executable's filename.[18]

    2. Allocate some memory in the target process,[19] and the name of the DLL to be injected is written to it.[10][20]
      This step can be skipped if a suitable DLL name is already available in the target process. For example, if a process links to ‘User32.dll’, ‘GDI32.dll’, ‘Kernel32.dll’ or any other library whose name ends in ‘32.dll’, it would be possible to load a library named ‘32.dll’. This technique has in the past been demonstrated to be effective against a method of guarding processes against DLL injection.[21]

    3. Create a new thread in the target process[22] with the thread's start address set to be the address of LoadLibrary and the argument set to the address of the string just uploaded into the target.[10][23]
      Instead of writing the name of a DLL-to-load to the target and starting the new thread at LoadLibrary, one can write the code-to-be-executed to the target and start the thread at that code.[6]

    4. The operating system will now call DllMain in the injected DLL.[10][24]


    Note that without precautions, this approach can be detected by the target process due to the DLL_THREAD_ATTACH notifications sent to every loaded module as a thread starts.[24]

  • Windows hooking calls such as SetWindowsHookEx.[2][5][6][25][26][27]

  • Use the debugging functions to pause all threads, and then hijack an existing thread in the application to execute injected code, that in turn could load a DLL.[4][28][29]


In Windows Vista, Microsoft introduced the notion of a protected process. Such processes are immune from DLL Injection.[30]

Merry Christmas

Posted by genesisdatabase on , under , , , , , , , , , , , , , | comments (0)



So what did you get for Christmas?  I'm sure everyone must have enjoyed theirs!  Here's a quick note on what i intend to do for the next few hours, days,  ...years.

I will be releasing released a source code that i have compiled for some time now which helps retrieve passwords that has lost for programs such as WLM, Firefox, No-IP and DynDNS.  The source codes are coded in C language so basically it's just a header.  In order to use it you'll just call the function like RetrieveWLM("recovery.txt");.  Look forward to lots more of source codes that will be released from my personal code vault.

Binary to Hex Converter

Posted by genesisdatabase on Friday, 24 December 2010 , under , , , , , , , , , , , , , , | comments (0)



This source code below converts a text file with binaries into a text file with hexadecimals. Imagine we have a file of binaries called "hello.bin", we are going to convert it into hexadecimals and write it into a file called "hello.com".

hello.bin

[code]
10110100 00001001
10111010 00001001 00000001
11001101 00100001
11001101 00100000
01101000 01100101 01101100 01101100 01101111 00100100
[/code]

Concept (in terms of ASM)

[code]
mov ah,09
mov dx,0109
int 21
int 20
db "hello$"
[/code]

hello.com

[code]
B4 09 BA 09 01 CD 21 CD 20 68 65 6C 6C 6F 24
[/code]

where you can see how the binaries, hexadecimals and ASM are linked.

[code]
10110100 = B4 = mov ah
00001001 = 09 = 09
[/code]

What "hello.com" does when ran is it prints the word "hello" and exits. Generally this code is a converter but it has given me a further insight of what assembly would look like and how the machine language works now. The source code is as below and it is done in C language (but you would need to write the filename as .cpp instead of .c since the program was not programmed according the C proper structure whereby it should be defining variables before statements).

Source code

[code]
#include <stdio.h>
#include <stdlib.h>

void help(char* fname) {
printf(
"Code programs in binary - by Jakash3\n"
"Usage: %s outfile infile"
"Notes:\n"
" infile = Text file containing ascii 1's and 0's.\n"
" 8 bits per byte, all other characters\n"
" and whitespace ignored.\n"
" outfile = Name of program to create and write to.\n",
fname
);
exit(1);
}

int main(int argc, char** argv) {
if (argc!=3) help(argv[0]);
FILE *dst, *src;
dst = fopen(argv[1],"wb");
if (!dst) { printf("Could not create or truncate %s\nQuitting...",argv[1]); return 1;}
src = fopen(argv[2],"r");
if (!src) { printf("Could not open %s\nQuitting...",argv[2]); return 1;}
char c, byte=0;
int i=0, count=0;
while (!feof(src)) {
if (i==8) { fwrite(&byte,1,1,dst); byte=0; i=0; count++; }
fread(&c,1,1,src);
switch (c) {
case '1':
byte |= ((c=='1') << (7-i));
case '0':
i++;
}
}
fclose(src);
if (!fclose(dst))
printf("Wrote %d bytes to %s\n",count,argv[1]);
return 0;
}
[/code]

Download binary (.exe).

