oalabs posts
Posts: 243
Files: 416
IDA Reverse Engineering - Module 2
Module 2, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we begin our analysis of the extracted Stage 2. binary. We focus on the entry point of an EXE file, and the CRT main "boilerplate" code.This is a very basic tutorial that introduces the concept of Structs, Arrays, custom Enums, and nested data structures. Sample7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6ccReferencespebase.hUnderstanding PE Parsing Tutorial SeriesIDA EnumsIDA Array...
IDA Reverse Engineering - Module 1.2
Module 1, Part 2 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we continue our analysis of the stage 1 DLL diving into the only export "work".This is a very basic tutorial that reinforces the concept of Function Definitions, Types, variable Names, Enums, and the "API-first approach" to reverse engineering. We also have a small explainer about string operations optimized by the compiler.Sample93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5e...
IDA Reverse Engineering - Module 1
Module 1, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we open our sample DLL in IDA and mark up the DLLEntryPoint and DLLMain.This is a very basic tutorial that introduces the concept of Function Definitions, Types, variable Names, Enums, and Type Libraries.Sample93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5edReferencesDLL Mainhttps://learn.microsoft.com/en-us/windows/win32/dlls/dllmainEnumshttps://hex-rays.com/blog/igors-tip-of-the-week-99-enu...
Live Stream VOD: Chinese RJ45-USB "Malware" Full Analysis - Part 2
In this stream we continue our analysis of "malware" that was apparently automatically launched from a USB Ethernet adapter. In this part we investigate the sandbox results from Hybrid Analysis and ANYRUN which led the original discoverer to believe this was malware!Samplee3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359ReferencesOrignal X post about the "malware"https://x.com/evapro30/status/1878416900016705783Blog by op about the "malware" https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memory-exe...
Live Stream VOD: Chinese RJ45-USB "Malware" Full Analysis - Part 1
In this stream we analyze "malware" that was apparently automatically launched from a USB Ethernet adapter. We reverse engineer the code line-by-line to confirm that nothing is malicious.In Part 2 we will analyze the sandbox results that lead to the incorrect conclusion that this was malware... stay tuned!Samplee3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359ReferencesOrignal X post about the "malware"https://x.com/evapro30/status/1878416900016705783Blog by op about the "malware" https://epcyber.com/blog/...
IDA Reverse Engineering - A Boring Introduction
This an introduction to our series on basic reverse engineering with IDA. It's boring and very much worth watching.
x64dbg Scripting - Logging C Runtime String Operations
Just a quick tip and some x64dbg scripts that can be used to spy on the C Runtime interface. This will only work if the C Runtime is dynamically linked which is uncommon for msvc compiled malware, but is the default for gcc/minGW compiled malware.Scriptsstringspy_msvcrt.txtstringspy_ucrtbase.txtReferencesLive Stream VOD: The Many Faces of CryptBotCollection: Debugging TipsC++ Strings for Reverse EngineersC++ Strings and C Runtime (CRT) Reverse Engineering Tips
Live Stream VOD: The Many Faces of CryptBot
In this Twitch stream we explore the past two years of CryptBot iterations as the developers attempt to distance themselves from the original stealer.SamplesV1 7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5dV234dcc780d2a2357c52019d87a0720802a92f358d15320247c80cc21060fb6f57V3 .1ff10143803f39c6c08b2fbe846d990b92c6d1b71e27f89bca69ab9331945b14aV3.2e7a83ddae3eec8ce624fc138e1dddb7f3ff5c5c9f20db11f60e22f489bdcc947NotesCryptBot Evolution - Tracking the many iterations of this stealer
Live Stream VOD: Spectre RAT Exposed
In this Twitch stream we triage Spectre RAT a commodity "implant" used in targeted e-crime intrusions. The RAT is written in C++ and we exploit some silly design choices by the developer to simplify reverse engineering! π My OBS crashed half way through the stream but I managed to recover the full VOD, apologies for the technical difficulties.SamplePacked74f30466c1edb8daf729df5531e6047e69cfbcd0625fbb3df02bb655ec90c480UnpacMeUnpacked734a22c413872a8b5f6fc5342261b9ff2c256c1891bb258747ff000df960ce4fUnpacMeNotesSpectre Ops - Triage for v1...
C++ Strings and C Runtime (CRT) Reverse Engineering Tips
in this tutorial we examine C++ strings initialized in the CRT __initterm and how to take advantage of this setup when reverse engineering malware with encrypted strings.Resourcescpp_crt_strings.cppcrt_strings_obf.cppWhy Is The PE Entry Point Not The Same As MainC++ Strings for Reverse EngineersPractice ExamplesAttached are both the encrypted and non-encrypted compiled examples as well as the accompanying PDB files. I strongly recommend attempting to decrypt the strings using x64dbg by replicating the steps shown in the tutorial.
