Debugging Fundamentals Module 1 - Debugger Events
oalabs activity
Live Stream VOD: Using Angr Symbolic Execution to Remove Control Flow Obfuscation From Pandora Ransomware
In this Twitch stream we use Angr symbolic execution and IDA scripts to removed the control flow flattening obfuscation from Pandora Ransomware.
Sample
Live Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2
In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predicates. We are using a combination of IDA scripts and emulation with dumpulato...
2022-03-26 02:51:33 +0000 UTC View PostLive Stream VOD: Pandora Ransomware Unpacking and Control Flow Deobfuscation Part 1
In this Twitch stream we unpack Pandora Ransomware and begin analyzing the control flow obfuscation used in the payload. The obfuscation is a type of control flow flattening that we begin to remove with a combination of IDA scripts and emulation with dumpulator.
Live Stream VOD: BlackCat Ransomware (Rust) Reverse Engineering Fail
In this Twitch stream we take a look at the latest version of BlackCat ransomware which is written in Rust. We learn that Rust is a pain to analyze and in the end we discover that we can't statically extract the ransomware config because it requires a decryption key to be passed at runtime. This was a struggle stream!
Sample:
Live Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM
In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component that is used to interface with WMI.
Sample: a259...
2022-03-14 01:30:56 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Analysis
In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine.
Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec&...
2022-03-12 06:46:34 +0000 UTC View PostLive Stream VOD: Analysis of Leaked Conti Ransomware Source Code
In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware.
Some backstory here, a twitter account @contileaks began posting leaked chat l...
2022-03-04 02:26:36 +0000 UTC View PostLive Stream VOD: Hermetic Wiper Analysis
In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued Hermetica Digital Ltd. The wiper also abuses legitimate drivers from the EaseUS Partition Master.
S...
2022-03-04 02:21:45 +0000 UTC View PostLive Stream VOD: Follow-Up On STL C++ Reversing Mistakes
In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!
Sample: 7d47e5871efc4c079531513f2...
2022-03-04 00:11:54 +0000 UTC View PostLive Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3
In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.
Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc624...
2022-02-26 00:01:47 +0000 UTC View PostHunting The XOR Keys For Hashed Imports - Emotet Example
With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our tutorial on API hashing and how HashDB can be used to resolve hashed imports you can view it on 2022-02-25 05:12:35 +0000 UTC View Post
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware
In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exe
S...
2022-02-22 00:48:36 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Implement CREATE_PROCESS_DEBUG_EVENT
- Build an au... 2022-02-19 01:35:06 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we implement hardware breakpoints!
The code is open source and posted on our GitHub: 2022-02-19 01:28:58 +0000 UTC View Post
Practical Calling Conventions For Reverse Engineers
Calling Conventions
- Different conventions based on processor, OS, and language
- Describes how arguments are passed to functions
- Describes how values are returned from functions
- Describes if the caller or callee cleans the stack
- Responsible for fun... 2022-02-17 07:27:27 +0000 UTC View Post
Assembly Calling Convention: __stdcall
Calling Convention: __stdcall
- Calling convention for WIN32 APIs
- Arguments are passed on the stack (pushed right-to-left)
- Callee is responsible for stack cleanup
Assembly Calling Convention: __fastcall
Calling Convention: __fastcall
- Calling convention may be specified by the developer or added by the compiler as an optimization
- The Borland compiler (Delphi) uses a different version of __fastcall as the default calling convention
- Microsoft: first... 2022-02-17 07:10:12 +0000 UTC View Post
Assembly Calling Convention: __thiscall
Calling Convention: __thiscall
- Calling convention for C++ class members
(passing the “this” object) - Arguments are passed on the stack (pushed right-to-left)
- An additional argument, the “this” object pointer, is passed in the ECX register
IDA Pro Custom Assembly Calling Convention: __usercall
IDA Calling Convention: __usercall
- Custom user-defined calling convention only in IDA used to define a non-standard function type
- Use the @<reg> convention to define a register argument
- Use the @<^start.end> convention... 2022-02-17 07:00:44 +0000 UTC View Post
Assembly Calling Convention: x64 __fastcall
Windows x64 __fastcall
- The first four arguments are passed in RCX, RDX, R8, R9
- Argument sizes up to QWORD are passed directly, anything else is passed by reference
- Return values up to QWORD are returned in RAX 2022-02-17 06:54:26 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 3
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Wrap memory write to allow writing to non-writable memory... 2022-02-11 22:01:51 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 2
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Handle LOAD_DLL_DEBUG_EVENT
- Handle UNLOAD_... 2022-02-07 17:03:50 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG
In this Twitch stream we begin to build a debugger from scratch, affectionally known as "TrashDBG". The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
The code is open source and posted on our GitHub: 2022-02-05 20:03:30 +0000 UTC View Post