render.article.log

This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) (format=pdflatex 2008.7.8)  30 JUN 2009 20:27
entering extended mode
**render.article.tex
(./render.article.tex
LaTeX2e <2003/12/01>
Babel <v3.8d> and hyphenation patterns for american, french, german, ngerman, b
ahasa, basque, bulgarian, catalan, croatian, czech, danish, dutch, esperanto, e
stonian, finnish, greek, icelandic, irish, italian, latin, magyar, norsk, polis
h, portuges, romanian, russian, serbian, slovak, slovene, spanish, swedish, tur
kish, ukrainian, nohyphenation, loaded.
(/opt/local/share/texmf-dist/tex/latex/base/article.cls
Document Class: article 2004/02/16 v1.4f Standard LaTeX document class
(/opt/local/share/texmf-dist/tex/latex/base/size10.clo
File: size10.clo 2004/02/16 v1.4f Standard LaTeX file (size option)
)
\c@part=\count79
\c@section=\count80
\c@subsection=\count81
\c@subsubsection=\count82
\c@paragraph=\count83
\c@subparagraph=\count84
\c@figure=\count85
\c@table=\count86
\abovecaptionskip=\skip41
\belowcaptionskip=\skip42
\bibindent=\dimen102
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerarticle.sty
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasercs.sty
Package: beamerbasercs 2004/10/07 (rcs-revision 1.3)
)
Package: beamerarticle 2004/10/14 (rcs-revision 1.5)

(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasemodes.sty
Package: beamerbasemodes 2004/10/07 (rcs-revision 1.20)
\beamer@tempbox=\box26
\beamer@tempcount=\count87
\c@beamerpauses=\count88

(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasedecode.sty
Package: beamerbasedecode 2004/10/07 (rcs-revision 1.16)
\beamer@slideinframe=\count89
\beamer@minimum=\count90
)
\beamer@commentbox=\box27
\beamer@modecount=\count91
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasearticle.sty
Package: beamerbasearticle 2004/10/14 (rcs-revision 1.24)

(/opt/local/share/texmf-dist/tex/latex/graphics/keyval.sty
Package: keyval 1999/03/16 v1.13 key=value parser (DPC)
\KV@toks@=\toks14
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseoptions.sty
Package: beamerbaseoptions 2004/10/07 (rcs-revision 1.6)
)
(/opt/local/share/texmf-dist/tex/latex/xcolor/xcolor.sty
Package: xcolor 2004/07/04 v2.00 LaTeX color extensions (UK)

(/opt/local/share/texmf-dist/tex/latex/graphics/color.cfg
File: color.cfg 2005/02/03 v1.3 color configuration of teTeX/TeXLive
)
Package xcolor Info: Package option `override' ignored on input line 128.
Package xcolor Info: Driver file: pdftex.def on input line 136.

(/opt/local/share/texmf-dist/tex/latex/graphics/pdftex.def
File: pdftex.def 2002/06/19 v0.03k graphics/color for pdftex
\Gread@gobject=\count92
)
Package xcolor Info: Color model `cmy' added on input line 972.
Package xcolor Info: Color model `hsb' added on input line 980.
Package xcolor Info: Color model `HTML' added on input line 1000.
Package xcolor Info: Color model `HSB' added on input line 1006.
Package xcolor Info: Color model `Gray' added on input line 1012.
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasecompatibility.sty
Package: beamerbasecompatibility 2004/11/01 (rcs-revision 1.56)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasefont.sty
Package: beamerbasefont 2004/10/07 (rcs-revision 1.11)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasemisc.sty
Package: beamerbasemisc 2004/10/07 (rcs-revision 1.19)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseoverlay.sty
Package: beamerbaseoverlay 2004/10/26 (rcs-revision 1.47)
\beamer@argscount=\count93
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasetitle.sty
Package: beamerbasetitle 2004/11/01 (rcs-revision 1.22)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasesection.sty
Package: beamerbasesection 2004/10/14 (rcs-revision 1.15)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseframe.sty
Package: beamerbaseframe 2004/11/01 (rcs-revision 1.47)
\c@framenumber=\count94
LaTeX Info: Redefining \\ on input line 682.
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseverbatim.sty
Package: beamerbaseverbatim 2004/10/13 (rcs-revision 1.2)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseframesize.sty
Package: beamerbaseframesize 2004/10/20 (rcs-revision 1.9)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseframecomponents.sty
Package: beamerbaseframecomponents 2004/11/01 (rcs-revision 1.39)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasecolor.sty
Package: beamerbasecolor 2004/10/28 (rcs-revision 1.38)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasenotes.sty
Package: beamerbasenotes 2004/10/08 (rcs-revision 1.14)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasetoc.sty
Package: beamerbasetoc 2004/10/07 (rcs-revision 1.19)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasetemplates.sty
Package: beamerbasetemplates 2004/10/07 (rcs-revision 1.50)
\beamer@sbttoks=\toks15

(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaseauxtemplates.sty
Package: beamerbaseauxtemplates 2004/10/28 (rcs-revision 1.21)
))
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbaselocalstructure.sty
Package: beamerbaselocalstructure 2004/11/01 (rcs-revision 1.50)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasenavigation.sty
Package: beamerbasenavigation 2004/11/01 (rcs-revision 1.30)
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasetheorems.sty
Package: beamerbasetheorems 2004/10/07 (rcs-revision 1.6)

(/opt/local/share/texmf-dist/tex/latex/amsmath/amsmath.sty
Package: amsmath 2000/07/18 v2.13 AMS math features
\@mathmargin=\skip43