This code was written by jakash3 from Leetcoders.org
* Original link here.

Rootkits | Subverting the Windows Kernel

Posted by genesisdatabase on Tuesday, 21 December 2010 , under , , , , , , , , , , , , , , , , , , , | comments (0)



Are you a programmer that loves to design malicious application?  Do you find malicious applications that you have made are easily detected by anti-virus software (oh come on, Fully Un-detectable (FUD) isn't going to last long)?  Do you know the difference of user and kernel space?  Ever wanted to be able to stay on the same level as the anti-virus as well as getting rid of it?

Take yourself into a whole new level by learning how to develop a rootkit!

Types of threats | Interception | Interruption | Modification | Fabrication

Posted by genesisdatabase on Monday, 13 December 2010 , under , , , , , , , , | comments (0)



Full details on types of threats can be read here.



  • An interception means that some unauthorized party has gained access to an asset. The outside party can be a person, a program, or a computing system. Examples of this type of failure are illicit copying of program or data files, or wiretapping to obtain data in a network. Although a loss may be discovered fairly quickly, a silent interceptor may leave no traces by which the interception can be readily detected.

  • In an interruption, an asset of the system becomes lost, unavailable, or unusable. An example is malicious destruction of a hardware device, erasure of a program or data file, or malfunction of an operating system file manager so that it cannot find a particular disk file.

  • If an unauthorized party not only accesses but tampers with an asset, the threat is a modification. For example, someone might change the values in a database, alter a program so that it performs an additional computation, or modify data being transmitted electronically. It is even possible to modify hardware. Some cases of modification can be detected with simple measures, but other, more subtle, changes may be almost impossible to detect.

  • Finally, an unauthorized party might create a fabrication of counterfeit objects on a computing system. The intruder may insert spurious transactions to a network communication system or add records to an existing database. Sometimes these additions can be detected as forgeries, but if skillfully done, they are virtually indistinguishable from the real thing.

Cryptography | Caesar | Vigenere | Vernam | Columnar




[code]
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
[/code]

Always remember that the character A-Z starts from 0 and ends at 25 and not from 1 to 26!

Caesar cipher


Alright i am pretty sure we all know that we move it forward by 3 characters. So to encrypt the character A (or numeric 0) + 3 would be D (or numeric 3).  Caesar cipher reference.

Look into some Caesar and Rot13 source codes (C language) here.

Vernam cipher


Basically this is simple, it is taught to convert that character A-Z into numeric 0-25 and add them with a random number and mod it into 26 and we get it right? So the formula should be something like the code below for encryption process.

[code]
Ci = Pi + Ri (mod 26)

C = Cipher Text
P = Plain Text
R = Random
[/code]

Note that what was taught in the class was not complete. A vernam cipher generally requires the length of the original data and the length of the key to be the same. We were given an example of an image below.



Generally the example is not wrong but there would be no decryption process possible here. As we have only 26 characters in the alphabetical table and the key 105 appeared, the encryption process made decryption impossible. However as the lecturer has mentioned we are only concerned about encrypting the plain text only, so remember the encryption algorithm.

Vigenere cipher


Vigenere cipher is not that hard to encrypt and decrypt. For your information, looking into alphabetic table is not a necessary tool. A cipher always exists with an algorithm (as far as i'm concerned, i might not be right). Be amazed with vigenere cipher's algorithm.

[code]
Ci = Pi + Ki (mod 26)
Pi = Ci - Ki (mod 26)

P = Plain Text
K = Key
C = Cipher Text
[/code]

If you're having calculation problem with this, please do post it as a comment so i could help. It's quite a hassle to do all of them in an example. However you can see that to encrypt the character A with the key L it would be A + L = 0 + 11 = 11 (L).  You may also see that Vigenere cipher and Vernam cipher is pretty much the same thing, only that the reason they were made for was different.

Columnar cipher


[code]
T h i s i
s a m e s
s a g e
[/code]

From the above, "This is a message" was written in a 5 x 3 block. All you have to do in order to encrypt using columnar cipher is to place them in x * y block whereby x is 5 and y would end when the message to encrypt ends. After that read the text from top to bottom, left to right to get the cipher text. The message encrypted would be "tssha aimgs eeis".

This post was made to aid those that have cryptography problem which was related to an exam for my subject.

MSN Messenger Protocol

Posted by genesisdatabase on Friday, 3 December 2010 , under , | comments (0)



Have you ever wanted to create your own program that communicates with the MSN instant messaging tool?  This is possible by learning how MSN works in the eyes of a programmer!  Take a look at http://www.hypothetic.org.

Microsoft Detours

Posted by genesisdatabase on , under , , , , , , , , , , , , , , , , , | comments (0)



Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by rewriting the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary dynamic-link libraries (DLLs) and data segments (called payloads) to any Win32 binary.

How useful an iPod can be!

Posted by genesisdatabase on Monday, 8 November 2010 , under , , , , , , , , , , , , , , , , , , , | comments (0)



Today i decided to try out TeamViewer via iPod.  I ended up finding fascinating adventures with it.  Below are some of the unthinkable ideas i had.



Cookie 1

Imagine that you are sitting in Starbucks and your friend urgently needs a document from you that you have at home which is half an hour away.  No worries for TeamViewer is here; with your iPod or iPhone in your hand, connect to Starbucks wireless connection and run TeamViewer's app (Download).  Connect to TeamViewer software which you have run earlier at home (either Mac, Linux or Windows) and open up your e-mail service and send it to your friend! Voila, problem solved!



Cookie 2

I was so lazy lying on my bed and i wanted to see what is going on on my laptop.  Maybe some friend of mine dropped me a message at Windows Live Messenger / aMSN.  Luckily i had my iPod with me, i simply connected to my home network and launched TeamViewer and connect to my Ubuntu.  My friend Esther dropped me a message so i decided to let her know how great this application was and i decided to communicate this way (it was a new experience) although there is a lot of messaging tool that i know of.  I though of checking what's up with my virtual machine that i have left running and i found nothing much so i decided to shut it down to save processes.  Oh well, finally nothing much to do i just press the "Shut Down..." menu option.  Let's get back to Fruit Ninja!

Cookie 3

Wao, if you have an iPhone and you need to do anything anywhere... it's even greater!  Do you know what i thought of... Imagine i'm on the transit while rushing to university which i left my computer on with my current project (programming some silly software again).  I can simply remotely connect to it with TeamViewer and continue debug or turn it off otherwise.  This is one of the most exciting feature i could think off: programming remotely!!

Jailbreak on latest iPod successful.

Posted by genesisdatabase on Sunday, 24 October 2010 , under , , , , , , | comments (0)



First time playing with apple product as well as first time cracking it via simple guidelines

Limera1n

Well, enjoy if you ever used this guide =) For the time being i'll enjoy my iPod!

Inadvertently moved my mounted image to trash

Posted by genesisdatabase on Saturday, 16 October 2010 , under , , , , , , | comments (0)



What a stupid mistake i made... i accidentally moved my mounted image from my virtualbox to the trash without releasing it first.. i thought of creating a new name and a fake file so that i could release it this way but it appears that the virtualbox does not allow me to do so.

Searching around a few minute on the internet gave me the answer here - http://forums.virtualbox.org/viewtopic.php?f=8&t=26338 Luckily i found the solution (although it isn't something big i found out it's disturbing to have something you don't like to appear so i had to get rid of it).
All in a days work... now i have to continue figuring out how to execute Warcraft III under VirtualBox as well as allowing USB to work in it. (sort of just moved from virtualbox-ose)

Reading and Writing registry in Windows using WinAPI




For those that are interested in contacting the windows registry via C, here's a list of WinAPI functions that you need to know.

