<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Writing Drivers in Delphi</title>
	<atom:link href="http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/feed/" rel="self" type="application/rss+xml" />
	<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/</link>
	<description>Slightly Advanced Computer Stuff (and some magic)</description>
	<lastBuildDate>Sat, 21 Nov 2009 04:22:17 +0200</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.6</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: White Shadow</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-32332</link>
		<dc:creator>White Shadow</dc:creator>
		<pubDate>Mon, 09 Nov 2009 19:42:05 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-32332</guid>
		<description>Over-eager antivirus software, likewise fail.</description>
		<content:encoded><![CDATA[<p>Over-eager antivirus software, likewise fail.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: qqqq1</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-32331</link>
		<dc:creator>qqqq1</dc:creator>
		<pubDate>Mon, 09 Nov 2009 19:40:52 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-32331</guid>
		<description>Virus inside. FAIL.</description>
		<content:encoded><![CDATA[<p>Virus inside. FAIL.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: avar</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-30411</link>
		<dc:creator>avar</dc:creator>
		<pubDate>Mon, 01 Jun 2009 08:04:34 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-30411</guid>
		<description>it is safe, this kit is now actively used by many chinese programmers, just search www.baidu.com for DDDK004.zip, u can find many links on many forums.</description>
		<content:encoded><![CDATA[<p>it is safe, this kit is now actively used by many chinese programmers, just search <a href="http://www.baidu.com" rel="nofollow">http://www.baidu.com</a> for DDDK004.zip, u can find many links on many forums.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: White Shadow</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-30237</link>
		<dc:creator>White Shadow</dc:creator>
		<pubDate>Tue, 19 May 2009 10:34:46 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-30237</guid>
		<description>I&#039;d say it is safe.</description>
		<content:encoded><![CDATA[<p>I&#8217;d say it is safe.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: dodo</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-30235</link>
		<dc:creator>dodo</dc:creator>
		<pubDate>Tue, 19 May 2009 08:18:44 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-30235</guid>
		<description>what the conclusion?
it is safe or not?</description>
		<content:encoded><![CDATA[<p>what the conclusion?<br />
it is safe or not?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Arghblarg</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-18983</link>
		<dc:creator>Arghblarg</dc:creator>
		<pubDate>Tue, 03 Mar 2009 05:50:08 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-18983</guid>
		<description>OK guys, I think everyone can relax. I analyzed the &#039;infected&#039; DCC32.exe, omf2d.exe and link.exe files in this archive.

It turns out they are compressed EXE files (a look with hex editor showed &#039;UPack&#039; by Dwing was the packer used). I found a trial of a program called &#039;PE Explorer&#039; (google it) which can unpack such EXE files; so I unpacked them and scanned the unpacked versions and Avira says they&#039;re clean.

DCC32.exe (unpacked): v15.0, circa 2002 (what version of Delphi IDE? Who knows)

omf2d.exe (unpacked):
C:\Documents and Settings\asdf\Desktop\DDDK004\unpacked&gt;.\omf2d.exe /?

OMF2D 1.02 converts 32bit OMF to Delphi linkable OMF
Copyright (C) 2003 Radim Picha, www.anticracking.sk/EliCZ
OMF2D: Cannot open input file!

.. I suppose the antivirus companies nowadays just flag *any* PE executable packed with Dwing UPack as malware since a lot of virus/trojan writers use the lib to keep their malware small. But it really doesn&#039;t, in itself, constitute a danger. I&#039;d say this is a legit package, but someone really needs to re-dist it without packed EXEs so people don&#039;t freak out. I guess I&#039;ll post it somewhere in a fixed form :)