For additional information on amsmath, use the `?' option.
(/opt/local/share/texmf-dist/tex/latex/amsmath/amstext.sty
Package: amstext 2000/06/29 v2.01

(/opt/local/share/texmf-dist/tex/latex/amsmath/amsgen.sty
File: amsgen.sty 1999/11/30 v2.0
\@emptytoks=\toks16
\ex@=\dimen103
))
(/opt/local/share/texmf-dist/tex/latex/amsmath/amsbsy.sty
Package: amsbsy 1999/11/29 v1.2d
\pmbraise@=\dimen104
)
(/opt/local/share/texmf-dist/tex/latex/amsmath/amsopn.sty
Package: amsopn 1999/12/14 v2.01 operator names
)
\inf@bad=\count95
LaTeX Info: Redefining \frac on input line 211.
\uproot@=\count96
\leftroot@=\count97
LaTeX Info: Redefining \overline on input line 307.
\classnum@=\count98
\DOTSCASE@=\count99
LaTeX Info: Redefining \ldots on input line 379.
LaTeX Info: Redefining \dots on input line 382.
LaTeX Info: Redefining \cdots on input line 467.
\Mathstrutbox@=\box28
\strutbox@=\box29
\big@size=\dimen105
LaTeX Font Info:    Redeclaring font encoding OML on input line 567.
LaTeX Font Info:    Redeclaring font encoding OMS on input line 568.
\macc@depth=\count100
\c@MaxMatrixCols=\count101
\dotsspace@=\muskip10
\c@parentequation=\count102
\dspbrk@lvl=\count103
\tag@help=\toks17
\row@=\count104
\column@=\count105
\maxfields@=\count106
\andhelp@=\toks18
\eqnshift@=\dimen106
\alignsep@=\dimen107
\tagshift@=\dimen108
\tagwidth@=\dimen109
\totwidth@=\dimen110
\lineht@=\dimen111
\@envbody=\toks19
\multlinegap=\skip44
\multlinetaggap=\skip45
\mathdisplay@stack=\toks20
LaTeX Info: Redefining \[ on input line 2666.
LaTeX Info: Redefining \] on input line 2667.
)
(/opt/local/share/texmf-dist/tex/latex/amscls/amsthm.sty
Package: amsthm 2004/08/06 v2.20
\thm@style=\toks21
\thm@bodyfont=\toks22
\thm@headfont=\toks23
\thm@notefont=\toks24
\thm@headpunct=\toks25
\thm@preskip=\skip46
\thm@postskip=\skip47
\thm@headsep=\skip48
\dth@everypar=\toks26
)
\c@theorem=\count107
)
(/opt/local/share/texmf-dist/tex/latex/beamer/beamerbasethemes.sty
Package: beamerbasethemes 2004/10/07 (rcs-revision 1.9)
)))
(./render.presentation.snm) (./header.tex
(/opt/local/share/texmf-dist/tex/latex/carlisle/colortbl.sty
Package: colortbl 2001/02/13 v0.1j Color table columns (DPC)

(/opt/local/share/texmf-dist/tex/latex/tools/array.sty
Package: array 2003/12/17 v2.4a Tabular extension package (FMi)
\col@sep=\dimen112
\extrarowheight=\dimen113
\NC@list=\toks27
\extratabsurround=\skip49
\backup@length=\skip50
)
\everycr=\toks28
\minrowclearance=\skip51
)
(/opt/local/share/texmf-dist/tex/latex/algorithm2e/algorithm2e.sty
Package: algorithm2e 2005/10/04 v3.9 algorithms environments
\c@AlgoLine=\count108

(/opt/local/share/texmf-dist/tex/latex/base/ifthen.sty
Package: ifthen 2001/05/26 v1.1c Standard LaTeX ifthen package (DPC)
)
(/opt/local/share/texmf-dist/tex/latex/tools/xspace.sty
Package: xspace 1997/10/13 v1.06 Space after command names (DPC)
)
********************************************************
Package `algorithm2e' Release 3.9 -- october 04 2005 --
- algorithm2e-announce@lirmm.fr mailing list for announcement about releases
- algorithm2e-discussion@lirmm.fr mailing list for discussion about package
subscribe by emailing sympa@lirmm.fr with 'subscribe <list> <firstname name>'
- Author: Christophe Fiorio (fiorio@lirmm.fr)
********************************************************
\skiptotal=\skip52
\skiprule=\skip53
\skiphlne=\skip54
\skiptext=\skip55
\skiplength=\skip56
\algomargin=\skip57
\skipalgocfslide=\skip58
\algowidth=\dimen114
\inoutsize=\dimen115
\inoutline=\dimen116
\algocf@inoutbox=\box30
\algocf@inputbox=\box31
\AlCapSkip=\skip59
\AlCapHSkip=\skip60
\algocf@capbox=\box32
\c@algocfline=\count109
\c@algocf=\count110
\algocf@algoframe=\box33
\algocf@algobox=\box34
) (/opt/local/share/texmf-dist/tex/latex/pgf/pgf.sty
Package: pgf 2004/10/08 ver 0.65
\pgf@objectcount=\count111

(/opt/local/share/texmf-dist/tex/latex/graphics/graphicx.sty
Package: graphicx 1999/02/16 v1.0f Enhanced LaTeX Graphics (DPC,SPQR)

(/opt/local/share/texmf-dist/tex/latex/graphics/graphics.sty
Package: graphics 2001/07/07 v1.0n Standard LaTeX Graphics (DPC,SPQR)

