Skip to main content
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
0xec's user avatar
  • 6,090
13 votes

Is Null in Windows equal to zero?

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all ...
NirIzr's user avatar
  • 11.8k
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
NirIzr's user avatar
  • 11.8k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
Megabeets's user avatar
  • 8,999
9 votes

Academic journals for latest RE/Malware/Exploitation research?

This is an indirect answer to your question, but hopefully still useful. There are multiple conferences that feature state-of-the-art work in this space. If anyone knows of more, feel free to add on ...
hairlessbear's user avatar
9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
Paweł Łukasik's user avatar
7 votes
Accepted

How do malware steal Code signing certificates?

For an executable with a digital certificate, it's easy enough to check for the certificate's information and origin by looking at the executable's properties. For example, here's what is shown for ...
Cheibriados's user avatar
7 votes

Academic journals for latest RE/Malware/Exploitation research?

You have a few academic workshops and conferences about the topic (or close to the topic). But, most of them are appearing and disappearing quite often unfortunately. So, it is difficult to come with ...
perror's user avatar
  • 19.1k
7 votes

Is Null in Windows equal to zero?

ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) ...
Peter Cordes's user avatar
6 votes
Accepted

Can benign applications have such APIs?

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
ekse's user avatar
  • 2,208
6 votes

Anti-VM and anti-sandbox malware samples

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github....
Denis Laskov's user avatar
  • 2,438
6 votes
Accepted

Good foundation for reverse engineering malware

Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

DGA(Domain Generation Algorithm) based malware files

I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a ...
pnX's user avatar
  • 416
6 votes
Accepted

Is there any websites to get malware files using YARA rules?

An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
PeterG's user avatar
  • 136
6 votes

Is Null in Windows equal to zero?

When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h #ifndef NULL #ifdef __cplusplus #define NULL 0 #else ...
chentiangemalc's user avatar
5 votes
Accepted

Where can I find benign samples with a high potential to false positive?

You can find some of the samples from our work on deobfuscation at hxxp://www.cs.arizona.edu/projects/lynx-project/Samples/ (s/x/t/). The programs---a mix of Linux and Windows binaries---are all ...
debray's user avatar
  • 668
5 votes

Where can I find benign samples with a high potential to false positive?

Malicious samples My favorite source for malicious samples is a database i assembled myself by regulary pulling the free examples provided by VirusSign. Please not these samples do require ...
Nordwald's user avatar
  • 2,906
5 votes

Analyzing highly obfuscated JavaScript

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-...
api pota's user avatar
  • 193
5 votes
Accepted

Safe way to download a malware payload?

This sounds like a straightforward question at first glance, but may prove a little more complicated at second thought. Before we go into how to retrieve the payload, I should highlight the ...
NirIzr's user avatar
  • 11.8k
5 votes

how to overcome setunhandledexceptionfilter in ollyDebugger?

TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter and ignore the exception / pass the exception to the program. A more detailed ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Information about packers

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
dsasmblr's user avatar
  • 2,234
5 votes

Reversing Self-Modifying Malware

Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely. You will see that the program resolves its own imports ...
peter ferrie's user avatar
  • 4,709
5 votes

Dumping dll out of process

I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL ...
Rolf Rolles's user avatar
  • 9,198
5 votes

Most efficient way to begin analyzing malware binary

I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be ...
GelosSnake's user avatar
5 votes

cdecl calling convention

esp register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary. #1 Initial stack frame: |local var 1| <- esp (lowest address) |local var 2| |----...
macro_controller's user avatar
5 votes
Accepted

How 10 IS HEX 5 bytes?

The length of 10 is simply the number of characters selected. Each hexadecimal digit requires 4 bits (0..F). So 10 hexadecimal digits take 40 bits (4 bits x 10) or 5 bytes (8 bits x 5).
Mega Tonnage's user avatar
4 votes
Accepted

Distribution of malware obfuscation types

Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a ...
knx's user avatar
  • 1,257
4 votes
Accepted

Malware samples to analyze with existing disassembly?

The archive of disassembled and analysed malware does not exist - at least I haven't heard of any good ones. The closest I can think of is labs files from "Practical Malware Analysis", at https://...
Vitaly Osipov's user avatar
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible