oalabs posts
Posts: 243
Files: 416
IDA Reverse Engineering - Module 2
Module 2, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we begin our analysis of the extracted Stage 2. binary. We focus on the entry point of an EXE file, and the CRT main "boilerplate" code.This is a very basic tutorial that introduces the concept of Structs, Arrays, custom Enums, and nested data structur...
IDA Reverse Engineering - Module 1.2
Module 1, Part 2 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we continue our analysis of the stage 1 DLL diving into the only export "work".This is a very basic tutorial that reinforces the concept of Function Definitions, Types, variable Names, Enums, and the "API-first approach" to reverse engineering. ...
IDA Reverse Engineering - Module 1
Module 1, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we open our sample DLL in IDA and mark up the DLLEntryPoint and DLLMain.This is a very basic tutorial that introduces the concept of Function Definitions, Types, variable Names, Enums, and Type Libraries.Sample93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5e...
Live Stream VOD: Chinese RJ45-USB "Malware" Full Analysis - Part 2
In this stream we continue our analysis of "malware" that was apparently automatically launched from a USB Ethernet adapter. In this part we investigate the sandbox results from Hybrid Analysis and ANYRUN which led the original discoverer to believe this was malware!Samplee3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359ReferencesOrignal X post about the "malware"htt...
Live Stream VOD: Chinese RJ45-USB "Malware" Full Analysis - Part 1
In this stream we analyze "malware" that was apparently automatically launched from a USB Ethernet adapter. We reverse engineer the code line-by-line to confirm that nothing is malicious.In Part 2 we will analyze the sandbox results that lead to the incorrect conclusion that this was malware... stay tuned!Samplee3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359ReferencesOrign...
IDA Reverse Engineering - A Boring Introduction
This an introduction to our series on basic reverse engineering with IDA. It's boring and very much worth watching.
x64dbg Scripting - Logging C Runtime String Operations
Just a quick tip and some x64dbg scripts that can be used to spy on the C Runtime interface. This will only work if the C Runtime is dynamically linked which is uncommon for msvc compiled malware, but is the default for gcc/minGW compiled malware.Scriptsstringspy_msvcrt.txtstringspy_ucrtbase.txtReferencesLive Stream VOD: The Many Faces of CryptBotCollection: Debugging TipsC++ Strings for Reverse E...
Live Stream VOD: The Many Faces of CryptBot
In this Twitch stream we explore the past two years of CryptBot iterations as the developers attempt to distance themselves from the original stealer.SamplesV1 7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5dV234dcc780d2a2357c52019d87a0720802a92f358d15320247c80cc21060fb6f57V3 .1ff10143803f39c6c08b2fbe846d990b92c6d1b71e27f89bca69ab9331945b14aV3.2e7a83ddae3eec8ce624fc138e1dddb7f3ff5c...
Live Stream VOD: Spectre RAT Exposed
In this Twitch stream we triage Spectre RAT a commodity "implant" used in targeted e-crime intrusions. The RAT is written in C++ and we exploit some silly design choices by the developer to simplify reverse engineering! ๐ My OBS crashed half way through the stream but I managed to recover the full VOD, apologies for the technical difficulties.SamplePacked74f30466c1edb8daf729df5531e6047e...
C++ Strings and C Runtime (CRT) Reverse Engineering Tips
in this tutorial we examine C++ strings initialized in the CRT __initterm and how to take advantage of this setup when reverse engineering malware with encrypted strings.Resourcescpp_crt_strings.cppcrt_strings_obf.cppWhy Is The PE Entry Point Not The Same As MainC++ Strings for Reverse EngineersPractice ExamplesAttached are both the encrypted and non-encrypted compiled examples as well as the acco...
C++ Strings for Reverse Engineers
identifying and correctly typing C++ strings is the first step towards easier C++ reverse engineering. In this tutorial we walk through the mechanics (and code) behind the standard strings in C++ResourcesThe C++ strings types header can be found here: cppstrings.hBelow is an IDA cheat sheet from @fr0gger_which is helpful when trying to remember the hot keys.Practice ExamplesAttached are both the o...
Reverse Engineering Lab Setup
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials.About FlareVMIf you have been with us for a while you may remember that we used to recommend FlareVM. It's still a great idea, and if you want to use their ful...
Tropical Live Stream VOD: Latrodectus
In this Twitch stream we take a look at the new Latrodectus variant which uses AES to encrypt its strings. Instead of writing an AES string decrypter we take a generic "black box approach" using emulation to simply emulate the full decryption algorithm.Samples5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8Notes (with code)Latrodectus - Extracting new AES encrypted strings ...
Intercepting HTTP Traffic With The Debugger
In this tutorial we demonstrate how to use x64dbg to intercept network traffic in a target process. We are using Lumma Stealer as an example but the approach is roughly the same for all malware.ReferencesWinHttpCrackUrlWinHttpReadDataHTTP Request Example CodeSample5aead2773474aa64c7e5300d49eca7ee01174fe806fd73f4a878ae4b2a4aaca1 [UnpacMe]Lumma Stealer AnalysisLive Stream VOD: Lumma Stealer Deobfusc...
Tropical Live Stream VOD: Polyglot Emmenhtal Analysis
Is it a benign PE file, is it a malicious HTA script? In this live stream we explore an interesting polyglot loader! Short and sweet, hope you all like scripts!Sampledd52a6b3e9d1f368ed000d5a506331ce5b3f194512f9d075b494510ae1583a1f [UnpacMe]NotesEmmenhtal - Peeling the layers of this polyglot loader
Tracing The Pain Away Module 6 - Introduction to DTrace
An introduction to DTRace and D-generate.ReferencesDTrace on Windowshttps://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtraceExample DTrace Scriptshttps://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace-programming#additional-sample-scriptsD-Generatehttps://raw.githubusercontent.com/jonaslyk/temp/main/dg.batJonas D-Generate release thread (X)https://x.com/jonasLyk...