(/opt/local/share/texmf-dist/tex/latex/graphics/trig.sty
Package: trig 1999/03/16 v1.09 sin cos tan (DPC)
)
(/opt/local/share/texmf-dist/tex/latex/graphics/graphics.cfg
File: graphics.cfg 2005/02/03 v1.3 graphics configuration of teTeX/TeXLive
)
Package graphics Info: Driver file: pdftex.def on input line 80.
)
\Gin@req@height=\dimen117
\Gin@req@width=\dimen118
)
\pgfex=\dimen119
\pgfem=\dimen120
\pgf@linewidth=\dimen121
\pgfpic=\box35
\pgf@hbox=\box36
\pgf@tempbox=\box37
\pgf@aax=\dimen122
\pgf@aay=\dimen123
\pgf@abx=\dimen124
\pgf@aby=\dimen125
\pgf@bax=\dimen126
\pgf@bay=\dimen127
\pgf@bbx=\dimen128
\pgf@bby=\dimen129
\pgf@tempdim=\dimen130
\pgf@x=\dimen131
\pgf@y=\dimen132
\pgf@xa=\dimen133
\pgf@ya=\dimen134
\pgf@xb=\dimen135
\pgf@yb=\dimen136
\pgf@xc=\dimen137
\pgf@yc=\dimen138
\pgfobjectbox=\box38
\pgf@xx=\dimen139
\pgf@xy=\dimen140
\pgf@yx=\dimen141
\pgf@yy=\dimen142
\pgf@zx=\dimen143
\pgf@zy=\dimen144
\pgf@counta=\count112
\pgf@countb=\count113
)
(/opt/local/share/texmf-dist/tex/latex/pgf/pgfarrows.sty
Package: pgfarrows 2004/10/08 ver 0.64
)
(/opt/local/share/texmf-dist/tex/latex/pgf/pgfnodes.sty
Package: pgfnodes 2004/10/08 ver 0.64
\pgf@nodesepstart=\dimen145
\pgf@nodesepend=\dimen146
)
(/opt/local/share/texmf-dist/tex/latex/preprint/fullpage.sty
Package: fullpage 1999/02/23 1.1 (PWD)
\FP@margin=\skip61
)
(./render.article.aux (./basic_analysis/python.aux)
(./advanced_analysis/compiler_optimizations.aux))
\openout1 = `render.article.aux'.

LaTeX Font Info:    Checking defaults for OML/cmm/m/it on input line 93.
LaTeX Font Info:    ... okay on input line 93.
LaTeX Font Info:    Checking defaults for T1/cmr/m/n on input line 93.
LaTeX Font Info:    ... okay on input line 93.
LaTeX Font Info:    Checking defaults for OT1/cmr/m/n on input line 93.
LaTeX Font Info:    ... okay on input line 93.
LaTeX Font Info:    Checking defaults for OMS/cmsy/m/n on input line 93.
LaTeX Font Info:    ... okay on input line 93.
LaTeX Font Info:    Checking defaults for OMX/cmex/m/n on input line 93.
LaTeX Font Info:    ... okay on input line 93.
LaTeX Font Info:    Checking defaults for U/cmr/m/n on input line 93.
LaTeX Font Info:    ... okay on input line 93.

(/opt/local/share/texmf-dist/tex/context/base/supp-pdf.tex
(/opt/local/share/texmf-dist/tex/context/base/supp-mis.tex
loading : Context Support Macros / Miscellaneous (2004.10.26)
\protectiondepth=\count114
\scratchcounter=\count115
\scratchtoks=\toks29
\scratchdimen=\dimen147
\scratchskip=\skip62
\scratchmuskip=\muskip11
\scratchbox=\box39
\scratchread=\read1
\scratchwrite=\write3
\zeropoint=\dimen148
\onepoint=\dimen149
\onebasepoint=\dimen150
\minusone=\count116
\thousandpoint=\dimen151
\onerealpoint=\dimen152
\emptytoks=\toks30
\nextbox=\box40
\nextdepth=\dimen153
\everyline=\toks31
\!!counta=\count117
\!!countb=\count118
\recursecounter=\count119
)
loading : Context Support Macros / PDF (2004.03.26)
\nofMPsegments=\count120
\nofMParguments=\count121
\MPscratchCnt=\count122
\MPscratchDim=\dimen154
\MPnumerator=\count123
\everyMPtoPDFconversion=\toks32
)
\rownum=\count124
 (./render.article.toc [1

{/opt/local/share/texmf-var/fonts/map/pdftex/updmap/pdftex.map}] [2])
\tf@toc=\write4
\openout4 = `render.article.toc'.

 (./render.article.toc)
\tf@toc=\write5
\openout5 = `render.article.toc'.

 (./render.article.toc)
\tf@toc=\write6
\openout6 = `render.article.toc'.


(./render.article.toc)
\tf@toc=\write7
\openout7 = `render.article.toc'.

 (./background/00-index.tex
(./background/introduction.tex
LaTeX Font Info:    Try loading font information for OMS+cmr on input line 6.

