Debugging Fundamentals Module 1 - Debugger Events
oalabs posts
Debugging Fundamentals Module 7 - Hardware Breakpoints
Further Research
- Toggle hardware data/read/execute breakpoints programmatically
Live Stream VOD: Using Angr Symbolic Execution to Remove Control Flow Obfuscation From Pandora Ransomware
In this Twitch stream we use Angr symbolic execution and IDA scripts to removed the control flow flattening obfuscation from Pandora Ransomware.
Sample
Live Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2
In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predicates. We are using a combination of IDA scripts and...
2022-03-26 02:51:33 +0000 UTC View PostLive Stream VOD: Pandora Ransomware Unpacking and Control Flow Deobfuscation Part 1
In this Twitch stream we unpack Pandora Ransomware and begin analyzing the control flow obfuscation used in the payload. The obfuscation is a type of control flow flattening that we begin to remove with a combination of IDA scripts and emulation w...
2022-03-21 20:16:20 +0000 UTC View PostLive Stream VOD: BlackCat Ransomware (Rust) Reverse Engineering Fail
In this Twitch stream we take a look at the latest version of BlackCat ransomware which is written in Rust. We learn that Rust is a pain to analyze and in the end we discover that we can't statically extract the ransomware config because it requir...
2022-03-19 02:44:41 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM
In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component that is used to interface with WMI.
Sample:...
2022-03-14 01:30:56 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Analysis
In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine.
Live Stream VOD: Analysis of Leaked Conti Ransomware Source Code
In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware.
Some backstory here, a twitter account 2022-03-04 02:26:36 +0000 UTC View Post
Live Stream VOD: Hermetic Wiper Analysis
In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued Hermetica Digital Ltd. The wiper ...
2022-03-04 02:21:45 +0000 UTC View PostLive Stream VOD: Follow-Up On STL C++ Reversing Mistakes
In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3
In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.
Hunting The XOR Keys For Hashed Imports - Emotet Example
With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our tutorial on API hashing and how HashDB can be used ...
2022-02-25 05:12:35 +0000 UTC View PostLive Stream VOD: Reverse Engineering Polyglot Dropper Malware
In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公...
2022-02-22 00:48:36 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part w...
2022-02-19 01:35:06 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part w...
2022-02-19 01:28:58 +0000 UTC View PostPractical Calling Conventions For Reverse Engineers
Calling Conventions
- Different conventions based on processor, OS, and language
- Describes how arguments are passed to functions
- Describes how values are returned from functions ... 2022-02-17 07:27:27 +0000 UTC View Post
Assembly Calling Convention: __stdcall
Calling Convention: __stdcall
- Calling convention for WIN32 APIs
- Arguments are passed on the stack (pushed right-to-left)
- Callee is... 2022-02-17 07:14:18 +0000 UTC View Post
Assembly Calling Convention: __fastcall
Calling Convention: __fastcall
- Calling convention may be specified by the developer or added by the compiler as an optimization
- The Borland compiler (Delphi) uses a differen... 2022-02-17 07:10:12 +0000 UTC View Post
Assembly Calling Convention: __thiscall
Calling Convention: __thiscall
- Calling convention for C++ class members
(passing the “this” object) - Arguments are passed on the stack (pushed right-to-left)
- An additional arg... 2022-02-17 07:06:08 +0000 UTC View Post
IDA Pro Custom Assembly Calling Convention: __usercall
IDA Calling Convention: __usercall
- Custom user-defined calling convention only in IDA used to define a non-standard function type
- Use the @<reg> conve... 2022-02-17 07:00:44 +0000 UTC View Post
Assembly Calling Convention: x64 __fastcall
Windows x64 __fastcall
- The first four arguments are passed in RCX, RDX, R8, R9
- Argument sizes up to QWORD are passed directly, anything els... 2022-02-17 06:54:26 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 3
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this part w...
2022-02-11 22:01:51 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 2
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.
In this ...
2022-02-07 17:03:50 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG
In this Twitch stream we begin to build a debugger from scratch, affectionally known as "TrashDBG". The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works unde...
2022-02-05 20:03:30 +0000 UTC View Post