Month: March 2018

Debugging a 32 or 64-bit DLL with WinDbg

March 16, 2018 Josh Stroschein malware, reversing

Debugging a DLL is not quite as straight forward as an executable, since you have to use rundll32 to load it and invoke DllMain. This is a brief posting discussing how to load a 64-bit DLL and break on DllMain, the sample I am using is Dridex and can be found on VirusTotal.

Reading List

March 3, 2018 Josh Stroschein malware, reversing

Here is a list of several texts that I have found to be indispensable. Software Security The Art of Software Security Assessment (2 Volumes)Mark Dowd, John McDonald, Justin Schuh978-0-321-44442-4