(/opt/local/share/texmf-dist/tex/latex/base/omscmr.fd
File: omscmr.fd 1999/05/25 v2.5h Standard LaTeX font definitions
)
LaTeX Font Info:    Font shape `OMS/cmr/m/n' in size <10> not available
(Font)              Font shape `OMS/cmsy/m/n' tried instead on input line 6.
 [3] [4] [5] [6])
(./background/vms_and_live_analysis.tex [7]
<images/vms_and_live_analysis/corerestore.png, id=39, 273.02pt x 165.61874pt>
File: images/vms_and_live_analysis/corerestore.png Graphic file (type png)

<use images/vms_and_live_analysis/corerestore.png> [8 <./images/vms_and_live_an
alysis/corerestore.png>] [9]
<images/vms_and_live_analysis/regmon.png, id=46, 902.37125pt x 473.77pt>
File: images/vms_and_live_analysis/regmon.png Graphic file (type png)

<use images/vms_and_live_analysis/regmon.png>
<images/vms_and_live_analysis/filemon.png, id=47, 834.11626pt x 469.755pt>
File: images/vms_and_live_analysis/filemon.png Graphic file (type png)

<use images/vms_and_live_analysis/filemon.png>
<images/vms_and_live_analysis/tcpview.png, id=48, 610.28pt x 526.96875pt>
File: images/vms_and_live_analysis/tcpview.png Graphic file (type png)

<use images/vms_and_live_analysis/tcpview.png> [10 <./images/vms_and_live_analy
sis/regmon.png> <./images/vms_and_live_analysis/filemon.png>]
<images/vms_and_live_analysis/process_explorer.png, id=52, 879.285pt x 587.1937
6pt>
File: images/vms_and_live_analysis/process_explorer.png Graphic file (type png)

 <use images/vms_and_live_analysis/process_explorer.png>
<images/vms_and_live_analysis/inctrl.png, id=53, 343.80873pt x 322.05757pt>
File: images/vms_and_live_analysis/inctrl.png Graphic file (type png)

<use images/vms_and_live_analysis/inctrl.png> [11 <./images/vms_and_live_analys
is/tcpview.png> <./images/vms_and_live_analysis/process_explorer.png>]
<images/vms_and_live_analysis/ethereal.png, id=57, 652.4375pt x 556.0775pt>
File: images/vms_and_live_analysis/ethereal.png Graphic file (type png)

<use images/vms_and_live_analysis/ethereal.png> [12 <./images/vms_and_live_anal
ysis/inctrl.png> <./images/vms_and_live_analysis/ethereal.png>])
(./background/architecture_and_os.tex [13] [14] [15] [16 <./images/architecture
_and_os/memory_layout.pdf>]) (./background/pe_file_format.tex
<images/pe_format/PE_Format.pdf, id=310, 2134.97626pt x 1590.94376pt>
File: images/pe_format/PE_Format.pdf Graphic file (type pdf)

<use images/pe_format/PE_Format.pdf>
Missing character: There is no Ò in font cmti10!
Missing character: There is no Ó in font cmti10!
 [17 <./images/pe_format/PE_Format.pdf>]
<images/pe_format/PE-DOS_Header.pdf, id=714, 345.29pt x 421.575pt>
File: images/pe_format/PE-DOS_Header.pdf Graphic file (type pdf)

<use images/pe_format/PE-DOS_Header.pdf> [18 <./images/pe_format/PE-DOS_Header.
pdf> <./images/pe_format/PE-FILE_Header.pdf>] [19 <./images/pe_format/PE-OPTION
AL_Header.pdf>] [20 <./images/pe_format/PE-SECTION_Header.pdf>] [21 <./images/p
e_file_inspection/slide_01.pdf> <./images/pe_file_inspection/slide_01A.pdf>]
[22 <./images/pe_file_inspection/slide_02.pdf> <./images/pe_file_inspection/sli
de_03.pdf>] [23 <./images/pe_file_inspection/slide_03A.pdf> <./images/pe_file_i
nspection/slide_04.pdf>] [24 <./images/pe_file_inspection/slide_05.pdf> <./imag
es/pe_file_inspection/slide_06.pdf>] [25 <./images/pe_file_inspection/slide_07.
pdf> <./images/pe_file_inspection/slide_08.pdf>]
<images/pe_format/PE-Imports.pdf, id=1518, 716.37767pt x 419.7098pt>
File: images/pe_format/PE-Imports.pdf Graphic file (type pdf)

<use images/pe_format/PE-Imports.pdf> [26 <./images/pe_file_inspection/slide_09
.pdf> <./images/pe_file_inspection/slide_10.pdf>]
<images/pe_format/PE-Image_Import_Descriptor.pdf, id=1779, 377.41pt x 238.8925p
t>
File: images/pe_format/PE-Image_Import_Descriptor.pdf Graphic file (type pdf)
 <use images/pe_format/PE-Image_Import_Descriptor.pdf> [27 <./images/pe_format/
PE-Imports.pdf> <./images/pe_format/PE-Image_Import_Descriptor.pdf>]
<images/pe_format/PE-Image_Thunk_Data.pdf, id=1857, 303.1325pt x 197.73875pt>
File: images/pe_format/PE-Image_Thunk_Data.pdf Graphic file (type pdf)

<use images/pe_format/PE-Image_Thunk_Data.pdf> [28 <./images/pe_format/PE-Image
_Thunk_Data.pdf>]
<images/pe_format/PE-Exports.pdf, id=1890, 615.29875pt x 308.15125pt>
File: images/pe_format/PE-Exports.pdf Graphic file (type pdf)

<use images/pe_format/PE-Exports.pdf> [29 <./images/pe_format/PE-Exports.pdf>]
[30]
Missing character: There is no Ð in font cmbx10!
Missing character: There is no Ð in font cmr10!
)) (./basic_analysis/00-index.tex
(./basic_analysis/overview_of_analysis_tools.tex [31] [32] [33] [34]
\openout2 = `basic_analysis/python.aux'.