C++ Strings for Reverse Engineers
identifying and correctly typing C++ strings is the first step towards easier C++ reverse engineering. In this tutorial we walk through the mechanics (and code) behind the standard strings in C++ResourcesThe C++ strings types header can be found here: cppstrings.hBelow is an IDA cheat sheet from @fr0gger_which is helpful when trying to remember the hot keys.Practice ExamplesAttached are both the optimized and non-optimized compiled examples as well as the source file and accompanying PDB files. I strongly recommend attempting to mark up the typ...
Reverse Engineering Lab Setup
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials.About FlareVMIf you have been with us for a while you may remember that we used to recommend FlareVM. It's still a great idea, and if you want to use their full suite of tools you can follow their install guide here FLARE-VM. However, after a few years of troubleshooting buggy installs (mostly NOT the fault ...
Tropical Live Stream VOD: Latrodectus
In this Twitch stream we take a look at the new Latrodectus variant which uses AES to encrypt its strings. Instead of writing an AES string decrypter we take a generic "black box approach" using emulation to simply emulate the full decryption algorithm.Samples5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8Notes (with code)Latrodectus - Extracting new AES encrypted strings from this RAT
Intercepting HTTP Traffic With The Debugger
In this tutorial we demonstrate how to use x64dbg to intercept network traffic in a target process. We are using Lumma Stealer as an example but the approach is roughly the same for all malware.ReferencesWinHttpCrackUrlWinHttpReadDataHTTP Request Example CodeSample5aead2773474aa64c7e5300d49eca7ee01174fe806fd73f4a878ae4b2a4aaca1 [UnpacMe]Lumma Stealer AnalysisLive Stream VOD: Lumma Stealer Deobfuscation - Part 1Live Stream VOD: Lumma Stealer Deobfuscation - Part 2
Tropical Live Stream VOD: Polyglot Emmenhtal Analysis
Is it a benign PE file, is it a malicious HTA script? In this live stream we explore an interesting polyglot loader! Short and sweet, hope you all like scripts!Sampledd52a6b3e9d1f368ed000d5a506331ce5b3f194512f9d075b494510ae1583a1f [UnpacMe]NotesEmmenhtal - Peeling the layers of this polyglot loader
Tracing The Pain Away Module 6 - Introduction to DTrace
An introduction to DTRace and D-generate.ReferencesDTrace on Windowshttps://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtraceExample DTrace Scriptshttps://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace-programming#additional-sample-scriptsD-Generatehttps://raw.githubusercontent.com/jonaslyk/temp/main/dg.batJonas D-Generate release thread (X)https://x.com/jonasLyk/status/1568450498579111936Lab 5 - DTraceIn this lab we use DTrace to trace syscalls from the kernel. DTrace can be configured to using multiple diffe...
Tracing The Pain Away Module 5 - Dynamic Binary Instrumentation with PIN
An introduction to DBI with PIN and TinyTracer.ReferencesTinyTracer Wikigithub.com/hasherezade/tiny_tracer/wikiDynamic Binary Instrumentation Frameworks: I know you're there spying on me (PDF)https://www.coresecurity.com/sites/default/files/private-files/publications/2016/05/corelabs-FalconRiva_2012.pdfPwning Intel piN Why DBI is unsuitable for security applications (PDF)https://kirschju.re/docs/kirsch-2018-pwning-intel-pin.pdfLab 4 - Dynamic Binary InstrumentationIn this lab we use the TinyTracer PINTool to replicate the tracing techniques...
Tropical Live Stream VOD: Zharkbot Dynamic Analysis
In this live stream we take a different approach to analyzing the annoying string encryption in Zharkbot; dynamic analysis! Sample1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109[UnpacMe]NotesZharkbot Strings - Extracting strings from this downloader
Tracing The Pain Away Module 4 - Instruction Tracing
Instruction tracing with x64dbg.Referencesx64dbg-tracedump.pygithub.com/mrexodia/dumpulator/blob/main/tests/x64dbg-tracedump.pyExecution Trace Viewergithub.com/teemu-l/execution-trace-viewerIDA Lighthouse Pluginhttps://github.com/gaasedelen/lighthouseDragon Dance Ghidra Trace Pluginhttps://github.com/0ffffffffh/dragondanceLab 3 - Instruction TracingIn this lab we use instruction tracing to dig deeper than just APIs and identify when direct syscalls are made from user code.Instruction Tracing: Anti-DebuggingThe lab3.exe binary is 64-bit and impl...
