Sunday, April 20, 2008

PropertySnake - the source of reduced house prices across the UK

PropertySnake - lists house price history and percentage price drops (unfortunately doesn't all list estate agent information)

Related:
NetHousePrices - lists all transacted house prices in each region and post code

Monday, April 14, 2008

Some cool Windows hacks

1. Tron - kernel driver DLL hider

2. Locreate - executable unpacking with dynamic loader

Locreate: An Anagram for Relocate

Locreate is actually using the documented behaviour of the dynamic loader of the executable to perform the unpacking operation.

The dynamic loader feature that is abused to achieve this is the relocation feature.

Essentially the binary on-disk is modified so that when loaded into memory and relocated, it will be the original. To do this:
1) Must be an exe and set /fixed:no during compilation.
2) Must set preferred base address to an invalid address (0x80000000 on 32 bit without /3GB, or SharedUserData which is always 0x7ffe0000).
3) Expected base address is 0x10000 on Windows because this is an executable so is the first to be loaded into the address space.
4) Go through the original binary code, and for some locations subtract the difference above, and add a relocation fixup descriptor. More complicated methods can generate multiple fixup descriptors per address, or even work on individual bytes in the 4-byte aligned block, or even use fixups on other later fixup descriptors.

Monday, April 07, 2008

The KBW European bank analysis spreadsheet

FT article
Spreadsheet here