Analysing a Collection of Windows Binaries and Embedded Resources - FLARE-On 2018

In this video we look at another FLARE-On 2018 challenge. This one is weird as we have to somehow automate the analysis of a big collection of binaries. We also learn something about embedded resources.
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#ReverseEngineering #CTF

[@ericsarason9099]

I understood 5% of this, I think I'm learning :D

[@Napert]

Me while watching your videos - i can totally do that myself, so if i do x and y to a thing i can cause it to run z code! Me actually trying to do this - where do i start? wtf am i even supposed to do?

[@hizbullahmohammed5044]

Napert360ggTGpl yeah... exactly... Its seems very easy when watching his videos.. 😅

[@jean-naymar602]

Practice makes perfect :)

[@wildwest1832]

yeah honestly this guy and some other hackers are better programmers than some professional ones. This guy is pretty good at figuring things out and his understanding of low level code. Looks easy but its not. Takes a lot of time and a natural ability to a degree.

[@soopyc]

Yea same

[@shadowvc8159]

I used a resource extractor that can extract all the resources from all the executables in a given folder and just tied the pictures together. You had a nice way to solve the challenge!

[@bibliophile5863]

Everyone misses different things! I didn't realize the binary created files until I had extracted all passwords and played around with them for a few hours.... I got all the passwords using the method you realized afterwards :)

[@nikitpad3532]

only found this channel about 2 days ago and I'm pretty damn impressed by the quality of your videos and your knowledge. I've learned quite a lot already, and I like the way you explain things. keep it up!

[@BertAframion]

Verstehe nur die Hälfte finde es aber super faszinierend! Mach bitte auf jeden Fall weiter so! Und danke für jedes einzelne Video :)

[@willmero4627]

Love these videos LiveOverflow. Amazing to see how you work, wishing I could infer the strategies you do when you approach these problems. Maybe if I keep watching these videos, I will catch on ;)

[@lacno29]

As always, quality content. You introduce all disassembler and their pros and cons. Good job with that.

[@olivert.7192]

this whole video was so over my head. I'm so bad at reversing!! great video, keep it up

[@Jellyg00se]

Man just flat out thumbs up, love the vids, keep it up.

[@horschtiboy]

Mega gute Videos, mega interessant und gut gemacht! Bitte (viel) mehr davon :)

[@gaborszivos507]

actually strings can find 16bit strings as well. You just have to set the `-e` flag for the encoding (l for 16-bit little endian). At least on linux, idk how it works on mac

[@almightyhydra]

What would be the Lego model output of following the Lego instructions? :-)

[@tae6175]

Asking the real thing here! :D

[@pmqtpqbtmz3956]

idk wtf just happened, but it was awesome! Can't wait to learn more CS

[@rishi905]

Upload some tutorial relating IDA and debugging

[@prakashyadav008]

yes, I am on my journey into the world of reverse engineering and i know radare2 but not IDA. what resources did u use to learn IDA..?

[@zCri]

yey another video

[@melkileo]

What a very good video!

[@sebastianelytron8450]

New LiveOverflow video. Time to shut off the outside world and turn on my brain.🤓

[@root317]

New vid! Yeyyy

[@dstensnes]

Also, here is a neat trick for you to help you out with the "strings" command in linux. Just pipe it through "tr -d '\0'" before piping to "strings", like so: cat somefile.exe | tr -d '\0' | strings It strips out null characters, which most of the 16-bit characters tend to be when encoding ascii anyways, so strings will not see them. Just be aware that the offsets will be way off!

[@dcnick3]

...or just use strings -b l

[@d74g0n]

great vid.

[@maelchouteau3712]

At 9:38 I don't understand how 33104 is equal to 8150h. I'm juste beginning 😁. Very nice videos continue like this men, you're the one!!!

[@LiveOverflow]

0x8150 is a hex number and that's 33104 in decimal system :)

[@srikarraoayilneni7074]

What is the best thing (binary debugging and analysis software)to reverse exe

[@balika011]

Pro version has the same string issues and more. But a quick edit in the config fixes them.

[@eugen189763987689379]

holy awesomeness!

[@signumxmagnum]

It was worth it to subscribe to your channel

[@cunningham.s_law]

so much tools to learn

[@P-G-77]

wow fantastic.

[@borhangherbi8189]

your the best

[@blackbeard4532]

Do some crypto ctfs please

[@Donder1337]

Nice!

[@nion456789]

Smashed the like

[@TurboZarya]

I’m planning on going into computer science, but while this video was pretty interesting, all of this is *_very_* intimidating to me.

