Welcome

This Blog is for Malware Researching, Reverse Engineering and System Programming

EgitMagazine Talked about me in Cairo Security Camp 2010

Posted by AmrThabet on 4:55 PM
Hi again

Here EgitMagazine talked about Cairo Secuirty Camp 2010 and talk about me in this event

see the link here :
http://www.egitmagazine.com/2010/07/28/bluekaizens-cairo-security-camp-when-egypts-it-tsecurity-experts-meet-at-one-place/

I become a Speaker in Cairo Security Camp 2010

Posted by AmrThabet on 4:22 PM

I have been chosen to be a speaker in Cairo Security Camp 2010 at Nile University in Cairo
I talked about my Emulator in a presentation named "Pokas x86 Emulator for Generic Unpacking"
I talked all in English and that's so hard but I do good with no problem
all the videos will be available at http://bluekaizen.org/index.php?option=com_content&view=article&id=95:cairo-security-camp-poster&catid=49

the presentation is in http://sourceforge.net/projects/x86emu/files/

have a cool feel ;)

Pokas x86 PE Emulator for Generic Unpacking

Posted by AmrThabet on 7:24 PM
I want to introduce a new application named Pokas Emulator
Pokas x86 Emulator is an Application-Only emulator created for generic unpacking and testing the antivirus detection algorithms.

it emulates the PE Executable Files 32-bits versions and monitor all memory writes and include many features . some of them are:
1. Has an assembler and a disassembler from and to mnemonics.
2. Support adding new APIs and adding the emulation function to them.
3. Support a very powerful debugger that has a parser that parses the condition you give and create a very fast native code that perform the check on this condition.
4. Support seh and support tib, teb, peb and peb_ldr_data.
5. It monitors all the memory writes and log up to 10 previous Eips and saves the last accessed and the last modified place in memory.
6. it support 6 APIs:GetModuleHandleA, LoadLibrayA, GetProcAddress, VirtualAlloc, VirtualFree and VirtualProtect.
7. With all of these it's FREE and open source.

It successfully emulates:
1. UPX
2. FSG
3. MEW
4. Aspack
5. PECompact
6. Morphine

But it does contain bugs and it still in the beta version. It surely will be fixed soon ith the help of your feedback.

It still doesn't support multithreading and doesn't support Linux ELF executables.
It's still working only on windows but the Linux version will be available soon.

you can download it from https://sourceforge.net/projects/x86emu/