Debugging Fundamentals Module 1 - Debugger Events
oalabs posts
Debugging Fundamentals Module 4 - DLLs
Further Research
- Why do I get ERROR_INVALID_HANDLE from GetModuleFileNameEx
- x64dbg source for DLL load
- ... 2022-04-08 23:00:37 +0000 UTC View Post
Debugging Fundamentals Module 7 - Hardware Breakpoints
Further Research
- Toggle hardware data/read/execute breakpoints programmatically
- Writing a Primitive Debugger: Part 2 (Breakpoints/Stepping)<... 2022-04-08 22:59:26 +0000 UTC View Post
Live Stream VOD: Using Angr Symbolic Execution to Remove Control Flow Obfuscation From Pandora Ransomware
In this Twitch stream we use Angr symbolic execution and IDA scripts to removed the control flow flattening obfuscation from Pandora Ransomware.
Sample
5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede...
2022-04-01 22:11:20 +0000 UTC View PostLive Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2
In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predicates. We are using a combination of IDA scripts and emulation with dumpulator to reconstruct the original control flow. 2022-03-26 02:51:33 +0000 UTC View Post
Live Stream VOD: Pandora Ransomware Unpacking and Control Flow Deobfuscation Part 1
In this Twitch stream we unpack Pandora Ransomware and begin analyzing the control flow obfuscation used in the payload. The obfuscation is a type of control flow flattening that we begin to remove with a combination of IDA scripts and emulation with dumpulator.
Live Stream VOD: BlackCat Ransomware (Rust) Reverse Engineering Fail
In this Twitch stream we take a look at the latest version of BlackCat ransomware which is written in Rust. We learn that Rust is a pain to analyze and in the end we discover that we can't statically extract the ransomware config because it requires a decryption key to be passed at runtime. This was a struggle stream!
Live Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM
In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component that is used to interface with WMI.
Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49...
2022-03-14 01:30:56 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Analysis
In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine.
Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec
Research Notes: 2022-03-12 06:46:34 +0000 UTC View Post
Live Stream VOD: Analysis of Leaked Conti Ransomware Source Code
In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware.
Some backstory here, a twitter account @contileaks began posting leaked chat logs and source code from the Conti ransomware grou...
2022-03-04 02:26:36 +0000 UTC View PostLive Stream VOD: Hermetic Wiper Analysis
In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued Hermetica Digital Ltd. The wiper also abuses legitimate drivers from the EaseUS Partition Master.
Live Stream VOD: Follow-Up On STL C++ Reversing Mistakes
In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!
Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969 2022-03-04 00:11:54 +0000 UTC View Post
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3
In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.
Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969
The malware ...
2022-02-26 00:01:47 +0000 UTC View PostHunting The XOR Keys For Hashed Imports - Emotet Example
With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our tutorial on API hashing and how HashDB can be used to resolve hashed imports you can view it on YouTube<...
2022-02-25 05:12:35 +0000 UTC View PostLive Stream VOD: Reverse Engineering Polyglot Dropper Malware
In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exe
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Implement CREATE_PROCESS_DEBUG_EVENT
- Build an automated dumper for x86 VMProtect malware
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we implement hardware breakpoints!
The code is open source and posted on our GitHub: 2022-02-19 01:28:58 +0000 UTC View Post
Practical Calling Conventions For Reverse Engineers
Calling Conventions
- Different conventions based on processor, OS, and language
- Describes how arguments are passed to functions
- Describes how values are returned from functions
- Describes if the caller or callee cleans the stack
- Responsible for function prologue and epilog... 2022-02-17 07:27:27 +0000 UTC View Post
Assembly Calling Convention: __stdcall
Calling Convention: __stdcall
- Calling convention for WIN32 APIs
- Arguments are passed on the stack (pushed right-to-left)
- Callee is responsible for stack cleanup
Assembly Calling Convention: __fastcall
Calling Convention: __fastcall
- Calling convention may be specified by the developer or added by the compiler as an optimization
- The Borland compiler (Delphi) uses a different version of __fastcall as the default calling convention
- Microsoft: first two DWORD arguments are passed in
EC... 2022-02-17 07:10:12 +0000 UTC View Post
Assembly Calling Convention: __thiscall
Calling Convention: __thiscall
- Calling convention for C++ class members
(passing the “this” object) - Arguments are passed on the stack (pushed right-to-left)
- An additional argument, the “this” object pointer, is passed in the ECX register
- Callee is responsible for stack cleanup... 2022-02-17 07:06:08 +0000 UTC View Post
IDA Pro Custom Assembly Calling Convention: __usercall
IDA Calling Convention: __usercall
- Custom user-defined calling convention only in IDA used to define a non-standard function type
- Use the @<reg> convention to define a register argument
- Use the @<^start.end> convention to define the stack location of an argument ... 2022-02-17 07:00:44 +0000 UTC View Post
Assembly Calling Convention: x64 __fastcall
Windows x64 __fastcall
- The first four arguments are passed in RCX, RDX, R8, R9
- Argument sizes up to QWORD are passed directly, anything else is passed by reference
- Return values up to QWORD are returned in RAX
- Registers RBX, RBP<... 2022-02-17 06:54:26 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 3
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Wrap memory write to allow writing to non-writable memory
- Implement software breakpoints 2022-02-11 22:01:51 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 2
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part we complete the following work:
- Handle LOAD_DLL_DEBUG_EVENT
- Handle UNLOAD_DLL_DEBUG_EVENT
- Implement a module list t... 2022-02-07 17:03:50 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG
In this Twitch stream we begin to build a debugger from scratch, affectionally known as "TrashDBG". The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
The code is open source and posted on our GitHub: Tra...
2022-02-05 20:03:30 +0000 UTC View Post