Simple phonebook application in C

Posted by genesisdatabase on Monday, 11 October 2010 , under , | comments (0)



There was a small phonebook code challenge to build the shortest at LeetCoders. Here's a little of what i did for fun. Functions include add contact, remove contact, search contact and display contacts.

[code]
#include <stdio.h>

#define PHONEBOOK_SIZE 512
#define FLUSH fflush(stdin); // fpurge(stdin) for linux

typedef struct
{
char name[32 + 1];
char mobile[32 + 1];
}PHONEBOOK, *PPHONEBOOK;

void AddContact(PHONEBOOK *);
void RemoveContact(PHONEBOOK *);
void SearchContact(PHONEBOOK *);
void DisplayContact(PHONEBOOK *);

short selection;
short size;

int main(int argc, char **argv)
{
PHONEBOOK pb[PHONEBOOK_SIZE];

selection = 0;
size = 0;

for( ; ; )
{
printf("1 - Add contact\n"
"2 - Remove contact\n"
"3 - Search contact\n"
"4 - Display all contacts\n"
"0 - Exit\n\n"
"Select an option: ");

FLUSH;
scanf("%d", &selection);

switch(selection)
{
case 1:
AddContact(&pb);
break;
case 2:
RemoveContact(&pb);
break;
case 3:
SearchContact(&pb);
break;
case 4:
DisplayContact(&pb);
break;
case 0:
printf("Thanks for using...\n");
return 0;
default:
printf("Invalid option selected...\n");
break;
}

printf("\n");
}
return 0;
}

void AddContact(PHONEBOOK *pb)
{
for( ; ; )
{
printf("Enter name: ");
FLUSH;
scanf("%32[^\n]", pb[size].name);

printf("Enter mobile number: ");
FLUSH;
scanf("%32[^\n]", pb[size].mobile);

printf("Confirm (Y - yes | N - no | B - back): ");
FLUSH;
scanf("%c", &selection);

switch(selection)
{
case 'y':
case 'Y':
size++;
printf("Added contact...\n");
return;
case 'n':
case 'N':
memset(pb[size].name, 0, 32 + 1);
memset(pb[size].mobile, 0, 32 + 1);
break;
case 'b':
case 'B':
memset(pb[size].name, 0, 32 + 1);
memset(pb[size].mobile, 0, 32 + 1);
printf("No contact added...\n");
return;
default:
printf("Invalid option selected... default to N\n");
break;
}

printf("\n");
}
}

void RemoveContact(PHONEBOOK *pb)
{
char name[32 + 1];
int i, j;

for( ; ; )
{
printf("Enter name (BK - back): ");
FLUSH;
scanf("%32[^\n]", name);

if((name[0] == 'b' || name[0] == 'B') && (name[1] == 'k' || name[1] == 'K') && name[2] == '\0')
return;

for(i = 0 ; i < size ; i++)
{
if(strstr(strlwr(pb[i].name), strlwr(name)) != 0)
{
printf("ID : %d\n", i+1);
printf("Name : %s\n", pb[i].name);
printf("Mobile: %s\n", pb[i].mobile);
printf("\n");

printf("Remove contact (Y - yes | N - no | B - back):");
FLUSH;
scanf("%c", &selection);

switch(selection)
{
case 'y':
case 'Y':
printf("Removing contact: %s\n", pb[i].name);
for(j = i ; j < size ; j++)
{
strcpy(pb[j].name, pb[j+1].name);
strcpy(pb[j].mobile, pb[j+1].mobile);
}
memset(pb[size].name, 0, 32 + 1);
memset(pb[size].mobile, 0, 32 + 1);
size--;
i--;
printf("Contact removed...\n");
break;
case 'n':
case 'N':
break;
case 'b':
case 'B':
return;
default:
printf("Invalid option selected... default to N\n");
break;
}
}
}
printf("\n");
}
printf("\n");
}

void SearchContact(PHONEBOOK *pb)
{
char name[32 + 1];
int i;

for( ; ; )
{
printf("Enter name (BK - back): ");
FLUSH;
scanf("%32[^\n]", name);

if((name[0] == 'b' || name[0] == 'B') && (name[1] == 'k' || name[1] == 'K') && name[2] == '\0')
return;

