<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Casaba Security &#187; Reverse Engineering</title>
	<atom:link href="http://www.casabasecurity.com/blog/category/reverse-engineering/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.casabasecurity.com/blog</link>
	<description>Building and breaking software and robots</description>
	<lastBuildDate>Tue, 31 Aug 2010 18:27:09 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 3)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 18:04:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Nebulous]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=188</guid>
		<description><![CDATA[Renaming parts of the assembly. So I promised this last week, but I&#8217;ve been busy on a new project. Below is some code that shows renaming of methods. This is a solution to renaming classes within namespaces. It iterates over each namespace renaming classes from class1 -&#62; classN. This is more useful for human readability [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 2)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/#comments</comments>
		<pubDate>Thu, 04 Feb 2010 23:53:14 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscated]]></category>
		<category><![CDATA[Microsoft CCI]]></category>
		<category><![CDATA[Reversing]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=171</guid>
		<description><![CDATA[So yesterday I talked a about using CCI to remove attributes from .Net binaries. Specifically the SupressIldasm attribute. I promised I&#8217;d put up some more code highlighting the framework&#8217;s benefits. So some more detail on the binary I&#8217;m working with. It has been ran through Babel -&#62; Netz -&#62; Babel again. My goals have been [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries.</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/#comments</comments>
		<pubDate>Wed, 03 Feb 2010 20:01:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=152</guid>
		<description><![CDATA[We had an issue recently crop up with an obfuscated .Net binary. I’ve been meaning to spend more time reversing .Net protected binaries so I start looking in it. Unfortunately everything I was reading on the forums and internet seemed difficult. Having recently read a little about Microsoft’s CCI framework, I thought this might be [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
	</channel>
</rss>