Hope that helps,
-Arghblarg</description>
		<content:encoded><![CDATA[<p>OK guys, I think everyone can relax. I analyzed the &#8216;infected&#8217; DCC32.exe, omf2d.exe and link.exe files in this archive.</p>
<p>It turns out they are compressed EXE files (a look with hex editor showed &#8216;UPack&#8217; by Dwing was the packer used). I found a trial of a program called &#8216;PE Explorer&#8217; (google it) which can unpack such EXE files; so I unpacked them and scanned the unpacked versions and Avira says they&#8217;re clean.</p>
<p>DCC32.exe (unpacked): v15.0, circa 2002 (what version of Delphi IDE? Who knows)</p>
<p>omf2d.exe (unpacked):<br />
C:\Documents and Settings\asdf\Desktop\DDDK004\unpacked&gt;.\omf2d.exe /?</p>
<p>OMF2D 1.02 converts 32bit OMF to Delphi linkable OMF<br />
Copyright (C) 2003 Radim Picha, <a href="http://www.anticracking.sk/EliCZ" rel="nofollow">http://www.anticracking.sk/EliCZ</a><br />
OMF2D: Cannot open input file!</p>
<p>.. I suppose the antivirus companies nowadays just flag *any* PE executable packed with Dwing UPack as malware since a lot of virus/trojan writers use the lib to keep their malware small. But it really doesn&#8217;t, in itself, constitute a danger. I&#8217;d say this is a legit package, but someone really needs to re-dist it without packed EXEs so people don&#8217;t freak out. I guess I&#8217;ll post it somewhere in a fixed form <img src='http://w-shadow.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<p>Hope that helps,<br />
-Arghblarg</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Arghblarg</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-18241</link>
		<dc:creator>Arghblarg</dc:creator>
		<pubDate>Fri, 27 Feb 2009 19:45:35 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-18241</guid>
		<description>The original DDDK004.zip is cached on the Internet Archive (Wayback Machine).. perhaps these ones don&#039;t trip virus scanners.. I don&#039;t know as I haven&#039;t tested them yet. Use at own risk.

http://web.archive.org/web/*/http://hxdef.org/download/DDDK004.zip</description>
		<content:encoded><![CDATA[<p>The original DDDK004.zip is cached on the Internet Archive (Wayback Machine).. perhaps these ones don&#8217;t trip virus scanners.. I don&#8217;t know as I haven&#8217;t tested them yet. Use at own risk.</p>
<p><a href="http://web.archive.org/web/" rel="nofollow">http://web.archive.org/web/</a>*/http://hxdef.org/download/DDDK004.zip</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: memoz</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-13959</link>
		<dc:creator>memoz</dc:creator>
		<pubDate>Mon, 02 Feb 2009 18:12:16 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-13959</guid>
		<description>please i want to make driver in by delphi7 , i&#039;m try so mutch but no way 
i want help 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!</description>
		<content:encoded><![CDATA[<p>please i want to make driver in by delphi7 , i&#8217;m try so mutch but no way<br />
i want help<br />
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: White Shadow</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-13949</link>
		<dc:creator>White Shadow</dc:creator>
		<pubDate>Mon, 02 Feb 2009 16:21:55 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-13949</guid>
		<description>I don&#039;t think I can, sorry. I haven&#039;t dealt with this topic for ages.</description>
		<content:encoded><![CDATA[<p>I don&#8217;t think I can, sorry. I haven&#8217;t dealt with this topic for ages.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: memoz</title>
		<link>http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/comment-page-1/#comment-13947</link>
		<dc:creator>memoz</dc:creator>
		<pubDate>Mon, 02 Feb 2009 16:13:01 +0000</pubDate>
		<guid isPermaLink="false">http://w-shadow.com/blog/2006/10/12/writing-drivers-in-delphi/#comment-13947</guid>
		<description>but then compile.debug.bat  didn&#039;t make the .sys file 
coul&#039;d you help me !!!!!!!!!!!!!!!!!!</description>
		<content:encoded><![CDATA[<p>but then compile.debug.bat  didn&#8217;t make the .sys file<br />
coul&#8217;d you help me !!!!!!!!!!!!!!!!!!</p>
]]></content:encoded>
	</item>
</channel>
</rss>
