oalabs posts
Posts: 243
Files: 416
Debugging Fundamentals Module 1 - Debugger Events
Further Research Process access with SeDebugPrivileges SE_DEBUG_NAME constant Windows Privilege Abuse CreateProcessW Process Creation Flags Writing the Debugger's Main LoopLab Environment SetupWe recommend using the FLARE-VM virtual machine (VM) for the labs running Window 10 x64. For more information on how to setup a free FLARE-VM virtual machine please see our Dynamic Malware Analysis Lab Setup tutorial.For the labs you will need to enable networking on the VM so you can install the required Python libraries. Before enabling networking ...
Debugging Fundamentals Module 2 - Threads
Further Research CREATE_THREAD_DEBUG_INFO structure Thread Scheduling Context Switching CONTEXT structure GetThreadContext Processes, Threads, and Jobs in the Windows Operating SystemLab 2When launched the debugger will print out the CREATE_THREAD_DEBUG_EVENT for each new thread as well as the CONTEXT for the thread. Because the CONTEXT is printed before the thread has be started only its initialization values will be present.Notice that these threads are created after the “Hello World” is printed to the screen indicating that the main thr...
Debugging Fundamentals Module 3 - The Stack
Further Research Functions and Stack Frames x86 Assembly and Call Stack StackWalk64 STACKFRAME structureLab 3When launched the debugger will print out a stack trace for each new thread in the CREATE_THREAD_DEBUG_EVENT. Notice that there is only one frame for this trace as thread has just been created.There is no additional exercise for this lab, simply ensure you understand how the stack trace works and how to extract the required information from the CONTEXT.
Debugging Fundamentals Module 4 - DLLs
Further Research Why do I get ERROR_INVALID_HANDLE from GetModuleFileNameEx x64dbg source for DLL load GetFinalPathNameByHandleA LOAD_DLL_DEBUG_INFOLab 4When launched the debugger will print out the LOAD_DLL_DEBUG event for each loaded DLL along with some additional information about the DLL. Note that we are using the pefile Python module to parse the DLL PE info.Lab 4 - ExerciseUpdate the handle_event_load_dll code to check if the loaded DLL is “ntdll.dll”. When “ntdll.dll” is loaded print the virtual address for the export “NtWrite...
Debugging Fundamentals Module 5 - Memory
Further Research How is it that WriteProcessMemory succeeds in writing to read-only memory? WriteProcessMemory failing (Unknown Cheats Forum) OpenProcess Process Security and Access Rights CreateProcessW Windows Anti-Debug techniques - OpenProcess filtering ReadProcessMemory WriteProcessMemoryLab 5When launched the debugger will use the CREATE_PROCESS_DEBUG_EVENT to Read/Write the target process memory and alter the “Hello World” string to print “String Hack” instead.Lab 5 - ExerciseUpdate the code in the CREATE_PROCESS_DEBUG_EVENT to p...
Debugging Fundamentals Module 6 - Software Breakpoints
Further Research INT (x86 instruction) OllyDBG Breakpoints EXCEPTION_DEBUG_INFO structure EXCEPTION_RECORD structure Writing a Primitive Debugger: Part 2 (Breakpoints/Stepping) CONTEXT structure What are all those instructions before the initally selected instruction in OllyDbg? NTSTATUS ValuesLab 6When launched the debugger will use the CREATE_PROCESS_DEBUG_EVENT to set a breakpoint on the entry point of the target. The EXCEPTION_BREAKPOINT events will then be captured to display when the breakpoint is hit.Note that the EXCEPTION_BREAKPOINT ha...
Debugging Fundamentals Module 7 - Hardware Breakpoints
Further Research Toggle hardware data/read/execute breakpoints programmatically Writing a Primitive Debugger: Part 2 (Breakpoints/Stepping) OpenSecurityTraning Hardware Breakpoints (pdf) CONTEXT structureLab 7Use the debugger to debug the target_antidebug.exe file. Observer that the Anti-Debug detection is not longer triggered. Why?Lab 7 - ExerciseConvert your code from Lab 6 to use a hardware breakpoint instead of a software breakpoint. Test again on the target_antidebug.exe file and observe that you can now capture the calls to NtWriteFile.
