Module 2, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we begin our analysis of the extracted Stage 2. binary. We focus on the entry point of an EXE file, and the CRT main "boilerplate" code.
This is a very basic tutorial that introduces the concept of Structs, Arrays, custom Enums, and nested data structures.
Module 1, Part 2 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we continue our analysis of the stage 1 DLL diving into the only export "work".
This is a very basic tutorial that reinforces the concept of Function Definitions, Types, variable Names, Enums, and the "API-first approach" to reverse engineering. We also have a small explainer about string ope...
2025-01-27 15:00:12 +0000 UTC View Post
Module 1, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we open our sample DLL in IDA and mark up the DLLEntryPoint and DLLMain.
This is a very basic tutorial that introduces the concept of Function Definitions, Types, variable Names, Enums, and Type Libraries.
In this stream we continue our analysis of "malware" that was apparently automatically launched from a USB Ethernet adapter. In this part we investigate the sandbox results from Hybrid Analysis and ANYRUN which led the original discoverer to believe this was malware!
In this stream we analyze "malware" that was apparently automatically launched from a USB Ethernet adapter. We reverse engineer the code line-by-line to confirm that nothing is malicious.
In Part 2 we will analyze the sandbox results that lead to the incorrect conclusion that this was malware... stay tuned!
This an introduction to our series on basic reverse engineering with IDA. It's boring and very much worth watching.
2025-01-13 15:00:11 +0000 UTC View Post
Just a quick tip and some x64dbg scripts that can be used to spy on the C Runtime interface. This will only work if the C Runtime is dynamically linked which is uncommon for msvc compiled malware, but is the default for gcc/minGW compiled malware.
<...
2024-12-15 00:05:54 +0000 UTC View PostIn this Twitch stream we explore the past two years of CryptBot iterations as the developers attempt to distance themselves from the original stealer.
V1 7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5d
V...
2024-12-09 20:30:07 +0000 UTC View Post
In this Twitch stream we triage Spectre RAT a commodity "implant" used in targeted e-crime intrusions. The RAT is written in C++ and we exploit some silly design choices by the developer to simplify reverse engineering!
🙉 My OBS crashed half way through the stream but I managed to recover the full VOD, apologies for the technical difficulties.
Packed
74f30466c1edb8daf729df5531e6047e69cfbcd062...
in this tutorial we examine C++ strings initialized in the CRT __initterm and how to take advantage of this setup when reverse engineering malware with encrypted strings.
identifying and correctly typing C++ strings is the first step towards easier C++ reverse engineering. In this tutorial we walk through the mechanics (and code) behind the standard strings in C++
The C++ strings types header can be found here: cppstrings.h
Below is an IDA cheat sheet from 2024-11-17 15:00:09 +0000 UTC View Post
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials.
If you have been with us for a while you may remember that we used to recommend Fla...
2024-10-15 21:22:00 +0000 UTC View Post
In this Twitch stream we take a look at the new Latrodectus variant which uses AES to encrypt its strings. Instead of writing an AES string decrypter we take a generic "black box approach" using emulation to simply emulate the full decryption algorithm.
5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233c...
2024-10-05 14:00:12 +0000 UTC View Post
In this tutorial we demonstrate how to use x64dbg to intercept network traffic in a target process. We are using Lumma Stealer as an example but the approach is roughly the same for all malware.
Is it a benign PE file, is it a malicious HTA script? In this live stream we explore an interesting polyglot loader! Short and sweet, hope you all like scripts!
dd52a6b3e9d1f368ed000d5a506331ce5b3f194512f9d075b494510ae1583a1f [UnpacMe]
An introduction to DTRace and D-generate.
DTrace on Windows
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace
Example DTrace Scripts
2024-09-12 14:00:02 +0000 UTC
View Post
An introduction to DBI with PIN and TinyTracer.
TinyTracer Wiki
github.com/hasherezade/tiny_tracer/wiki
Dynamic Binary Instrumentation Frameworks: I know you're there spying on me (PDF)
2024-09-09 14:00:02 +0000 UTC
View Post
In this live stream we take a different approach to analyzing the annoying string encryption in Zharkbot; dynamic analysis!
1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109 [UnpacMe]
Instruction tracing with x64dbg.
x64dbg-tracedump.py
github.com/mrexodia/dumpulator/blob/main/tests/x64dbg-tracedump.py
Execution Trace Viewer
github.com/teemu-l/execution-trace-viewer<...
Syscall tracing with x64dbg.
WOW64 Syscall Tracing With x64dbg
https://www.patreon.com/posts/syscall-tracing-103115555
x64 Syscall Table
j00ru.vexillium.org/syscalls/nt/64/
x32 Syscall Table<...
2024-09-02 14:00:03 +0000 UTC View Post
In this live stream we analyze an unknown python stealer that comes bundled as a PyInstaller, but instead of static analysis we opt for dynamic analysis with x64dbg!
2a19ba63e85ce75d5f2d884011dfc94f616b176ed89a67c1acc0fe2179e8b591 [UnpacMe]
Introduction to API tracing with the debugger.
Practical Calling Conventions Tutorials
https://www.patreon.com/collection/155851?view=expanded
X64dbg string formatting reference ...
2024-08-29 14:00:06 +0000 UTC View Post
A brief overview of how VM protection works.
Applied Emulation Tutorial Series
https://www.patreon.com/collection/155915?view=expanded
This is a good time to make sure your tools are installed and working. Read through the I...
2024-08-26 14:02:01 +0000 UTC View Post
A quick refresher on static vs. dynamic analysis.
2024-08-26 14:01:00 +0000 UTC View Post
To complete the labs you will need the following setup.
Windows VM running at least Windows 10 (64bit) 20H1, later versions of 64bit Windows are also acceptable including Windows 11.
A copy of IDA installed, IDA Free will work fine if you don’t have a license.
2024-08-26 14:00:13 +0000 UTC
View Post
Hey Reverse Engineers,
Long time no post! if you are wondering why it has been two weeks since our last stream we have been busy putting the final touches on our DEF CON workshop! Sadly tickets have already sold out but if you show up at the door you may get lucky!
Also, for those of you not attending, no worries! A video version of the training will be up on Patreon once we get back (give us a week of editing time)
We wi...
In this twitch stream we take a look at a new packer being used to protect the latest version of Zharkbot... plot twist, the packer is written in rust!
068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80 [UnpacMe]
In this tutorial we combine multiple concepts and transform x64dbg into a memory tracing tool using conditional breakpoints. Many of the concepts used in this tutorial build on our previous tutorials. The following may be helpful for a deeper explanation of the topics discussed.
This is the second part in our analysis of RansomHouse ransomware loader. In this stream we rebuild a custom PE format used by the loader.
acf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123
No notes, just pure RE and...
2024-06-27 14:00:12 +0000 UTC View Post
Back to basics, full reverse engineering! In this stream we investigate how the password protection feature works on RansomHouse/WhiteRabbit ransomware.
acf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123
No notes, ju...
2024-06-02 19:46:38 +0000 UTC View Post