(./basic_analysis/python.tex [35

]) [36]) (./basic_analysis/disassembly.tex
[37

] [38] [39]
<images/disassembly/return_value.png, id=1998, 202.7575pt x 110.4125pt>
File: images/disassembly/return_value.png Graphic file (type png)

<use images/disassembly/return_value.png> [40 <./images/disassembly/return_valu
e.png>] [41] [42] [43] [44]) (./basic_analysis/ida_pro.tex [45]
<images/ida/cfg_call_graph.png, id=2021, 529.98pt x 248.93pt>
File: images/ida/cfg_call_graph.png Graphic file (type png)

<use images/ida/cfg_call_graph.png> [46]
<images/ida/cfg_deadlisting.png, id=2025, 241.90375pt x 243.91125pt>
File: images/ida/cfg_deadlisting.png Graphic file (type png)

<use images/ida/cfg_deadlisting.png>
<images/ida/cfg_graph.png, id=2026, 285.065pt x 462.72874pt>
File: images/ida/cfg_graph.png Graphic file (type png)

<use images/ida/cfg_graph.png>
<images/ida/disasm_view.png, id=2027, 409.53pt x 212.9556pt>
File: images/ida/disasm_view.png Graphic file (type png)

<use images/ida/disasm_view.png> [47 <./images/ida/cfg_call_graph.png> <./image
s/ida/cfg_deadlisting.png> <./images/ida/cfg_graph.png>]
<images/ida/navigator_band.png, id=2031, 614.7768pt x 89.6148pt>
File: images/ida/navigator_band.png Graphic file (type png)

<use images/ida/navigator_band.png>
<images/ida/messages_window.png, id=2032, 547.77374pt x 165.07124pt>
File: images/ida/messages_window.png Graphic file (type png)

<use images/ida/messages_window.png>
<images/ida/hex_view.png, id=2033, 523.9575pt x 197.38258pt>
File: images/ida/hex_view.png Graphic file (type png)

<use images/ida/hex_view.png> [48 <./images/ida/disasm_view.png> <./images/ida/
navigator_band.png> <./images/ida/messages_window.png>]
<images/ida/function_list.png, id=2037, 476.47035pt x 189.30902pt>
File: images/ida/function_list.png Graphic file (type png)

<use images/ida/function_list.png>
<images/ida/names_list.png, id=2038, 343.5234pt x 131.92912pt>
File: images/ida/names_list.png Graphic file (type png)

<use images/ida/names_list.png>
<images/ida/imports_list.png, id=2039, 290.27455pt x 337.87769pt>
File: images/ida/imports_list.png Graphic file (type png)

<use images/ida/imports_list.png> [49 <./images/ida/hex_view.png> <./images/ida
/function_list.png> <./images/ida/names_list.png>]
<images/ida/strings_list.png, id=2044, 301.125pt x 117.0774pt>
File: images/ida/strings_list.png Graphic file (type png)

<use images/ida/strings_list.png>
<images/ida/notepad.png, id=2045, 592.9425pt x 195.4575pt>
File: images/ida/notepad.png Graphic file (type png)

<use images/ida/notepad.png> [50 <./images/ida/imports_list.png> <./images/ida/
strings_list.png> <./images/ida/notepad.png>]
<images/ida/renaming_variables.png, id=2049, 670.505pt x 322.20375pt>
File: images/ida/renaming_variables.png Graphic file (type png)

<use images/ida/renaming_variables.png> [51 <./images/ida/renaming_variables.pn
g>] [52]) (./basic_analysis/ollydbg.tex [53]
<images/olly/cpu.png, id=2059, 331.4784pt x 185.0112pt>
File: images/olly/cpu.png Graphic file (type png)

<use images/olly/cpu.png>
<images/olly/cpu_registers.png, id=2060, 302.29065pt x 337.80135pt>
File: images/olly/cpu_registers.png Graphic file (type png)

<use images/olly/cpu_registers.png> [54 <./images/olly/cpu.png>]
<images/olly/cpu_stack.png, id=2064, 301.31927pt x 187.902pt>
File: images/olly/cpu_stack.png Graphic file (type png)

<use images/olly/cpu_stack.png>
<images/olly/cpu_dump.png, id=2065, 301.54034pt x 160.54265pt>
File: images/olly/cpu_dump.png Graphic file (type png)

<use images/olly/cpu_dump.png> [55 <./images/olly/cpu_registers.png> <./images/
olly/cpu_stack.png>] <images/olly/log.png, id=2070, 590.205pt x 153.44283pt>
File: images/olly/log.png Graphic file (type png)

<use images/olly/log.png>
<images/olly/call_stack.png, id=2071, 680.5425pt x 98.94107pt>
File: images/olly/call_stack.png Graphic file (type png)

<use images/olly/call_stack.png>
<images/olly/threads.png, id=2072, 620.57935pt x 91.90858pt>
File: images/olly/threads.png Graphic file (type png)

<use images/olly/threads.png> [56 <./images/olly/cpu_dump.png> <./images/olly/l
og.png> <./images/olly/call_stack.png>]
<images/olly/executable_modules.png, id=2076, 614.68355pt x 163.19032pt>
File: images/olly/executable_modules.png Graphic file (type png)

<use images/olly/executable_modules.png>
Missing character: There is no “ in font cmr10!
Missing character: There is no ” in font cmr10!

