DWTF (DLL Watcher & Template Framework) is the simple engine designed by Dreg to create duplicate or fake DLL from the original DLL. It creates separate export section in the new fake DLL with each entry pointing to export section of original DLL.

In short this new fake DLL acts like interceptor and can be useful in tracking all the function calls made to the original DLL in any process. This can come in very handy while analyzing malicious process and its activities.

Here is the video demo which shows its usage….

Currently this framework is in its infancy and will grow up with time…!

.

This entry was posted on Thursday, December 17th, 2009 at 12:33 pm and is filed under Rootkit Analysis, Rootkit News, Rootkit Research, Tools. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.