Reverse Engineering 101

https://malwareunicorn.org/workshops/re101.html
Admin
This workshop provides hands-on fundamentals of reversing engineering (RE) Windows malware, covering...
Tokens:13,359
Snippets:172
Trust Score:7.9
Update:7 months ago
Show doc for...
Tokens:
Raw
### Start inetsim Service on Sniffer VM

Source: https://malwareunicorn.org/workshops/re101.html/index

This snippet demonstrates how to check if the 'inetsim' service is running on the Sniffer VM and how to start it if it's not. It uses standard Linux commands to query process status and manage services.

```bash
ps -ef | grep inetsim
/etc/init.d/inetsim start
```

--------------------------------

### Analyze PE Binary File Header (HxD)

Source: https://malwareunicorn.org/workshops/re101.html/index

Examine the initial bytes of a file using a hex editor to identify its type. For PE (Portable Executable) files, the header typically starts with 'MZ'. This step helps confirm the file format before deeper analysis.

```hex
00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 d800 0000  ................
00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!.L.!Th
00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno
00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS
00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......
00000080: e34b 539a a72a 3dc9 a72a 3dc9 a72a 3dc9  .KS..*=..*=..*=
00000090: bcb7 a3c9 a62a 3dc9 bcb7 97c9 a12a 3dc9  .....*=......*=. 
```

--------------------------------

### x86 Assembly: Move Value to Register

Source: https://malwareunicorn.org/workshops/re101.html/index_0

This example demonstrates a common x86 assembly instruction 'mov' which is used for data movement. It shows how to move a value from a memory address (0xaaaaaaaa) into the 'ecx' register. The corresponding opcode is also provided.

```assembly
mov ecx,[0xaaaaaaaa]; 		8B 0D AA AA AA AA
```

--------------------------------

### Filter Procmon Events for Specific Process

Source: https://malwareunicorn.org/workshops/re101.html/index

Apply filters within Procmon to isolate events related to a specific executable, like 'Unknown.exe'. This narrows down the analysis to focus on the behavior of the target malware, for example, by filtering for 'CreateFile' operations.

```text
[Process Name] [is] [Unknown.exe]
[Operation] [is] [CreateFile]
```

--------------------------------

### Assembly: Buffer Comparison for Specific Bytes

Source: https://malwareunicorn.org/workshops/re101.html/index

This assembly code performs a series of byte comparisons against a buffer starting at `[ebp-104h]`. It checks if the bytes match the sequence `6Ch, 6Dh, 61h, 6Fh`. If any comparison fails, control jumps to `loc_4012E6`.

```assembly
.text:00401176                 call    sub_401000
.text:0040117B                 cmp     byte ptr [ebp-104h], 6Ch
.text:00401182                 jnz     loc_4012E6
.text:00401188                 cmp     byte ptr [ebp-103h], 6Dh
.text:0040118F                 jnz     loc_4012E6
.text:00401195                 cmp     byte ptr [ebp-102h], 61h
.text:0040119C                 jnz     loc_4012E6
.text:004011A2                 cmp     byte ptr [ebp-101h], 6Fh
.text:004011A9                 jnz     loc_4012E6
.text:004011AF                 mov     edi, ds:LoadIconA
```

--------------------------------

### Analyze CreateFileA API Call in C and Assembly

Source: https://malwareunicorn.org/workshops/re101.html/index

This snippet shows the C prototype for the `CreateFileA` function and its corresponding assembly implementation. It highlights how arguments, including file names and access modes, are pushed onto the stack before the API call. Understanding these arguments is key to determining file operations.

```c
HANDLE CreateFileA(
LPCSTR                lpFileName, // Arg1
DWORD                 dwDesiredAccess, // Arg2
DWORD                 dwShareMode, //Arg3
LPSECURITY_ATTRIBUTES lpSecurityAttributes, //Arg4
DWORD                 dwCreationDisposition, //Arg5
DWORD                 dwFlagsAndAttributes, //Arg6
HANDLE                hTemplateFile //Arg7
);
```

```assembly
.text:004010B8                 push    0               ; Arg7 hTemplateFile
.text:004010BA                 push    80h             ; Arg6
.text:004010BF                 push    2               ; Arg5
.text:004010C1                 push    0               ; Arg4
.text:004010C3                 push    0               ; Arg3 dwShareMode
.text:004010C5                 push    40000000h       ; Arg2 dwDesiredAccess
.text:004010CA                 push    esi             ; Arg1 lpFileName
.text:004010CB                 call    ds:CreateFileA
```

--------------------------------

### Analyze CreateFileA API Call in IDA Pro

Source: https://malwareunicorn.org/workshops/re101.html/index_0

Demonstrates how to analyze the arguments passed to the CreateFileA function in assembly. The string for the file name (e.g., 'stage2.exe') is often concatenated before being passed as the first argument. Understanding argument pushing order is crucial.

```assembly
.text:004010B8                 push    0               ; Arg7 hTemplateFile
.text:004010BA                 push    80h             ; Arg6
.text:004010BF                 push    2               ; Arg5
.text:004010C1                 push    0               ; Arg4
.text:004010C3                 push    0               ; Arg3 dwShareMode
.text:004010C5                 push    40000000h       ; Arg2 dwDesiredAccess
.text:004010CA                 push    esi             ; Arg1 lpFileName
.text:004010CB                 call    ds:CreateFileA
```