<images/olly/memory_map.png, id=2077, 301.125pt x 161.8848pt>
File: images/olly/memory_map.png Graphic file (type png)

<use images/olly/memory_map.png>
<images/olly/breakpoints.png, id=2078, 578.16pt x 95.65147pt>
File: images/olly/breakpoints.png Graphic file (type png)

<use images/olly/breakpoints.png> [57 <./images/olly/threads.png> <./images/oll
y/executable_modules.png> <./images/olly/memory_map.png>]
<images/olly/bookmarks.png, id=2082, 608.64891pt x 110.66344pt>
File: images/olly/bookmarks.png Graphic file (type png)

<use images/olly/bookmarks.png>
<images/olly/seh_chain.png, id=2083, 246.9225pt x 203.19391pt>
File: images/olly/seh_chain.png Graphic file (type png)

<use images/olly/seh_chain.png>
<images/olly/watch_expressions.png, id=2084, 248.93pt x 276.5113pt>
File: images/olly/watch_expressions.png Graphic file (type png)

<use images/olly/watch_expressions.png> [58 <./images/olly/breakpoints.png> <./
images/olly/bookmarks.png> <./images/olly/seh_chain.png>]
<images/olly/handles.png, id=2088, 572.47585pt x 178.64494pt>
File: images/olly/handles.png Graphic file (type png)

<use images/olly/handles.png> [59 <./images/olly/watch_expressions.png> <./imag
es/olly/handles.png>]
<images/olly/follow_expression.png, id=2092, 761.84625pt x 285.065pt>
File: images/olly/follow_expression.png Graphic file (type png)

<use images/olly/follow_expression.png>
<images/olly/set_breakpoint.png, id=2093, 384.43625pt x 204.765pt>
File: images/olly/set_breakpoint.png Graphic file (type png)

<use images/olly/set_breakpoint.png>
<images/olly/hardware_breakpoints.png, id=2094, 463.7325pt x 241.90375pt>
File: images/olly/hardware_breakpoints.png Graphic file (type png)

<use images/olly/hardware_breakpoints.png> [60 <./images/olly/follow_expression
.png> <./images/olly/set_breakpoint.png> <./images/olly/hardware_breakpoints.pn
g>] <images/olly/enumerate_functions.png, id=2098, 612.2875pt x 275.0275pt>
File: images/olly/enumerate_functions.png Graphic file (type png)

<use images/olly/enumerate_functions.png>
<images/olly/search.png, id=2099, 284.06125pt x 335.2525pt>
File: images/olly/search.png Graphic file (type png)

<use images/olly/search.png> [61 <./images/olly/enumerate_functions.png>]))
(./advanced_analysis/00-index.tex (./advanced_analysis/executable_packing.tex
[62 <./images/olly/search.png>]
<images/executable_packing/the_target_application.png, id=2107, 536.55pt x 110.
595pt>
File: images/executable_packing/the_target_application.png Graphic file (type p
ng)
 <use images/executable_packing/the_target_application.png>
<images/executable_packing/abusing_slack_space.png, id=2108, 484.81125pt x 226.
8475pt>
File: images/executable_packing/abusing_slack_space.png Graphic file (type png)

 <use images/executable_packing/abusing_slack_space.png> [63 <./images/executab
le_packing/the_target_application.png> <./images/executable_packing/abusing_sla
ck_space.png>]
Missing character: There is no – in font cmtt8!
Missing character: There is no “ in font cmr10!
Missing character: There is no ” in font cmr10!
 [64]
Missing character: There is no “ in font cmr10!
Missing character: There is no ” in font cmr10!
 [65]
<images/executable_packing/peid.png, id=2118, 368.87813pt x 218.31563pt>
File: images/executable_packing/peid.png Graphic file (type png)

<use images/executable_packing/peid.png> [66 <./images/executable_packing/peid.
png>]
<images/executable_packing/ollydump.png, id=2122, 319.45435pt x 236.18674pt>
File: images/executable_packing/ollydump.png Graphic file (type png)

<use images/executable_packing/ollydump.png> [67 <./images/executable_packing/o
llydump.png>]
<images/executable_packing/importrec.png, id=2127, 331.4784pt x 248.127pt>
File: images/executable_packing/importrec.png Graphic file (type png)

<use images/executable_packing/importrec.png>
<images/executable_packing/x86-emu.png, id=2128, 319.63712pt x 177.03725pt>
File: images/executable_packing/x86-emu.png Graphic file (type png)

<use images/executable_packing/x86-emu.png> [68 <./images/executable_packing/im
portrec.png> <./images/executable_packing/x86-emu.png>] [69] [70 <./images/exec
utable_packing/packer_stats_pie_chart.png> <./images/executable_packing/packer_
stats_bar_chart.png>] [71 <./images/unpacking_traces/UPX-1.95.jpg>] [72 <./imag
es/unpacking_traces/ASPack_2.12.jpg>] [73 <./images/unpacking_traces/FSG_v2.0.j
pg> <./images/unpacking_traces/Petite_2.2.jpg>] [74 <./images/unpacking_traces/
tElock_v.098.jpg> <./images/unpacking_traces/Yodas_Crypter_v1.3.jpg>])
(./advanced_analysis/anti_re.tex
Missing character: There is no – in font cmtt8!
Missing character: There is no – in font cmr10!
 [75 <./images/unpacking_traces/Yodas_Protector_v1.02.jpg>]
Overfull \hbox (64.91069pt too wide) in paragraph at lines 51--51
[]\OT1/cmr/m/n/10 PEB -$\OML/cmm/m/it/10 >$ \OT1/cmr/m/n/10 Nt-Glob-alFlag. If 
70h == FLG[]HEAP[]ENABLE[]TAIL[]CHECK, FLG[]HEAP[]ENABLE[]FREE[]CHECK
 []

[76]
Missing character: There is no “ in font cmr10!
Missing character: There is no ” in font cmr10!
 [77 <./images/anti_re/tls_construction_a.png>] [78 <./images/anti_re/tls_const
ruction_b.png>] [79]
\openout2 = `advanced_analysis/compiler_optimizations.aux'.

