Reference count or load count of the DLL is the number of times the DLL is loaded into the process. Windows APIs does not provide much information about loaded DLLs. This article explains how to find out the reference count of DLL using the undocumented APIs. Read more...

Firefox uses master password to protect the stored sign-on information for various websites. If the master password is forgotten, then there is no way to recover the master password and user has to lose all the sign-on information stored in it. To prevent this problem, I have developed FireMaster which uses combination of techniques such as dictionary, hybrid and brute force to recover the master password from the Firefox key database file. Read more...

Windows heap enumeration functions are slower and takes lot of time while traversing large number of heap blocks. This article uncovers the reason behind it and shows you a new efficient way of enumerating process heaps based on reverse engineering of Windows heap API functions. Read more...

FirePassword is the tool designed to decrypt the username and password list from Firefox sign-on database. Firefox stores the username and password information for various sites in its database files. FirePassword works on similar line as Firefox's built-in password manager but it can be used as offline tool to get the username/password information without running the Firefox. Read more...

PESpin is a Windows executable file compressor & protector. It has some of the best protection techniques including API Redirection mechanism to protect the binary against disassembling and debugging. ImpREC is the most powerful import reconstructor used against the techniques such as API Redirection. This article explains how to write API tracer plugin for ImpREC to build the import table for PESpin protected application. Read more...