--------------------------------

### Monitor Process and File System Activity (Procmon)

Source: https://malwareunicorn.org/workshops/re101.html/index

Utilize Procmon on the Victim VM to observe real-time file system, registry, and process activity. This helps identify actions performed by the malware, such as file creation, modification, or process execution.

```powershell
procmon.exe
```

--------------------------------

### Assembly: Buffer Initialization and Function Call

Source: https://malwareunicorn.org/workshops/re101.html/index

This assembly snippet demonstrates the initialization of a buffer at `[ebp-104h]` to zero and its subsequent passing as an argument to the function `sub_401000`. It also shows a comparison of the first byte of the buffer against the hexadecimal value 6Ch.

```assembly
.text:00401169                 lea     edi, [ebp-104h]
.text:0040116F                 mov     byte ptr [ebp-104h], 0
.text:00401176                 call    sub_401000
.text:0040117B                 cmp     byte ptr [ebp-104h], 6Ch
```

--------------------------------

### Assembly: InternetReadFile Function Call

Source: https://malwareunicorn.org/workshops/re101.html/index

This assembly code shows the arguments being pushed onto the stack before calling the `InternetReadFile` function (aliased as `ebx`). The arguments include a buffer (`edi`), the number of bytes to read (`0FEh`), and a file handle (`esi`).

```assembly
.text:00401104                 push    eax             ; lpdwNumberOfBytesRead
.text:00401105                 push    0FEh            ; dwNumberOfBytesToRead
.text:0040110A                 push    edi             ; lpBuffer
.text:0040110B                 push    esi             ; hFile
.text:0040110C                 mov     [ebp+dwNumberOfBytesRead], 0
.text:00401116                 call    ebx ; InternetReadFile
```

--------------------------------

### C Function Signature for CreateFileA

Source: https://malwareunicorn.org/workshops/re101.html/index_0

Provides the C function signature for CreateFileA, a Windows API function used to create or open files. This helps in understanding the parameters and their order when analyzing the assembly calls.

```c
HANDLE CreateFileA(
LPCSTR                lpFileName, // Arg1
DWORD                 dwDesiredAccess, // Arg2
DWORD                 dwShareMode, //Arg3
LPSECURITY_ATTRIBUTES lpSecurityAttributes, //Arg4
DWORD                 dwCreationDisposition, //Arg5
DWORD                 dwFlagsAndAttributes, //Arg6
HANDLE                hTemplateFile //Arg7
);
```

--------------------------------

### Mount Shared Folder on Sniffer VM

Source: https://malwareunicorn.org/workshops/re101.html/index

This command mounts a shared folder named 'sniffershare' from the host machine to the Sniffer VM. It uses the VirtualBox filesystem driver ('vboxsf') and ensures the mounted folder is accessible within the VM's filesystem.

```bash
mkdir ~/host; sudo mount -t vboxsf -o uid=$UID,gid=$(id -g) sniffershare ~/host
```

--------------------------------

### Capture Network Traffic with Wireshark

Source: https://malwareunicorn.org/workshops/re101.html/index

Monitor network activity on the Sniffer VM using Wireshark. This tool captures all packets traversing the network interface, allowing analysis of communication patterns, protocols, and data exchanged by the malware.

```bash
sudo wireshark
```

--------------------------------

### Test Network Connectivity to Sniffer VM

Source: https://malwareunicorn.org/workshops/re101.html/index

This command is used on the Victim VM to test network connectivity to the Sniffer VM by sending ICMP echo requests. It verifies that the network settings and routing are correctly configured between the two virtual machines.

```bash
ping 10.10.10.112
```

--------------------------------

### Pseudocode: Buffer Check Logic

Source: https://malwareunicorn.org/workshops/re101.html/index

This pseudocode represents the logic of the buffer comparison checks shown in the assembly snippet. It sequentially compares the first four bytes of a buffer against the hexadecimal values 6C, 6D, 61, and 6F. If any byte does not match, the program branches to an exit point.

```pseudocode
if (buffer[0] != 6C) goto Exit
if (buffer[1] != 6D) goto Exit
if (buffer[2] != 61) goto Exit
if (buffer[3] != 6F) goto Exit
```

--------------------------------

### Deobfuscate Stack Strings in Assembly

Source: https://malwareunicorn.org/workshops/re101.html/index

Malware authors often hide strings by pushing them onto the stack character by character. This snippet demonstrates how to reverse this process by converting little-endian hexadecimal values back into readable ASCII strings. This is crucial for uncovering hidden commands or indicators.

```assembly
.text:004010B0                 push    offset aStage2_exe ; "stage2.exe"
.text:004010B5                 push    esi             ; lpString1
.text:004010B6                 call    edi ; lstrcatA
```

--------------------------------

### Follow TCP Stream in Wireshark

Source: https://malwareunicorn.org/workshops/re101.html/index

After identifying relevant network traffic in Wireshark, use the 'Follow TCP Stream' feature to reconstruct and view the complete data exchanged during a specific TCP connection. This is useful for examining HTTP requests or other application-level protocols.

```text
Right click -> Follow -> TCP Stream
```

--------------------------------

### x86 Assembly: Move Value to Register

Source: https://malwareunicorn.org/workshops/re101.html/index

This x86 assembly instruction demonstrates moving a 32-bit value from a memory address to the ECX register. The opcode '8B 0D' signifies a move operation from a memory operand, followed by the memory address in little-endian format.

```assembly
mov ecx,[0xaaaaaaaa]
; Opcode: 8B 0D AA AA AA AA
```
Tokens:
Raw