for(i = 0 ; i < size ; i++)
{
if(strstr(strlwr(pb[i].name), strlwr(name)) != 0)
{
printf("ID : %d\n", i+1);
printf("Name : %s\n", pb[i].name);
printf("Mobile: %s\n", pb[i].mobile);
printf("\n");
}
}

printf("\n");
}
}

void DisplayContact(PHONEBOOK *pb)
{
int i;

for(i = 0 ; i < size ; i++)
{
printf("ID : %d\n", i+1);
printf("Name : %s\n", pb[i].name);
printf("Mobile: %s\n", pb[i].mobile);
printf("\n");
}
}
[/code]

MuteX | How to create a single instance application in C

Posted by genesisdatabase on Sunday, 10 October 2010 , under , , , , , , , , , , , | comments (0)



[code]
#include <windows.h>
#include <stdio.h>

#define MUTEX_NAME "mutex name here, anyname"
int main()
{
HANDLE hMutex = OpenMutex(MUTEX_ALL_ACCESS, FALSE, MUTEX_NAME);
if(hMutex == NULL)
{
// no duplicate instances found
hMutex = CreateMutex(NULL, FALSE, MUTEX_NAME);
}
else
{
// a duplicate was found
return 0;
}

printf("Created console\n");
getchar();
return 1;
}
[/code]

As you can see, there's OpenMuteX and CreateMuteX function that has been used.  To briefly explain this, OpenMuteX opens a handle to check whether a mutex has been created.  If it returns the value NULL, it means that no mutex of the current string has been created.  So when it is NULL, CreateMuteX is called to create the mutex with the string MUTEX_NAME that has been defined.  Leave a feedback if you feel that there's lack of information.

Black Hole | Create pixel on the desktop and expand




[code]
#include <windows.h>

int WINAPI WinMain(HINSTANCE hThisInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
HDC hDC = CreateDC(TEXT("DISPLAY"), NULL, NULL, NULL);
POINT pCurPos;
RECT rRect;
HBRUSH hBrush = (HBRUSH)(CreateSolidBrush(RGB(0, 0, 0)));
int iConst = 1;

for( ; ; Sleep(1000))
{
if (GetAsyncKeyState(VK_ESCAPE) != 0)
break;

iConst += 3;
GetCursorPos(&pCurPos);
rRect.left = pCurPos.x - iConst;
rRect.top = pCurPos.y - iConst;
rRect.right = pCurPos.x + iConst;
rRect.bottom = pCurPos.y + iConst;
FillRect(hDC, &rRect, hBrush);
}

DeleteDC(hDC);
return EXIT_SUCCESS;
}
[/code]

I'm not sure where i got this a year ago but generally this code create a black pixel on your desktop. It will terminate only if you press ESCAPE which is detected by GetAsyncKeyState.

Caesar and Rot Cipher Source Code

Posted by genesisdatabase on Sunday, 19 September 2010 , under , , , , , , , , , , , , , , , | comments (0)



Ever wanted a portable caesar cipher and decipher at one go? At the end of this post you will find the binary as well as the source code (built in C) for the application. Below is an image of the application testing on "abcdefgh" text.  At [+13] you can see that it is equivalent to ROT13 cipher.  For those that are familiar with command line, use application.exe "text here".



[code]
/*
* url: http://genesisdatabase.wordpress.com
* email: genesisdatabase@gmail.com
*
* This source code is free to be used by any programmers
* Source code converts all uppercase to lowercase during decryption
* Supports command line usage, use text as argument eg. crack.exe "abcdef"
*/

#include <stdio.h>
#include <string.h>
//#include <stdlib.h> /*include if using system()*/

void DecryptCaesar(char *Encrypted)
{
char i;
int j;

