<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>AdvanceVB</title>
	<atom:link href="http://www.advancevb.com.ar/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://www.advancevb.com.ar</link>
	<description>It&#039;s even worse than it appears.</description>
	<lastBuildDate>Fri, 03 Sep 2010 16:35:39 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>SystemProcessesAndThreadsInformation</title>
		<link>http://www.advancevb.com.ar/?p=589</link>
		<comments>http://www.advancevb.com.ar/?p=589#comments</comments>
		<pubDate>Fri, 03 Sep 2010 16:35:39 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[NTDLL]]></category>
		<category><![CDATA[NtQuerySystemInformation]]></category>
		<category><![CDATA[SystemProcessesAndThreadsInformation]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=589</guid>
		<description><![CDATA['--------------------------------------------------------------------------------------- ' Module : mProcessInformation ' Author : Karcrack ' Now : 26/08/2010 15:00 ' Purpose : Native Process Enumeration ' History : 26/08/2010 First cut ......................................................... '--------------------------------------------------------------------------------------- Option Explicit Option Base 0 Public Type PROCESS sName As String lPID As Long End Type 'NTDLL Private Declare Function NtQuerySystemInformation Lib &#34;NTDLL&#34; (ByVal SystemInformationClass As Long, [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=589</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Upgrading the blog (opinions)</title>
		<link>http://www.advancevb.com.ar/?p=586</link>
		<comments>http://www.advancevb.com.ar/?p=586#comments</comments>
		<pubDate>Thu, 26 Aug 2010 02:01:29 +0000</pubDate>
		<dc:creator>Cobein</dc:creator>
				<category><![CDATA[News]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=586</guid>
		<description><![CDATA[Last month I purchased a better host (the one I have right now is provided for free for a friend) so I was thinking on expand the blog to something better, maybe adding some other sections (ASM, C++ and so on) Im not planning to cover everything but I myself use some C++ and ASM [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=586</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Moving Out (Random Stuff)</title>
		<link>http://www.advancevb.com.ar/?p=583</link>
		<comments>http://www.advancevb.com.ar/?p=583#comments</comments>
		<pubDate>Thu, 26 Aug 2010 01:04:07 +0000</pubDate>
		<dc:creator>Cobein</dc:creator>
				<category><![CDATA[Random]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=583</guid>
		<description><![CDATA[Folks I&#8217;m in the process of moving out, I already drove from Miami to California (about 44 hs) and I still have to fly back to Argentina so I&#8217;m not gonna be really active for the next couple weeks at least. meanwhile Karcrak has been releasing some amazing stuff and I know he have a [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=583</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>mZombieInvoke &#8211; Native VB6 Invoke :)</title>
		<link>http://www.advancevb.com.ar/?p=567</link>
		<comments>http://www.advancevb.com.ar/?p=567#comments</comments>
		<pubDate>Mon, 09 Aug 2010 11:50:27 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[callapibyname]]></category>
		<category><![CDATA[DllFunctionCall]]></category>
		<category><![CDATA[GetProcAddress]]></category>
		<category><![CDATA[inline asm]]></category>
		<category><![CDATA[loadlibrary]]></category>
		<category><![CDATA[native]]></category>
		<category><![CDATA[shellcode]]></category>
		<category><![CDATA[TLB]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=567</guid>
		<description><![CDATA[This code allow you to call APIs without declaring them, but the best of it is that only uses VB6 functions!!! (aka funcs @ MSVBVM60) :) '--------------------------------------------------------------------------------------- ' Module : mZombieInvoke ' Author : Karcrack ' Now : 09/08/2010 13:37 ' Purpose : Calling API without declaring ' Only uses VB6 functions :) ' History [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=567</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>[ANTI] IsVMWare?</title>
		<link>http://www.advancevb.com.ar/?p=563</link>
		<comments>http://www.advancevb.com.ar/?p=563#comments</comments>
		<pubDate>Mon, 02 Aug 2010 11:02:56 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Antis]]></category>
		<category><![CDATA[Code]]></category>
		<category><![CDATA[anti]]></category>
		<category><![CDATA[detection]]></category>
		<category><![CDATA[inline asm]]></category>
		<category><![CDATA[virtual machine]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=563</guid>
