Pointer Sequence Reverser (PSR)
ID: f1adad46-52b7-50dc-9d2e-b65bba774d1f
STIX ID: report--f1adad46-52b7-50dc-9d2e-b65bba774d1f
Feed Name: NCC Research
Pointer Sequence Reverser (PSR) is a C++ tool that attaches to a Windows process, sets memory breakpoints, records executed instructions leading to accesses of a target memory address, analyzes those instructions to extract the sequence used to reach the data, and presents the results to the user. The report outlines PSR's high-level workflow, implementation (using Win32 debugging APIs and Capstone), comparative advantages over manual reverse engineering and pointer scanners, and provides links to the GitHub repository and a whitepaper.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