 (./advanced_analysis/compiler_optimizations.tex
[80

 <./images/anti_re/basic_block_sharing_optimizations_1a.png> <./images/anti_re/
basic_block_sharing_optimizations_1b.png>] [81 <./images/anti_re/basic_block_sh
aring_optimizations_2.png> <./images/anti_re/basic_block_sharing_optimizations_
3.png>]) [82 <./images/anti_re/basic_block_sharing_optimizations_4.png>]
<images/anti_re/PE-Misaligned_Sections.pdf, id=2192, 525.965pt x 385.44pt>
File: images/anti_re/PE-Misaligned_Sections.pdf Graphic file (type pdf)

<use images/anti_re/PE-Misaligned_Sections.pdf> [83

] [84 <./images/anti_re/PE-Misaligned_Sections.pdf> <./images/anti_re/relocatio
n_01.pdf>] [85 <./images/anti_re/relocation_02.pdf> <./images/anti_re/relocatio
n_03.pdf>] [86 <./images/anti_re/relocation_04.pdf> <./images/anti_re/relocatio
n_05.pdf>] [87 <./images/anti_re/relocation_06.pdf>] [88] [89 <./images/anti_re
/bad_pe_header_values.png> <./images/anti_re/loaderflags.png>]) (./advanced_ana
lysis/binary_diffing.tex
[90 <./images/anti_re/nicolasb_section.png>] [91 <./images/binary_diffing/bindi
ff_01_start.png>] [92 <./images/binary_diffing/bindiff_02_building_signature.pn
g> <./images/binary_diffing/bindiff_03_working.png> <./images/binary_diffing/bi
ndiff_04_results.png>]
<images/binary_diffing/similarity_function.png, id=2524, 201.75375pt x 60.97781
pt>
File: images/binary_diffing/similarity_function.png Graphic file (type png)
 <use images/binary_diffing/similarity_function.png> [93 <./images/binary_diffi
ng/bindiff_05_graph_results.png> <./images/binary_diffing/bindiff_06_asm_result
s.png> <./images/binary_diffing/similarity_function.png>]
<images/binary_diffing/xtree.png, id=2528, 749.199pt x 297.7524pt>
File: images/binary_diffing/xtree.png Graphic file (type png)

<use images/binary_diffing/xtree.png>)
(./advanced_analysis/advanced_malware_techniques.tex [94 <./images/binary_diffi
ng/xtree.png>] [95 <./images/advanced_malware_techniques/polymorphic.pdf>]
[96 <./images/advanced_malware_techniques/metamorphic.pdf>] [97]))
(./analysis_and_custom_development/00-index.tex
(./analysis_and_custom_development/analysis.tex [98 <./images/analysis_I/virus_
I_mugshot.jpg>] [99 <./images/analysis_I/UPX_hexdump_scrambled_strings.jpg>]
[100 <./images/analysis_I/UPX_unpacker_code_start.jpg> <./images/analysis_I/UPX
_unpacker_code_end.jpg>] [101 <./images/analysis_I/UPX_oep_not_unpacked.jpg> <.
/images/analysis_I/UPX_oep_unpacked.jpg>] [102] [103 <./images/analysis_I/IDA_u
rldownloadtofile.jpg> <./images/analysis_I/IDA_winexec.jpg>] [104 <./images/ana
lysis_I/virus_I_mugshot.jpg> <./images/analysis_II/virus_II_mugshot.jpg>]
[105 <./images/analysis_II/UPX_hexdump_scrambled_strings.jpg> <./images/analysi
s_II/IDA_1st_xor_loop.jpg>] [106 <./images/analysis_II/IDA_1st_xor_loop_after.j
pg> <./images/analysis_II/IDA_parite_code_no_imports.jpg> <./images/analysis_II
/OllyDBG_00_calling_loadlibrary.jpg>] [107 <./images/analysis_II/OllyDBG_01_res
olving_imports.jpg> <./images/analysis_II/OllyDBG_02_resolved_imports_in_the_st
ack.jpg>] [108 <./images/analysis_II/IDA_parite_body_xor_function.jpg> <./image
s/analysis_II/ProcDump_dumping_the_dropped_and_loaded_dell.jpg>] [109 <./images
/analysis_II/OllyDBG_03_calling_the_dlls_Initiate.jpg> <./images/analysis_II/Ol
lyDBG_04_calling_a_dll_resolved_import.jpg> <./images/analysis_II/OllyDBG_05_th
e_dlls_table_of_imported_symbols.jpg>]
Overfull \hbox (29.5239pt too wide) in paragraph at lines 448--454
\OT1/cmr/m/n/10 MakeName(0x008E2DA0, 'ad-vapi32.RegCloseKey') Mak-e-Name(0x008E
2DA6, 'ad-vapi32.RegCreateKeyExA')
 []


Overfull \hbox (26.77396pt too wide) in paragraph at lines 448--454
\OT1/cmr/m/n/10 Mak-e-Name(0x008E2DAC, 'ad-vapi32.RegFlushKey') Mak-e-Name(0x00
8E2DB2, 'ad-vapi32.RegOpenKeyExA')
 []

