Vitali Kremez
  • Home
  • About
  • Contact
  • Cyber Security
  • Cyber Intel
  • Programming
  • Reverse Engineering
  • Exploit Development
  • Penetration Test
  • WIN32 Assembly
  • On Writing
    • Blog
    • LSAT
    • Photo
  • Honeypot
  • Forum

Reverse engineering Malware

IDA Pro Tutorial: Unpacking Obfuscated Binary Using IDA Pro Debugger

8/27/2016

0 Comments

 
​Source: hexrays.com
Goal: Advance IDA Pro understanding
Step: Load file using as Portable Executable for 80386 (metapc) reveals multiple errors and “Warning” tab informing about possible obfuscation routines.
 
The following flags are checked out as well:
  • Rename DLL sections
  • Create import segment
Picture
The subroutine reveals the unresolvable jmp call to nowhere, as marked in red.
Picture

Read More
0 Comments

Debugging C Code in Microsoft Visual Studio 2015

8/21/2016

0 Comments

 
Source: Intro to Intel  x86, OpenSecurityTraining
1 - Fix C++/ Linker Setup Properties
* Program Database (/Zi)
* Disable Security Check
* __cdecl (/Gd) or __stdcall (/Gz)
* Linker/Enable Incremental Linking (No)
2 - Breakpoint on Main -> Go to Disassembly
3 - Windows/Memory -> Address on ESP (hexadecimal display and 4-byte integers)
4 - Windows/Registers
Picture
0 Comments

    Author

    Vitali Kremez

    Archives

    August 2016
    June 2016
    May 2016
    April 2016

    Categories

    All

    RSS Feed

Powered by Create your own unique website with customizable templates.
  • Home
  • About
  • Contact
  • Cyber Security
  • Cyber Intel
  • Programming
  • Reverse Engineering
  • Exploit Development
  • Penetration Test
  • WIN32 Assembly
  • On Writing
    • Blog
    • LSAT
    • Photo
  • Honeypot
  • Forum