sam. 16 avril 2016

Breaking Cerber strings obfuscation with Python and radare2

Finally after almost two years of inactivity, I finally motivated myself and decided a new article on this blog ! In this article, I'll show how to use radare2 and especially its Python bindings to write a little tool able to decode a large part of Cerber ransomware encrypted strings, thanks …

Category: Reverse-engineering - Tags: Malware Ransomware Cerber
mer. 11 décembre 2013

Hiding code in ELF binary

Since I'm contributing to the radare2, I'm learning on how a disassembler works, and especially how ELF files are handled by disassemblers. I saw that almost (even every ?) disassemblers rely on ELF section headers (generally located at the end of the file), which has never used in reality (by Linux kernel or glibc) because ELF's mapping in memory is given by program header (another ELF structure, which I described in my article about ELF packer

So, we can easily hide code from disassemblers by manipulating virtual address fields of the ".text" section structure. I'll use an hexadecimal editor and the latest git revision of radare2 (which fixes a bug related to virtual address calculation in ELF binary), so I recommend you to have those tools installed of your computer to continue the reading of this article.

Category: Hacking - Tags: radare2 C ELF
ven. 17 mai 2013

Making ELF packer for fun and chocapicz (part 2)

As promised, here is the second article about my ELF packer.
Here, I'll talk about dynamically-linked ELF (i.e. which has dependencies to ".so" modules), which is more tricky than the "basic" packer I showed before. The code is still NASM, and still under 32bit (feel free to rewrite the code to support 64-bit architecture ;))

Category: Hacking - Tags: Packer ELF C assembler
mar. 07 mai 2013

Making ELF packer for fun and chocapicz

I recently decided to make an ELF packer, in order to learn some cool stuff about Linux kernel and ELF format, so I'll write 2 or 3 articles in this blog to explain some stuff I discovered. To write this article, I use NASM and a x86 linux kernel (yeah guys, I'm still on a x86 archlinux). But before, let's listen to some music

Category: Hacking - Tags: Packer ELF C assembler
sam. 23 mars 2013

Andromeda 2.07 analysis

Hi folks !
As it's spring (and I've not written something for a while), malwares get updated, and this is also the case for Andromeda which got an update. I know I already wrote something about previous version, but this version has some fun tricks, so let's reverse it to see these tricks :)

Category: Reverse-engineering - Tags: Malware Andromeda

« Page 2 / 6 »