Tracing The Pain Away Module 5 - Dynamic Binary Instrumentation with PIN
An introduction to DBI with PIN and TinyTracer.ReferencesTinyTracer Wikigithub.com/hasherezade/tiny_tracer/wikiDynamic Binary Instrumentation Frameworks: I know you're there spying on me (PDF)https://www.coresecurity.com/sites/default/files/private-files/publications/2016/05/corelabs-FalconRiva_2012.pdfPwning Intel piN Why DBI is unsuitable for security applications (PDF)https://kirschju.re/do...
Tropical Live Stream VOD: Zharkbot Dynamic Analysis
In this live stream we take a different approach to analyzing the annoying string encryption in Zharkbot; dynamic analysis! Sample1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109[UnpacMe]NotesZharkbot Strings - Extracting strings from this downloader
Tracing The Pain Away Module 4 - Instruction Tracing
Instruction tracing with x64dbg.Referencesx64dbg-tracedump.pygithub.com/mrexodia/dumpulator/blob/main/tests/x64dbg-tracedump.pyExecution Trace Viewergithub.com/teemu-l/execution-trace-viewerIDA Lighthouse Pluginhttps://github.com/gaasedelen/lighthouseDragon Dance Ghidra Trace Pluginhttps://github.com/0ffffffffh/dragondanceLab 3 - Instruction TracingIn this lab we use instruction tracing to dig dee...
Tracing The Pain Away Module 3 - Syscalls
Syscall tracing with x64dbg.ReferencesWOW64 Syscall Tracing With x64dbghttps://www.patreon.com/posts/syscall-tracing-103115555x64 Syscall Tablej00ru.vexillium.org/syscalls/nt/64/x32 Syscall Tablej00ru.vexillium.org/syscalls/nt/32/Lab 2 - SyscallsIn this lab we move our focus lower in the the windows stack and trace syscalls. This is the lowest userland interface with the kernel and impossible to e...
Tropical Live Stream VOD: Dynamic Python Deobfuscation Attacking The Interpreter
In this live stream we analyze an unknown python stealer that comes bundled as a PyInstaller, but instead of static analysis we opt for dynamic analysis with x64dbg!Sample2a19ba63e85ce75d5f2d884011dfc94f616b176ed89a67c1acc0fe2179e8b591[UnpacMe]NotesPython Hunting - Triaging this unknown python stealer with some breakpoints
Tracing The Pain Away Module 2 - Debugger Basics
Introduction to API tracing with the debugger.Referencesanti-debug.checkpoint.comPractical Calling Conventions Tutorialshttps://www.patreon.com/collection/155851?view=expandedX64dbg string formatting reference help.x64dbg.com/en/latest/introduction/Formatting.htmlTracing Memory With X64dbg and Advanced Breakpointshttps://www.patreon.com/posts/tracing-memory-107586165Lab 1 - DebuggingThis lab intro...
Tracing The Pain Away Module 1 Part 2 - Code Obfuscation Basics With VM Protection
A brief overview of how VM protection works.ReferencesApplied Emulation Tutorial Serieshttps://www.patreon.com/collection/155915?view=expandedLab 0 - IntroductionThis is a good time to make sure your tools are installed and working. Read through the Introduction Tooling Setup(first tutorial video) and ensure you have the required software installed. If you need a hand getting anything setup just a...
Tracing The Pain Away Module 1 Part 1 - Introduction to Static and Dynamic Analysis
A quick refresher on static vs. dynamic analysis.
Tracing The Pain Away Introduction
Tooling SetupTo complete the labs you will need the following setup.Windows VM running at least Windows 10 (64bit) 20H1, later versions of 64bitWindows are also acceptable including Windows 11.A copy of IDAinstalled, IDA Free will work fine if you donโt have a license.https://hex-rays.com/ida-free/A copy of x64dbg installed, at least a release from July 2024 or laterhttps://x64dbg.com/Build and ...
๐ DEF CON 32
Hey Reverse Engineers,Long time no post! if you are wondering why it has been two weeks since our last stream we have been busy putting the final touches on our DEF CON workshop! Sadly tickets have already sold out but if you show up at the door you may get lucky! Also, for those of you not attending, no worries! A video version of the training will be up on Patreon once we get back (give us a wee...
Live Steam VOD: New Rust Packer Protects Zharkbot
In this twitch stream we take a look at a new packer being used to protect the latest version of Zharkbot... plot twist, the packer is written in rust! Sample068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80[UnpacMe]NotesZharkbot In A RUST Shell - Taking a look at this updated ZharkBot in a rust packer
Tracing Memory With X64dbg and Advanced Breakpoints
In this tutorial we combine multiple concepts and transform x64dbg into a memory tracing tool using conditional breakpoints. Many of the concepts used in this tutorial build on our previous tutorials. The following may be helpful for a deeper explanation of the topics discussed.TutorialsSyscall Tracing With x64dbgAssembly Calling Convention: x64 __fastcallProcess Memory BasicsDebugging Fundamental...
Live Steam VOD: RansomHouse Part 2 - PE Rebuilding
This is the second part in our analysis of RansomHouse ransomware loader. In this stream we rebuild a custom PE format used by the loader.Sampleacf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123No notes, just pure RE and chill ๐น๐พ
Live Steam VOD: RansomHouse Part 1 - Password Protection
Back to basics, full reverse engineering! In this stream we investigate how the password protection feature works on RansomHouse/WhiteRabbit ransomware.Sampleacf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123No notes, just pure RE and chill ๐น๐พ
