Debugging Fundamentals Module 1 - Debugger Events
oalabs posts
Debugging Fundamentals Module 4 - DLLs
Further Research
- Why do I get ERROR_INVALID_HANDLE from GetModuleFileNameEx&nbs... 2022-04-08 23:00:37 +0000 UTC View Post
Live Stream VOD: Using Angr Symbolic Execution to Remove Control Flow Obfuscation From Pandora Ransomware
In this Twitch stream we use Angr symbolic execution and IDA scripts to removed the control flow flattening obfuscation from Pandora Ransomware.
Sample
Live Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2
In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predica...
2022-03-26 02:51:33 +0000 UTC View PostLive Stream VOD: Pandora Ransomware Unpacking and Control Flow Deobfuscation Part 1
In this Twitch stream we unpack Pandora Ransomware and begin analyzing the control flow obfuscation used in the payload. The obfuscation is a type of control flow flattening that we begin to remove...
2022-03-21 20:16:20 +0000 UTC View PostLive Stream VOD: BlackCat Ransomware (Rust) Reverse Engineering Fail
In this Twitch stream we take a look at the latest version of BlackCat ransomware which is written in Rust. We learn that Rust is a pain to analyze and in the end we discover that we can't statical...
2022-03-19 02:44:41 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM
In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component...
2022-03-14 01:30:56 +0000 UTC View PostLive Stream VOD: Hermetic Wizard WMI Spreader Analysis
In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine.
Live Stream VOD: Analysis of Leaked Conti Ransomware Source Code
In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware.
Live Stream VOD: Hermetic Wiper Analysis
In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued ...
2022-03-04 02:21:45 +0000 UTC View PostLive Stream VOD: Follow-Up On STL C++ Reversing Mistakes
In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3
In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.
Hunting The XOR Keys For Hashed Imports - Emotet Example
With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our t...
2022-02-25 05:12:35 +0000 UTC View PostLive Stream VOD: Reverse Engineering Polyglot Dropper Malware
In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal i...
2022-02-22 00:48:36 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging ...
2022-02-19 01:35:06 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging ...
2022-02-19 01:28:58 +0000 UTC View PostPractical Calling Conventions For Reverse Engineers
Calling Conventions
- Different conventions based on processor, OS, and language
- Describes how arguments are passed to functions
- Describes how
Assembly Calling Convention: __stdcall
Calling Convention: __stdcall
- Calling convention for WIN32 APIs
- Arguments are passed on the stack (pushed ... 2022-02-17 07:14:18 +0000 UTC View Post
Assembly Calling Convention: __fastcall
Calling Convention: __fastcall
- Calling convention may be specified by the developer or added by the compiler as an optimization
- The Borland ... 2022-02-17 07:10:12 +0000 UTC View Post
Assembly Calling Convention: __thiscall
Calling Convention: __thiscall
- Calling convention for C++ class members
(passing the “this” object) - Arguments are passed on the stack... 2022-02-17 07:06:08 +0000 UTC View Post
IDA Pro Custom Assembly Calling Convention: __usercall
IDA Calling Convention: __usercall
- Custom user-defined calling convention only in IDA used to define a non-standard function type 2022-02-17 07:00:44 +0000 UTC View Post
Assembly Calling Convention: x64 __fastcall
Windows x64 __fastcall
- The first four arguments are passed in RCX, RDX, R8, R9
- Argument s... 2022-02-17 06:54:26 +0000 UTC View Post
Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 3
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging ...
2022-02-11 22:01:51 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG Part 2
In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging ...
2022-02-07 17:03:50 +0000 UTC View PostLive Stream VOD: Building A Debugger From Scratch - TrashDBG
In this Twitch stream we begin to build a debugger from scratch, affectionally known as "TrashDBG". The purpose of building a debugger is to gain a better understanding of how debuggers work and ho...
2022-02-05 20:03:30 +0000 UTC View Post