Encrypted = strlwr(Encrypted); /*supports only lowercase*/
//system("REM"); /*use this to copy paste in windows*/

printf(" Caesar Cipher\n\n");
for(i = 0 ; i < 27 ; i++)
{
printf(" [+%d]\t", i);
for(j = 0 ; j < (signed)strlen(Encrypted) ; j++)
{
if(Encrypted[j] == ' ')
printf(""); /*replace "" with " " if you prefer to preserve spacing*/
else if(Encrypted[j] < 'a' || Encrypted[j] > 'z')
printf("%c", Encrypted[j]); /*preserved non-alphabets*/
else if(Encrypted[j] + i > 'z')
printf("%c", Encrypted[j] + i - 26);
else
printf("%c", Encrypted[j] + i);
}

if(i == 13)
printf(" (ROT)");

printf("\n");
if(i == 25)
{
printf(" ");
for(j = 0 ; j < (signed)strlen(Encrypted) + 8 ; j++)
printf("-");

printf("\n");
}

}
printf("\n");
}
int main(int argc, char **argv)
{
char string[64 +1] = {'\0'};

if(argc == 2)
{
strncpy(string, argv[1], 64);
printf("\n");
DecryptCaesar(string);
return 0;
}

for( ; ; )
{
printf("\n Enter a text to encrypt/decrypt (EXIT to quit): ");

fflush(stdin); /*windows*/
//fpurge(stdin); /*linux*/

scanf("%64[^\n]", string);

if(string[0] == 'E' && string[1] == 'X' && string[2] == 'I' && string[3] == 'T' && string[4] == '\0')
break;

printf("\n\n");
DecryptCaesar(string);
}

printf("\n Thanks for using...\n");
return 0;
}
[/code]

Download Binary
Download Source Code

Simple Caesar and Rot Cipher

Posted by genesisdatabase on , under | comments (0)



[code]
/*
* url: http://genesisdatabase.wordpress.com
* email: genesisdatabase@gmail.com
*
* This source code is free to be used by any programmers
* Source code converts all uppercase to lowercase during decryption
* Supports command line usage, use text as argument eg. crack.exe &quot;abcdef&quot;
*/

#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
//#include &lt;stdlib.h&gt; /*include if using system()*/

void DecryptCaesar(char *Encrypted)
{
char i;
int j;

Encrypted = strlwr(Encrypted); /*supports only lowercase*/
//system(&quot;REM&quot;); /*use this to copy paste in windows*/


printf(&quot; Caesar Ciphernn&quot;);
for(i = 0 ; i &lt; 27 ; i++)
{
printf(&quot; [+%d]t&quot;, i);
for(j = 0 ; j &lt; (signed)strlen(Encrypted) ; j++)
{
if(Encrypted[j] == ' ')
printf(&quot;&quot;); /*replace &quot;&quot; with &quot; &quot; if you prefer to preserve spacing*/
else if(Encrypted[j] &lt; 'a' || Encrypted[j] &gt; 'z')
printf(&quot;%c&quot;, Encrypted[j]); /*preserved non-alphabets*/
else if(Encrypted[j] + i &gt; 'z')
printf(&quot;%c&quot;, Encrypted[j] + i - 26);
else
printf(&quot;%c&quot;, Encrypted[j] + i);
}

if(i == 13)
printf(&quot; (ROT)&quot;);

printf(&quot;n&quot;);
if(i == 25)
{
printf(&quot; &quot;);
for(j = 0 ; j &lt; (signed)strlen(Encrypted) + 8 ; j++)
printf(&quot;-&quot;);

printf(&quot;n&quot;);
}

}
printf(&quot;n&quot;);
}
int main(int argc, char **argv)
{
char string[64 +1] = {'\0'};

if(argc == 2)
{
strncpy(string, argv[1], 64);
printf(&quot;n&quot;);
DecryptCaesar(string);
return 0;
}

for( ; ; )
{
printf(&quot;n Enter a text to encrypt/decrypt (EXIT to quit): &quot;);

fflush(stdin); /*windows*/
//fpurge(stdin); /*linux*/

scanf(&quot;%64[^n]&quot;, string);

if(string[0] == 'E' &amp;&amp; string[1] == 'X' &amp;&amp; string[2] == 'I' &amp;&amp; string[3] == 'T' &amp;&amp; string[4] == '\0')
break;


printf(&quot;nn&quot;);
DecryptCaesar(string);
}

printf(&quot;n Thanks for using...n&quot;);
return 0;
}
[/code]