0:00 / 0:00

Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro

Name: Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro
Uploaded: 2019-06-12T05:00:10Z
Duration: 7 min 31 s
Channel: OALabs
Description: How to disable Address Space Layout Randomization in a Windows debugging virtual machine to simplify malware analysis.

OALabs

52K subscribers • 40 videos on Hallway

YouTube

Recommended by 1 person: 1 in engineering communities.

Intermediate. Assumes working knowledge.

14K views7 years ago1 recommendation

Security Reverse engineering Exploits and vulnerabilities Debugging

How to disable Address Space Layout Randomization in a Windows debugging virtual machine to simplify malware analysis.

This tutorial covers how to disable ASLR in your debugging VM to speed up your debugging when using x64dbg and IDA Pro.We have a short blog post here: oalabs.openanalysis.net/2019/06/12/disable-aslr-for-easier-m… ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- The registry value you want to add is: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #ReverseEngineering #Debugging #ASLR #x64dbg

Why it's here

1 person recommends this

What people say. Recommended as a quick tip for making malware debugging easier by disabling ASLR.

u/herrcorein r/ReverseEngineering • 7 years agoRecommends

Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro (OALabs Quick Tip)

56View on Reddit