I’d like to share a few projects I’ve been working on. The first project is APTNotes-md , which is APTNotes converted to Markdown format. If you’ve never heard of APTNotes, it’s a GitHub repository of APT-related threat intelligence reports in PDF format, organized by year. I created APTNotes-md for anyone who wants to explore the data using large language models. APTNotes-md contains additional…
Hello, this is an ongoing personal learning series on Large Language Models (LLMs) and automated reverse engineering. In a previous blog post , I described a type of complexity attack against LLMs. I am using "attack" in the practical reverse-engineering sense: intentionally increasing the amount of interdependent code and state the model has to reason about. My hypothesis is that increasing the…
At my day job, I run a RE mentorship. It’s a simple process for me. I have a link to the task, and the user emails me the answers to the questions in the task. If their answers are correct, I send them the next task. If the answers are incorrect, I let them know their mistakes and send them references to help. Sometimes people get tripped up with learning Assembly, or they think it’s boring (which…
Packers, cryptors, and code obfuscation are all methods used to bypass signature-based scanners in AV/EDR or to slow down the reverse engineering process. Many people are now using Large Language Models (LLMs) to reverse engineer or thwart these protections. It is increasingly common to see examples of frontier models solving CTF challenges or being used to port old video games to modern code. It…
Over the weekend I explored OpenAI’s Codex source code using Codex with the goal of understanding how it sends, receives, and processes responses from the API. Here is a link to the report . While going through it, I started thinking about inter-process communication (IPC) between Codex and other processes. In the coding agents I’m familiar with (Anthropic’s Claude Code and OpenAI’s Codex), there…
OpenAI recently posted a role for a Cybersecurity Landscape Analyst within their Intelligence and Investigation team. One line stood out: “Develop forward-looking assessments of how cyber threats may evolve over 6–24 months.” To predict the future of Agentic AI, we only need to look to the past. Agentic AI security is not emerging from nothing. It is replaying the same history as traditional…
Normal 0 false false false false EN-US X-NONE X-NONE Cybersecurity stocks took a dive after Anthropic released a blog post titled “Making frontier cybersecurity capabilities available to defenders" . What stood out was not the post itself, but the market reaction. Companies tied to endpoint protection, cloud security, and other traditional cybersecurity products were affected, even though the post…
Hello, I forgot to post a recent IDAPython plugin that I created for viewing Microsoft SDK documentation in IDA. Here is an example screenshot of msdocsviewer . The repository for the plugin can be found here .
Function Trapper Keeper is an IDA plugin for writing and storing function notes in IDBs, it’s a middle ground between function comments and IDA’s Notepad. It’s a tool that I have wanted for a while. To understand why I wanted Function Trapper Keeper, it might be worth describing my process of reverse engineering a binary in IDA. Upon opening a binary, I always take note of the code to data ratio.…
A common question when first reverse engineering ransomware is “what is a good resource for learning cryptography?”. Having an understanding of cryptography is essential when reversing ransomware. Most reverse engineers need to know how to identify the encryption algorithm, be able to follow the key generation, understand key storage and ensure the encryption implementation isn’t flawed. To…
gopep (Go Lang Portable Executable Parser) is project I have been working on for learning about Windows Portable Executables (PE) compiled in Go. As most malware analyst have noticed, there has been an uptick in malware (particularly ransomware) compiled in Go. At first glance, reverse engineering Go PE files can be intimidating. The files are commonly over 3MB in size, contains thousands of…
Hello, Some real quick updates. I have released an new version of The Beginner's Guide to IDAPytho n. It has been rewritten to cover changes that IDA 7.0 introduced. I plan on adding a couple of more chapters in the upcoming months on HexRays, Structures, GUIs and (the chapter I'm most excited about) using The Unicorn Engine within IDA. Sorry for the lack updates. Lately, I have been using a…
A while back Locky JS downloaders were downloading executable payloads encrypted with XOR. The infection chain consisted of a victim double clicking on a JS (JavaScript), JSE (Encoded JavaScript), WSH (Windows Script Host ) or another Jscript based interpreted language, the script would then connect to a compromised website, download a binary file, decrypt the binary file using XOR and then…
ObfStrReplacer is a script that replaces obfuscated variable names with easier to read strings. Some obfuscation techniques rely on common looking strings to make the code difficult to read. For example the string Illl1III111I11 is hard to distinguish from lIll1III111I11 . ObfStrReplacer takes a regular expression as an argument to match obfuscated strings, it will then add all matches to a set…
If anyone is curious the encoding that Angler is using in their SWFs is base91. The encoding was hinted at in an excellent article by Palo Alto Networks but was only identified as a function named DecodeToByteArray. Below are my notes to decode and decompress the embedded SWF. ___*____$ swfextract c34266299460225c0354df5438417924579641095ffd7588a42d8fae07ae8511 Objects in file…
I wrapped up an analysis of the Top 100 ebooks of the Pirate Bay. Rather than posting to code I decided to use a notebook viewer. All the data and code can be found on my bit-bucket repo . Cheers.
