13
votes
Is Null in Windows equal to zero?
In C, and many other low-level programming languages the term NULL is equivalent to 0.
The C standard requires NULL to be #defined to an "implementation defined value", however all ...
- 11.8k
11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.8k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 9,009
9
votes
Academic journals for latest RE/Malware/Exploitation research?
This is an indirect answer to your question, but hopefully still useful. There are multiple conferences that feature state-of-the-art work in this space. If anyone knows of more, feel free to add on ...
- 957
9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,932
7
votes
Academic journals for latest RE/Malware/Exploitation research?
You have a few academic workshops and conferences about the topic (or close to the topic). But, most of them are appearing and disappearing quite often unfortunately. So, it is difficult to come with ...
- 19.2k
7
votes
Is Null in Windows equal to zero?
ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) ...
- 260
6
votes
Anti-VM and anti-sandbox malware samples
For learning purposes, I would recommend you the following Github projects to start with:
Paranoid Fish by a0rtega
https://github.com/a0rtega/pafish
Al-Khaser v0.60 by Noteworthy
https://github....
- 2,438
6
votes
Accepted
Good foundation for reverse engineering malware
Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
- 11.8k
6
votes
Accepted
Can benign applications have such APIs?
IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
- 2,208
6
votes
Accepted
DGA(Domain Generation Algorithm) based malware files
I know of no collection of malware samples, focusing specifically on DGAs.
However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a ...
- 416
6
votes
Accepted
Is there any websites to get malware files using YARA rules?
An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara ...
- 11.8k
6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
6
votes
Is Null in Windows equal to zero?
When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h
#ifndef NULL
#ifdef __cplusplus
#define NULL 0
#else
...
- 1,267
5
votes
Analyzing highly obfuscated JavaScript
In addition to the other useful links here, I recommend to try Malware-Jail
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
malware-...
- 193
5
votes
Accepted
Where can I find benign samples with a high potential to false positive?
You can find some of the samples from our work on deobfuscation at hxxp://www.cs.arizona.edu/projects/lynx-project/Samples/ (s/x/t/). The programs---a mix of Linux and Windows binaries---are all ...
- 668
5
votes
Where can I find benign samples with a high potential to false positive?
Malicious samples
My favorite source for malicious samples is a database i assembled myself by regulary pulling the free examples provided by VirusSign. Please not these samples do require ...
- 2,906
5
votes
Accepted
Safe way to download a malware payload?
This sounds like a straightforward question at first glance, but may prove a little more complicated at second thought.
Before we go into how to retrieve the payload, I should highlight the ...
- 11.8k
5
votes
how to overcome setunhandledexceptionfilter in ollyDebugger?
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed ...
- 11.8k
5
votes
Accepted
Information about packers
First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
- 2,254
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,709
5
votes
Dumping dll out of process
I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL ...
- 9,198
5
votes
Most efficient way to begin analyzing malware binary
I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be ...
- 712
5
votes
cdecl calling convention
esp register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary.
#1 Initial stack frame:
|local var 1| <- esp (lowest address)
|local var 2|
|----...
- 1,858
5
votes
Accepted
How 10 IS HEX 5 bytes?
The length of 10 is simply the number of characters selected.
Each hexadecimal digit requires 4 bits (0..F).
So 10 hexadecimal digits take 40 bits (4 bits x 10) or 5 bytes (8 bits x 5).
- 796
4
votes
Accepted
Malware samples to analyze with existing disassembly?
The archive of disassembled and analysed malware does not exist - at least I haven't heard of any good ones. The closest I can think of is labs files from "Practical Malware Analysis", at https://...
- 843
4
votes
Accepted
Distribution of malware obfuscation types
Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a ...
- 1,257
4
votes
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
using ollgdbgv2's debug child processes feature
Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0.
One of the new features in ollydbg ...
- 11.8k
4
votes
Accepted
What PE anomalies can crash the Windows Loader or cause a file to not load?
Based on my experience, these type of errors could happen when MajorOperatingSystem/MinorOperatingSystem and/or MajorSubsystemVersion/MinorSubsystemVersion are not compatible with the system you are ...
- 1,073
4
votes
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
The author does not appear to explicitly explain what "file properties" are, but some of the papers cited in relation to "file properties" discuss the role of malware families in machine-learning ...
- 7,246
Only top scored, non community-wiki answers of a minimum length are eligible