18
votes
Accepted
Randomly picking up a x86 register for an instruction
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
+----------------------+--------+--------+-----+--------------...
- 6,040
13
votes
Is Null in Windows equal to zero?
In C, and many other low-level programming languages the term NULL is equivalent to 0.
The C standard requires NULL to be #defined to an "implementation defined value", however all ...
- 11.7k
11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.7k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 8,919
9
votes
Academic journals for latest RE/Malware/Exploitation research?
This is an indirect answer to your question, but hopefully still useful. There are multiple conferences that feature state-of-the-art work in this space. If anyone knows of more, feel free to add on ...
- 915
9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,912
7
votes
Accepted
How do malware steal Code signing certificates?
For an executable with a digital certificate, it's easy enough to check for the certificate's information and origin by looking at the executable's properties. For example, here's what is shown for ...
- 310
7
votes
Academic journals for latest RE/Malware/Exploitation research?
You have a few academic workshops and conferences about the topic (or close to the topic). But, most of them are appearing and disappearing quite often unfortunately. So, it is difficult to come with ...
- 18.9k
6
votes
Accepted
Can benign applications have such APIs?
IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
- 2,208
6
votes
Anti-VM and anti-sandbox malware samples
For learning purposes, I would recommend you the following Github projects to start with:
Paranoid Fish by a0rtega
https://github.com/a0rtega/pafish
Al-Khaser v0.60 by Noteworthy
https://github....
- 2,438
6
votes
Accepted
Good foundation for reverse engineering malware
Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
- 11.7k
6
votes
Accepted
DGA(Domain Generation Algorithm) based malware files
I know of no collection of malware samples, focusing specifically on DGAs.
However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a ...
- 416
6
votes
Accepted
Is there any websites to get malware files using YARA rules?
An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara ...
- 11.7k
6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
6
votes
Is Null in Windows equal to zero?
When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h
#ifndef NULL
#ifdef __cplusplus
#define NULL 0
#else
...
- 1,235
6
votes
Is Null in Windows equal to zero?
ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) ...
- 219
5
votes
Accepted
Dynamic analysis of malware samples
configure the VM with no access to network and create a clean snapshot before executing the first malware. Once the execution is complete revert the snapshot. Repeat that till you finish. (probably ...
- 712
5
votes
What is the average time for "defusing" malware self-protection mechanisms?
I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand ...
- 1,063
5
votes
Accepted
Reversing a Windows service
If you want to debug the service initialization and it happens automatically (not triggered by some action you perform), you probably can't do it on any Windows newer than XP with ollydbg. You'll have ...
- 632
5
votes
Where can I find benign samples with a high potential to false positive?
Malicious samples
My favorite source for malicious samples is a database i assembled myself by regulary pulling the free examples provided by VirusSign. Please not these samples do require ...
- 2,896
5
votes
Accepted
Where can I find benign samples with a high potential to false positive?
You can find some of the samples from our work on deobfuscation at hxxp://www.cs.arizona.edu/projects/lynx-project/Samples/ (s/x/t/). The programs---a mix of Linux and Windows binaries---are all ...
- 668
5
votes
Accepted
Safe way to download a malware payload?
This sounds like a straightforward question at first glance, but may prove a little more complicated at second thought.
Before we go into how to retrieve the payload, I should highlight the ...
- 11.7k
5
votes
how to overcome setunhandledexceptionfilter in ollyDebugger?
TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program.
A more detailed ...
- 11.7k
5
votes
Accepted
Information about packers
First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
- 2,234
5
votes
Reversing Self-Modifying Malware
Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
- 4,701
5
votes
Dumping dll out of process
I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL ...
- 9,158
5
votes
Most efficient way to begin analyzing malware binary
I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be ...
- 712
5
votes
cdecl calling convention
esp register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary.
#1 Initial stack frame:
|local var 1| <- esp (lowest address)
|local var 2|
|----...
- 1,848
5
votes
Accepted
How 10 IS HEX 5 bytes?
The length of 10 is simply the number of characters selected.
Each hexadecimal digit requires 4 bits (0..F).
So 10 hexadecimal digits take 40 bits (4 bits x 10) or 5 bytes (8 bits x 5).
- 796
4
votes
Analyzing highly obfuscated JavaScript
In addition to the other useful links here, I recommend to try Malware-Jail
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
malware-...
- 183
Only top scored, non community-wiki answers of a minimum length are eligible