In my spare time for the past couple of months I have been working on an ebook called "The Beginner's Guide to IDAPython". I originally wrote it as a reference for myself - I wanted a place to go to where I could find examples of functions that I commonly use (and forget) in IDAPython. Since I started the book I have used it many times as a quick reference to understand syntax or see an example of…
I recently wrapped up my analysis of Dyre. A PDF document can be found in my papers repo . Most of the document focuses on the different stages that Dyre interacts with the operating system. There are still some areas that I'd like to dig deeper into. For now it should be a good resource for anyone trying to identify a machine infected with Dyre or wanting to know more about the family of malware.…
I have been reversing Dyre in my spare time. I'm hoping to have a full analysis out in the next week or two. Something kind of annoying about Dyre is it uses what looks like a massive structure to store it's data and function pointers. For example in the image below we can see it it passing a handle stored at [eax+0x130] to WaitForSingleObject. Manually tracing the code or searching for all cross…
Example 1 Hex View There are a number of tools that cover char strings in IDA. If you are not familiar with char strings it's a low hanging obfuscation technique to thwart analyst from viewing the strings inside of an executable. Some notable tools and posts on this topic are [1] & [2]. In the image above you can see the string DBG. Odds are if we were viewing the executable in a hex editor or…
Simple Function The above function is very simple. Let's ignore the actual code but think about the codes functionality from a generic standpoint. The code pushes arguments on to the stack, calls APIs, compares return values from the APIs and then returns one or zero. In most instance these simple functions do not need to be analyzed. By reading the API names most of the functionality can be…
While reading through the Windows Internals book I came across an interesting feature called AppLocker. AppLocker provides a robust experience for IT administrators through new rule creation tools and wizards. For example, IT administrators can automatically generate rules by using a test reference computer and then importing the rules into a production environment for widespread deployment. The…
''' Name: garts.py (Get all referenced text strings) Version: 1.0 Date: 2014/05/21 Author: alexander<dot>hanel<at>gmail<dot>com Description: garts.py is a simple string viewer for IDA. It will iterate through all known functions, look for possible string refercences and then print them. This is super helpful for dealing with strings in Delphi executables, finding missed strings, having the exact…
For anyone else who doesn't want to manually carve out single byte XOR encoded executables. C:\Documents and Settings\Administrator\Desktop\x>ex_pe_xor.py bad.bin * Encoded PE Found, Key 0x21, Offset 0x0 * exe found at offset 0x0 C:\Documents and Settings\Administrator\Desktop\x>dir 04/30/2014 08:36 PM <DIR> . 04/30/2014 08:36 PM <DIR> .. 04/30/2014 08:36 PM 24,576 1.exe <- carved 04/30/2014 05:44…
A couple of days while reading my RSS feeds I noticed an article entitled Daily analysis note: "Upatre" is back to SSL? on the Malware Must Die! blog. During their analysis they mentioned that they didn't solve the obfuscation. I had recently wrapped up an analysis of different obfuscation techniques that Upatre uses. So I thought I'd take a crack at it. After glancing at the sample for a couple…