[110 <./images/analysis_II/IDA_parite_fixed_imports.jpg>] [111 <./images/analys
is_II/IDA_UPX_jump_to_oep.jpg> <./images/analysis_II/IDA_urldownloadtofile.jpg>
 <./images/analysis_II/IDA_winexec.jpg> <./images/analysis_II/virus_II_mugshot.
jpg>]) (./analysis_and_custom_development/ida_python.tex [112] [113])
(./analysis_and_custom_development/pefile_pydasm.tex [114] [115] [116] [117]
[118]) (./analysis_and_custom_development/paimei.tex [119]
<images/paimei/pstalker_demo.jpg, id=2823, 351.3125pt x 190.7125pt>
File: images/paimei/pstalker_demo.jpg Graphic file (type jpg)

<use images/paimei/pstalker_demo.jpg> [120 <./images/paimei/pstalker_demo.jpg>]

Overfull \hbox (20.257pt too wide) in paragraph at lines 87--87
[]\OT1/cmr/m/n/10 enumerate[]processes(), enu-mer-ate[]modules(), enu-mer-ate[]
threads(), at-tach(), load(), sus-pend[]thread(),
 []

[121] [122] [123] [124]
<images/paimei/paimei_relationship_graph.png, id=2840, 997.7275pt x 448.67625pt
>
File: images/paimei/paimei_relationship_graph.png Graphic file (type png)
 <use images/paimei/paimei_relationship_graph.png> [125] [126 <./images/paimei/
paimei_relationship_graph.png>] [127]
<images/paimei/dpc_demo.jpg, id=2852, 323.2075pt x 223.83624pt>
File: images/paimei/dpc_demo.jpg Graphic file (type jpg)

<use images/paimei/dpc_demo.jpg> [128 <./images/paimei/dpc_demo.jpg>]
<images/paimei/ollydbg_connector_demo.jpg, id=2856, 349.305pt x 501.875pt>
File: images/paimei/ollydbg_connector_demo.jpg Graphic file (type jpg)

<use images/paimei/ollydbg_connector_demo.jpg> [129 <./images/paimei/ollydbg_co
nnector_demo.jpg>] [130]
<images/paimei/peek_demo.png, id=2863, 200.75pt x 200.75pt>
File: images/paimei/peek_demo.png Graphic file (type png)

<use images/paimei/peek_demo.png> [131 <./images/paimei/peek_demo.png>]
[132] [133])) (./render.article.toc)
\tf@toc=\write8
\openout8 = `render.article.toc'.

 [134]
Missing character: There is no Ð in font cmr10!
Missing character: There is no Ð in font cmr10!

Underfull \hbox (badness 10000) in paragraph at lines 156--157
[]\OT1/cmr/m/n/10 Peter Fer-rie, Zmist Op-por-tu-ni-ties, Virus Bul-letin March
 2001;
 []


Underfull \hbox (badness 10000) in paragraph at lines 162--163
[]\OT1/cmr/m/n/10 Ero Car-rera, In-tro-duc-tion to IDAPython,
 []


Underfull \hbox (badness 10000) in paragraph at lines 166--167
[]\OT1/cmr/m/n/10 Tricky Re-lo-ca-tions, Pe-ter Szor, Virus Bul-letin, April 20
01, page 8
 []


Underfull \hbox (badness 10000) in paragraph at lines 170--171
[]\OT1/cmr/m/n/10 The Vi-ral Dar-win-ism of W32.Evol
 []

Missing character: There is no Ž in font cmr10!
Missing character: There is no Þ in font cmr10!
[135] (./render.article.aux (./basic_analysis/python.aux)
(./advanced_analysis/compiler_optimizations.aux)) ) ) 
Here is how much of TeX's memory you used:
 5104 strings out of 94500
 77996 string characters out of 1174974
 148143 words of memory out of 1000000
 7944 multiletter control sequences out of 10000+50000
 7762 words of font info for 30 fonts, out of 500000 for 2000
 580 hyphenation exceptions out of 1000
 51i,8n,42p,420b,449s stack positions out of 1500i,500n,5000p,200000b,5000s
PDF statistics:
 2880 PDF objects out of 300000
 0 named destinations out of 131072
 681 words of extra memory for PDF output out of 65536
</opt/local/share/texmf-di
st/fonts/type1/bluesky/cm/cmtt9.pfb></opt/local/share/texmf-dist/fonts/type1/bl
uesky/cm/cmr5.pfb></opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmbxti10.
pfb></opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmtt10.pfb></opt/local/
share/texmf-dist/fonts/type1/bluesky/cm/cmmi10.pfb></opt/local/share/texmf-dist
/fonts/type1/bluesky/cm/cmr7.pfb></opt/local/share/texmf-dist/fonts/type1/blues
ky/cm/cmsy5.pfb></opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmtt8.pfb><
/opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmitt10.pfb></opt/local/shar
e/texmf-dist/fonts/type1/bluesky/cm/cmti10.pfb></opt/local/share/texmf-dist/fon
ts/type1/bluesky/cm/cmsy10.pfb></opt/local/share/texmf-dist/fonts/type1/bluesky
/cm/cmr10.pfb></opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmbx10.pfb></
opt/local/share/texmf-dist/fonts/type1/bluesky/cm/cmbx12.pfb>
Output written on render.article.pdf (135 pages, 9069191 bytes).