Tracing The Pain Away Module 3 - Syscalls
Syscall tracing with x64dbg.ReferencesWOW64 Syscall Tracing With x64dbghttps://www.patreon.com/posts/syscall-tracing-103115555x64 Syscall Tablej00ru.vexillium.org/syscalls/nt/64/x32 Syscall Tablej00ru.vexillium.org/syscalls/nt/32/Lab 2 - SyscallsIn this lab we move our focus lower in the the windows stack and trace syscalls. This is the lowest userland interface with the kernel and impossible to escape regardless of how obfuscated the code is. You are provided with two binaries, the first of which uses the NTDLL API, and the second which uses a...
Tropical Live Stream VOD: Dynamic Python Deobfuscation Attacking The Interpreter
In this live stream we analyze an unknown python stealer that comes bundled as a PyInstaller, but instead of static analysis we opt for dynamic analysis with x64dbg!Sample2a19ba63e85ce75d5f2d884011dfc94f616b176ed89a67c1acc0fe2179e8b591[UnpacMe]NotesPython Hunting - Triaging this unknown python stealer with some breakpoints
Tracing The Pain Away Module 2 - Debugger Basics
Introduction to API tracing with the debugger.Referencesanti-debug.checkpoint.comPractical Calling Conventions Tutorialshttps://www.patreon.com/collection/155851?view=expandedX64dbg string formatting reference help.x64dbg.com/en/latest/introduction/Formatting.htmlTracing Memory With X64dbg and Advanced Breakpointshttps://www.patreon.com/posts/tracing-memory-107586165Lab 1 - DebuggingThis lab introduces the concept of using simple API monitoring with a debugger to gain insight into VM operations. You are provided with a reference binary which ca...
Tracing The Pain Away Module 1 Part 2 - Code Obfuscation Basics With VM Protection
A brief overview of how VM protection works.ReferencesApplied Emulation Tutorial Serieshttps://www.patreon.com/collection/155915?view=expandedLab 0 - IntroductionThis is a good time to make sure your tools are installed and working. Read through the Introduction Tooling Setup(first tutorial video) and ensure you have the required software installed. If you need a hand getting anything setup just ask on discord!Introduction to VM Obfuscation: Reference BinaryThe good.exe binary is a non-obfuscated reference which is used to demonstrate a simple ...
Tracing The Pain Away Module 1 Part 1 - Introduction to Static and Dynamic Analysis
A quick refresher on static vs. dynamic analysis.
Tracing The Pain Away Introduction
Tooling SetupTo complete the labs you will need the following setup.Windows VM running at least Windows 10 (64bit) 20H1, later versions of 64bitWindows are also acceptable including Windows 11.A copy of IDAinstalled, IDA Free will work fine if you donβt have a license.https://hex-rays.com/ida-free/A copy of x64dbg installed, at least a release from July 2024 or laterhttps://x64dbg.com/Build and install TinyTracer(you can simply drop the attached pin directory into you c:\ just do not distribute it please)Install and configure DTrace(require a...
π DEF CON 32
Hey Reverse Engineers,Long time no post! if you are wondering why it has been two weeks since our last stream we have been busy putting the final touches on our DEF CON workshop! Sadly tickets have already sold out but if you show up at the door you may get lucky! Also, for those of you not attending, no worries! A video version of the training will be up on Patreon once we get back (give us a week of editing time)We will also be wandering around the conference with a big stack of OALABS stickers so if you see us be sure to say hi! Remember, sh...
Live Steam VOD: New Rust Packer Protects Zharkbot
In this twitch stream we take a look at a new packer being used to protect the latest version of Zharkbot... plot twist, the packer is written in rust! Sample068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80[UnpacMe]NotesZharkbot In A RUST Shell - Taking a look at this updated ZharkBot in a rust packer
Tracing Memory With X64dbg and Advanced Breakpoints
In this tutorial we combine multiple concepts and transform x64dbg into a memory tracing tool using conditional breakpoints. Many of the concepts used in this tutorial build on our previous tutorials. The following may be helpful for a deeper explanation of the topics discussed.TutorialsSyscall Tracing With x64dbgAssembly Calling Convention: x64 __fastcallProcess Memory BasicsDebugging FundamentalsSample5fc152649ac2f0ed3f418107e20bd01a97bcd8028e1ef076faab9524e954cedfhttps://www.unpac.me/results/759da01a-d8e6-4b31-b44f-c894e77ec733X64dbg log for...
Live Steam VOD: RansomHouse Part 2 - PE Rebuilding
This is the second part in our analysis of RansomHouse ransomware loader. In this stream we rebuild a custom PE format used by the loader.Sampleacf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123No notes, just pure RE and chill πΉπΎ
Live Steam VOD: RansomHouse Part 1 - Password Protection
Back to basics, full reverse engineering! In this stream we investigate how the password protection feature works on RansomHouse/WhiteRabbit ransomware.Sampleacf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123No notes, just pure RE and chill πΉπΎ
