<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Casaba Security &#187; John Hernandez</title>
	<atom:link href="http://www.casabasecurity.com/blog/author/john/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.casabasecurity.com/blog</link>
	<description>Building and breaking software and robots</description>
	<lastBuildDate>Tue, 31 Aug 2010 18:27:09 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 3)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 18:04:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Nebulous]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=188</guid>
		<description><![CDATA[Renaming parts of the assembly. So I promised this last week, but I&#8217;ve been busy on a new project. Below is some code that shows renaming of methods. This is a solution to renaming classes within namespaces. It iterates over each namespace renaming classes from class1 -&#62; classN. This is more useful for human readability [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 2)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/#comments</comments>
		<pubDate>Thu, 04 Feb 2010 23:53:14 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscated]]></category>
		<category><![CDATA[Microsoft CCI]]></category>
		<category><![CDATA[Reversing]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=171</guid>
		<description><![CDATA[So yesterday I talked a about using CCI to remove attributes from .Net binaries. Specifically the SupressIldasm attribute. I promised I&#8217;d put up some more code highlighting the framework&#8217;s benefits. So some more detail on the binary I&#8217;m working with. It has been ran through Babel -&#62; Netz -&#62; Babel again. My goals have been [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries.</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/#comments</comments>
		<pubDate>Wed, 03 Feb 2010 20:01:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=152</guid>
		<description><![CDATA[We had an issue recently crop up with an obfuscated .Net binary. I’ve been meaning to spend more time reversing .Net protected binaries so I start looking in it. Unfortunately everything I was reading on the forums and internet seemed difficult. Having recently read a little about Microsoft’s CCI framework, I thought this might be [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Powershell Grep</title>
		<link>http://www.casabasecurity.com/blog/2008/06/powershell-grep/</link>
		<comments>http://www.casabasecurity.com/blog/2008/06/powershell-grep/#comments</comments>
		<pubDate>Tue, 03 Jun 2008 23:23:08 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[Powershell]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[So, I spent a good couple of hours today trying to find a easy solution to the lack of Grep on windows. I&#039;ve tried using findstr but the output gave me a headache trying to parse it. So I decidied to use powershell, what a great tool by MS, once you get past the learning [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2008/06/powershell-grep/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Command and Control Structures in Malware: From Handler/Agent to P2P</title>
		<link>http://www.casabasecurity.com/blog/2007/12/command-and-control-structures-in-malware-from-handleragent-to-p2p/</link>
		<comments>http://www.casabasecurity.com/blog/2007/12/command-and-control-structures-in-malware-from-handleragent-to-p2p/#comments</comments>
		<pubDate>Sat, 15 Dec 2007 23:37:38 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[botnet]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[Good article by David Dittrich and Sven Dietrich in ;login: magazine which I was able to contribute to by doing a lot of the reverse engineering of the Nugache trojan. The main focus of the article is the evolution of bot networks. Focusing on the details of the command and control structures of various types [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2007/12/command-and-control-structures-in-malware-from-handleragent-to-p2p/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Analysis of the Storm and Nugache Trojans: P2P Is Here</title>
		<link>http://www.casabasecurity.com/blog/2007/12/analysis-of-the-storm-and-nugache-trojans-p2p-is-here/</link>
		<comments>http://www.casabasecurity.com/blog/2007/12/analysis-of-the-storm-and-nugache-trojans-p2p-is-here/#comments</comments>
		<pubDate>Sat, 15 Dec 2007 23:33:09 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[botnet]]></category>

		<guid isPermaLink="false"></guid>
		<description><![CDATA[This is an article that I worked on with Sam stover which covers some of the high level concepts that were introduced by next generation peer-to-peer bot networks. In it we dissect the some of the details of the Nugache and Storm trojans. Check it out: Analysis of the Storm and Nugache Trojans: P2P Is [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2007/12/analysis-of-the-storm-and-nugache-trojans-p2p-is-here/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