Live Stream VOD: Using Angr Symbolic Execution to Remove Control Flow Obfuscation From Pandora Ransomware
In this Twitch stream we use Angr symbolic execution and IDA scripts to removed the control flow flattening obfuscation from Pandora Ransomware.Sample5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7bUnpacked sample (we will be using this as our example)2619862c382d3e375f13f3859c6ab44db1a4bce905b4a617df2390fbf36902e7Our notes (with working code) are split between two notebooks.Pandora Ransomware Notes (unpacking and initial analysis)Angr Control Flow Deobfuscation (symbolic execution code)
Live Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2
In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predicates. We are using a combination of IDA scripts and emulation with dumpulator to reconstruct the original control flow.Sample: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7bResearch notes are available with code and more obfuscation learning resources: Pandora Ransomware
Live Stream VOD: Pandora Ransomware Unpacking and Control Flow Deobfuscation Part 1
In this Twitch stream we unpack Pandora Ransomware and begin analyzing the control flow obfuscation used in the payload. The obfuscation is a type of control flow flattening that we begin to remove with a combination of IDA scripts and emulation with dumpulator.Sample: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7bResearch notes are available with code: Pandora Ransomware
Live Stream VOD: BlackCat Ransomware (Rust) Reverse Engineering Fail
In this Twitch stream we take a look at the latest version of BlackCat ransomware which is written in Rust. We learn that Rust is a pain to analyze and in the end we discover that we can't statically extract the ransomware config because it requires a decryption key to be passed at runtime. This was a struggle stream!Sample: 6dd995d896a9a593b2c48d09da60bd83866d8577273f36d38788d83ad8173e68Research Notes: BlackCat Ransomware
Live Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM
In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component that is used to interface with WMI.Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ecResearch Notes: Hermetic Wizard MalwareCOM Reverse EngineeringFor more information on COM reverse engineering check out Mike Bailey's COM Presentation. He also has a nice (free) video on Pluralsight.
Live Stream VOD: Hermetic Wizard WMI Spreader Analysis
In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine.Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ecResearch Notes: Hermetic Wizard Malware
Live Stream VOD: Analysis of Leaked Conti Ransomware Source Code
In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware.Some backstory here, a twitter account @contileaks began posting leaked chat logs and source code from the Conti ransomware group. Initially they posted a password protected archive of the Conti v2 source code. Later posted an archive of the source code with the locker cpp files removed and no password. This was apparently an attempt to prevent others from compiling the source co...
Live Stream VOD: Hermetic Wiper Analysis
In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued Hermetica Digital Ltd. The wiper also abuses legitimate drivers from the EaseUS Partition Master.Sample: 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591Analysis notes can be found in our Lab-Notes: Hermetic Wiper
Live Stream VOD: Follow-Up On STL C++ Reversing Mistakes
In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969MÖBIUS STRIP REVERSE ENGINEERINGWe received a lot of help from Rolf of Möbius Strip Reverse Engineering. He helped us understand some of the STL type information and after the stream he created a marked-up IDB that can be used as a reference for this binary.We are very grateful to Rolf, and would encourage anyone who is interested ...
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3
In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969The malware is possibly related to Ghost RAT, based on the use of the export PluginMe.Full notes can be found in our Lab-NotesMÖBIUS STRIP REVERSE ENGINEERINGDuring the stream we received a lot of help from Rolf of Möbius Strip Reverse Engineering. He helped us understand some of the STL type information and after the stream he created a marked-up IDB that c...
Hunting The XOR Keys For Hashed Imports - Emotet Example
With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our tutorial on API hashing and how HashDB can be used to resolve hashed imports you can view it on YouTube. In addition to hashing API names some malware families will XOR the API hashes with a XOR key that changes with each new build of the malware. This is an attempt to further obscure the APIs and frustrate tools like HashDB. Luckily HashDB supports XOR keys for API hashes, but the job of locating the XOR key is still a manual task that mus...
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware
In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exeSHA256: 104bd2d33c119d007df2adbc571a3e8cfac722cf1f0b6156ba211f413905e9f4When executed the sample downloads a polyglot jpg as a second stage from http[:]//43.129.168[.]248/xlb.jpgFull notes can be found in our Lab-Notes
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.In this part we complete the following work: Implement CREATE_PROCESS_DEBUG_EVENT Build an automated dumper for x86 VMProtect malwareThe code is open source and posted on our GitHub: TrashDBGThe VMProtect sample we dump is a HackingTeam implant called Soldier that we analyzed in a previous stream.All coding of the debugger...