		<description><![CDATA[Option Explicit '--------------------------------------------------------------------------------------- ' Module : mAntiVMWare ' Author : Karcrack ' Now$ : 020810 ' Used for? : Known if being Virtualized inside VMWARE ' Original C source: ' bool IsVMWare() ' { ' unsigned long _EBX; ' __try ' { ' __asm ' { ' // Run the magic code sequence ' push [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=563</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>IsUserAnAdmin replacement</title>
		<link>http://www.advancevb.com.ar/?p=559</link>
		<comments>http://www.advancevb.com.ar/?p=559#comments</comments>
		<pubDate>Fri, 30 Jul 2010 14:23:33 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Code]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=559</guid>
		<description><![CDATA['ADVAPI32 Private Declare Function CheckTokenMembership Lib &#34;ADVAPI32&#34; (ByVal TokenHandle As Long, ByVal pSidToCheck As Long, ByRef IsMember As Boolean) As Long '--------------------------------------------------------------------------------------- ' Procedure : IsUserAnAdmin ' Author : Karcrack ' Date : 300710 ' Purpose : Check wether the user is in the Administrator Group ' TestedOn : Windows XP SP3 '--------------------------------------------------------------------------------------- ' Private [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=559</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>GetProcessTimes Alternative</title>
		<link>http://www.advancevb.com.ar/?p=557</link>
		<comments>http://www.advancevb.com.ar/?p=557#comments</comments>
		<pubDate>Thu, 29 Jul 2010 10:50:50 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[NTDLL]]></category>
		<category><![CDATA[native]]></category>
		<category><![CDATA[NtQueryInformationProcess]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=557</guid>
		<description><![CDATA[Option Explicit Public Type KERNEL_USER_TIMES liCreateTime As Currency 'LARGE_INTEGER liExitTime As Currency 'LARGE_INTEGER liKernelTime As Currency 'LARGE_INTEGER liUserTime As Currency 'LARGE_INTEGER End Type 'NTDLL Private Declare Function NtQueryInformationProcess Lib &#34;NTDLL&#34; (ByVal ProcessHandle As Long, ByVal ProcessInformationClass As Long, ByVal ProcessInformation As Long, ByVal ProcessInformationLength As Long, ReturnLength As Long) As Long Private Const ProcessTimes As [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=557</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>RtlMoveMemory/vbaCopyBytes replacement</title>
		<link>http://www.advancevb.com.ar/?p=554</link>
		<comments>http://www.advancevb.com.ar/?p=554#comments</comments>
		<pubDate>Wed, 28 Jul 2010 21:34:31 +0000</pubDate>
		<dc:creator>Karcrack (online)</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[inline]]></category>
		<category><![CDATA[inline asm]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=554</guid>
		<description><![CDATA[Option Explicit Option Base 0 '--------------------------------------------------------------------------------------- ' Module : mCopyMemoryASM ' Author : Karcrack ' Date : 280710 ' Purpose : A kewl RtlMoveMemory/CopyMemory replacement using ASM :) '--------------------------------------------------------------------------------------- 'USER32 Private Declare Function CallWindowProcW Lib &#34;USER32&#34; (ByVal lpCodePointer As Long, Optional ByVal l1 As Long, Optional ByVal l2 As Long, Optional ByVal l3 As Long, [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=554</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Summer Slaughter 2010 !!!!</title>
		<link>http://www.advancevb.com.ar/?p=549</link>
		<comments>http://www.advancevb.com.ar/?p=549#comments</comments>
		<pubDate>Mon, 26 Jul 2010 01:52:21 +0000</pubDate>
		<dc:creator>Cobein</dc:creator>
				<category><![CDATA[Random]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=549</guid>
		<description><![CDATA[Im a happy mofucka!!!! Yeah some good bands in town =D]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=549</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Copy Bytes</title>
		<link>http://www.advancevb.com.ar/?p=538</link>
		<comments>http://www.advancevb.com.ar/?p=538#comments</comments>
		<pubDate>Fri, 04 Jun 2010 17:35:24 +0000</pubDate>
		<dc:creator>Cobein</dc:creator>
				<category><![CDATA[Code]]></category>
		<category><![CDATA[alternative]]></category>
		<category><![CDATA[api]]></category>
		<category><![CDATA[bytes]]></category>
		<category><![CDATA[Copy]]></category>

		<guid isPermaLink="false">http://www.advancevb.com.ar/?p=538</guid>
		<description><![CDATA[I&#8217;ve seen so many posts from ppl complaining about CopyMemory, vbaCopyBytes and so on being dettected by Avira and some other AVs but there are many more APIs to do the same. Here is a simple example, moving 4 bytes using lstrcpynW, more than enough to patch an address and do whatever we want. Private [...]]]></description>
		<wfw:commentRss>http://www.advancevb.com.ar/?feed=rss2&amp;p=538</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
	</channel>
</rss>
