https://insinuator.net/tags/dprk/ Recent content in Dprk on Insinuator.net - Bold Statements Hugo en-us Fri, 16 Nov 2018 00:00:00 +0000 https://insinuator.net/2018/11/dumping-decrypted-documents-from-a-north-korean-pdf-reader/ Fri, 16 Nov 2018 00:00:00 +0000 https://insinuator.net/2018/11/dumping-decrypted-documents-from-a-north-korean-pdf-reader/ <p>This is a write-up about how to use <a href="https://www.frida.re/">Frida</a> to dump documents from a process after they have been loaded and decrypted. It’s a generic and very effective approach demonstrated on a piece of software from North Korea.</p> <p>Some time ago we received an ISO file which was a dump of a CD-ROM from North Korea. The only information we got was that it included a document viewer and various PDF documents. I started to dump the content of the ISO in order to analyze what the reader was actually doing by mounting it:</p>