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.In this part we implement hardware breakpoints!The code is open source and posted on our GitHub: TrashDBGAll coding of the debugger is done live on stream so we can work through the challenges together as a team. Difficult challenges are documented as Issues and everyone is encouraged to add suggestions for Issues we encou...
Practical Calling Conventions For Reverse Engineers
Calling Conventions Different conventions based on processor, OS, and language Describes how arguments are passed to functions Describes how values are returned from functions Describes if the caller or callee cleans the stack Responsible for function prologue and epiloguePractical Calling ConventionsWindows x86 Calling Conventions All arguments are widened to 32 bits (DWORD) Return value is widened to 32 bits (DWORD) Return values up to 32 bits are returned in EAX Return values of 64 bit size (QWORD) are returned in EDX:EAX Return structures a...
Assembly Calling Convention: __stdcall
Calling Convention: __stdcall Calling convention for WIN32 APIs Arguments are passed on the stack (pushed right-to-left) Callee is responsible for stack cleanupMSDN __stdcall documentation
Assembly Calling Convention: __fastcall
Calling Convention: __fastcall Calling convention may be specified by the developer or added by the compiler as an optimization The Borland compiler (Delphi) uses a different version of __fastcall as the default calling convention Microsoft: first two DWORD arguments are passed in ECX and EDX (left-to-right) Borland: first three DWORD arguments are passed in EAX, EDX and ECX (left-to-right) Callee is responsible for stack cleanupMSDN __fastcall documentationPractice ExamplesAttached to this post is a copy of the HelloWorld PE file from our tu...
Assembly Calling Convention: __thiscall
Calling Convention: __thiscall Calling convention for C++ class members(passing the “this” object) Arguments are passed on the stack (pushed right-to-left) An additional argument, the “this” object pointer, is passed in the ECX register Callee is responsible for stack cleanupReverse Engineering C++ Basics TutorialMSDN __thiscall documentation Practice ExamplesAttached to this post is a copy of the HelloWorld PE file from our tutorial. You are encouraged to open this sample in IDA and identify the function calling conventions as well as ...
IDA Pro Custom Assembly Calling Convention: __usercall
IDA Calling Convention: __usercall Custom user-defined calling convention only in IDA used to define a non-standard function type Use the @<reg> convention to define a register argument Use the @<^start.end> convention to define the stack location of an argument Arguments without a specified location are assumed to be on the stack (right-to-left) Hex-Rays documentation is your friend!Full documentation for __usercall can be found in the Hex-Rays DocumentationPractice ExamplesAttached to this post is a copy of the malware shell code file from ou...
Assembly Calling Convention: x64 __fastcall
Windows x64 __fastcall The first four arguments are passed in RCX, RDX, R8, R9 Argument sizes up to QWORD are passed directly, anything else is passed by reference Return values up to QWORD are returned in RAX Registers RBX, RBP, RDI, RSI, RSP, R12, R13, R14, R15, and XMM6-XMM15 are restored (non-volatile)Windows x64 Shadow Store All non-leaf functions — functions that call other functions — must allocate Shadow Store (Shadow Space) for the functions they call The shadow store is space that can be used by the callee to save the 4 arguments ...
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 3
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.In this part we complete the following work: Wrap memory write to allow writing to non-writable memory Implement software breakpointsThe code is open source and posted on our GitHub: TrashDBGAll coding of the debugger is done live on stream so we can work through the challenges together as a team. Difficult challenges are ...
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 2
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.In this part we complete the following work: Handle LOAD_DLL_DEBUG_EVENT Handle UNLOAD_DLL_DEBUG_EVENT Implement a module list to track DLLs loaded into the target Implement target memory read/writeThe code is open source and posted on our GitHub: TrashDBGAll coding of the debugger is done live on stream so we can work thr...
Live Stream VOD: Building A Debugger From Scratch - TrashDBG
In this Twitch stream we begin to build a debugger from scratch, affectionally known as "TrashDBG". The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.The code is open source and posted on our GitHub: TrashDBGAll coding of the debugger is done live on stream so we can work through the challenges together as a team. Difficult challenges are documented as Issues and everyone is encouraged to add suggestions for Issues we encounter.
