LODSB
If you've been reversing x86/x64 for a while then you will have definitely come across functions that end like this: We know two things here: The RET/RETN opcode in x86/x64 pops the stack and jumps to that address The PUSH before the return here i...
I was really really excited when Open Obfuscator was launched. I've enjoyed the challenges that application obfuscation have given us over the years, and it was fun to find a well documented and open source obfuscator that we could play with and try ...
If you've been reversing for a while then eventually you'll come up against a control flow graph that looks like this: This is a simple toy app hosted at https://github.com/samrussell/cff_playground if you feel like following along at home. The plug...
I've been modding some games on Steam recently, and some of them make use of the Steamworks product to add an extra layer of security, as well as adding other features such as the overlay and cloud saves. This isn't an article on how Steam DRM and St...
I've started looking into the Adylkuzz malware, as mentioned by Tim Blazytko in his article on Automated Detection of Obfuscated Code. Initial analysis shows a TLS entry handler that dumps us straight into a VMProtect VMEnter() function, that looks l...
Hashing function names slows down reversers It's common for packed and otherwise obfuscated binaries to effectively user their own shellcode to populate the imports that they plan to use. This does two things: It hides imports from the reverser that...
Carrying on from the previous article, we can take the first of the tigress challenges and finesse it so the VM parser shows up nicely as a big switch/case statement and we can unpick what all the VM handlers do. The next step is to translate the VM ...
I've recently started reversing some of the Tigress obfuscator challenges, and I decided to use this to test out some of the functionality in Binary Ninja. One of the keys to reversing a virtualization obfuscator is identifying the control loop where...
I've recently been looking into NtSetContextThread as an exploit vector, and was looking at different ways of setting up state to load some code into our target thread and then execute it. The idea of ghost writing is pretty fun, but I wanted a way ...
I recently came across a neat technique for process injection called NINA that uses NtSetContextThread to modify registers in a thread inside another process and does your dirty work without having to directly modify foreign memory on your own. Vario...
After my recent work on extracting the SSDT from kernels without a debugger I synced this up with the symbols from the freely-available PDBs and ran a diff between the 20H2 kernel and the latest build (22523) and here's what we see: Syscalls removed:...
For any developers wanting to make their apps hard to hook and analyze, making direct syscalls to the kernel is a useful approach to look into. There are countless resources for making this happen, from j00ru's work building a full table, to the lib...
One common anti-debugging technique is to make use of the Windows API to simply mark your threads as invisible to the debugger. This isn't officially documented by Microsoft but it has been quite robust across windows versions. The documentation for ...
This is one I've been working on for a while, and most of the ideas here come from Rolf Rolles, so I'd encourage you to read through his article series on this and other virtualization obfuscators. I'm not going to go into details of how VMProtect ...
I've found it hard to find a source for these in one place so I've put some code together to calculate these for me. You can find the code I used to generate these results here: https://github.com/samrussell/TestFlags Intro This is all based off http...
Here we find 4 functions: LDIV, LUDIV, LMOD, and LUMOD, and the standard variations: N_LDIV@, F_LDIV@, N_LUDIV@, F_LUDIV@, N_LMOD@, F_LMOD@, N_LUMOD@, F_LUMOD@ Like with PADD and PSUB we find multiple entrypoints to the same function: We see the s...
These two are both intertwined so it makes sense to analyse them together: We can see a few variations on names at the top here: N_PADD@ and F_PADD@ for PADD, and N_PSUB@ and F_PSUB@ respectively. The prolog for the near versions is the same; it pop...
After recently reversing the unpacker for Commander Keen, I moved on to reversing the game itself. One thing that shows up when reversing is the functions that get inserted by the compiler of the day. Old DOS games such as Commander Keen end up with ...
I've been in a bit of a rut with reversing recently and I thought I'd go back to something that I reversed years ago, has a little bit of complexity, but is easy enough that I can focus on extracting one part at a time and getting something turned ar...
Demo code for this article: https://github.com/samrussell/tritondemos/blob/main/tritonbasic2.py In my previous post, we looked at a basic intro to binary analysis with Triton. In short, it allows us to take something like this: push ebp mov ebp, esp ...