[@i_am_ur_manager7673]

IDA Best tool for reverse engineering for m'y part !😀

[@mikoajpisula6756]

Cool bro

[@fndcrewmaster]

Well at least i know this is one of many way for hacker/programmer to level up their skill... amazing :)

[@zeejay09]

You're videos interests me, I am interested to learn.

[@Ynoxxx]

Great insight! Ok a question : this 12 min long quick recap video - how long did this take to reverse engineer and figure out in real time please? :-) Just to have an idea

[@31redorange08]

Probably a few hours.

[@byrondelacruz9932]

Any website suggestions to learn more about cs?

[@hakimESC]

You lost me at unziping the rss and got back when there were images of lego... all the stuff between is a noice :-| :-D

[@engineeringsolutions9585]

Any help for 2019 challenge 2 ? I need some help

[@itsvollx9684]

what programs do you use for reverseEnigering?

[@LawZist]

Can you do a tutorial for absoulote begginers ? love your vids :)

[@amirroohi4566]

Which MacBook do you use? Thanks

[@MegaCyberpirate]

Hello sir.. May you suggest me some good ctf challenges site..

[@LoukaJC]

Did you know that 'strings' have options ? :p $ man strings --encoding=encoding Select the character encoding of the strings that are to be found. Possible values for encoding are: s = single-7-bit-byte characters (ASCII, ISO 8859, etc., default), S = single-8-bit-byte characters, b = 16-bit bigendian, l = 16-bit littleendian, B = 32-bit bigendian, L = 32-bit littleendian. Useful for finding wide character strings. (l and b apply to, for example, Unicode UTF-16/UCS-2 encodings). I have not tested it for your PE, but I'm pretty sure that it would find them too. I used to have an alias that extracts all strings with all kind of encoding, takes unique ones and sort them by length. That was efficient af ! Anyway, good video as usual, keep it up !

[@AlboCoder]

To take automation to the next level you could crop 100x100 top-left corner->pass it to tesseract ->get the order->reorder the flag string. And grab a coffee while this runs haha. :)

[@renhoeknl]

Is there still a way to download the challenges, so we can try it when we missed out on the event?

[@Spiralem]

it should be on fireeye website

[@archie9500]

At 11 I watched NFS Secrets. Now I watch this.

[@CodePhiles]

how you have 174 K subscribers only !!!!!!!!!!!

[@peyastig6371]

What books did you read to gain all of these knowledge? Or really nothing particular just a mix of many things?

[@LiveOverflow]

I have a video about that :) the secret step by step guide to learn hacking

[@henrywang8638]

interesting... i ended up just patching the binaries so that it would print out the password because i couldn't seem to find the string resource of the password.. hehe

[@thepointlessvideo100]

Mind = blown. Awesome video though.

[@mikoajpisula6756]

Wrong bro. mind==blown 👌

[@Sejiko]

do you know that u can use ubuntu shell in windows 10? It would be really cool to see what ou can do with it.

[@mikoajpisula6756]

What do you mean by this?

[@crazylegs85]

@@mikoajpisula6756 Windows Subsystem for Linux (WSL). There are actually more distributions available. Even Kali. All are command line based though. I'm not sure how useful it would be based on how everything is wired under the hood. Had to go look for this vid: kzbin.info/www/bejne/kJqTlqKcpqaejrc

[@_nikeee]

Bist du auf dem Congress?

[@MrRRongen]

The strings command does support different file and string types (at least the GNU Binutils version). For x86-64 pe's: strings -dT pe-x86-64 -e l 1BpnGjHOT7h5vvZsV4vISSb60Xj3pX5G.exe for example

[@tadho]

Mind to make a video about hacking game's save file? Been trying to do that for quite a while, having a dead end for now. Need something inspiring 😂

[@imcensored5004]

How to do all of this thing on win 10

[@kirdow]

Just curious, aren't the executable filenames in Base64, would decoding this give anything of usefulness or is it just garbage made to mislead?

[@levisaxos7335]

I find this really interesting and however I could follow the previous two tasks of flare-on .. you totally lost me on this one :-p

[@ShalvinKumar7]

I feel the same way! :)

[@ianbryant]

I love you

[@MilMike]

I am a software dev who lost the source code to one of my programs.. I need to decompile my keygen so I can implement it in my online shop (because what I do now: customer orders, I get email.. I copy/paste his name to get the key for him).. this is tedious, I want to automate it... the keygen was written in VB6, I already tried IDA and some VB6 decompilers but all I get is some assembler code which I don't understand -.- I mean it doesn't really show me the algorithm I used for the key.. which was ~15y ago.

[@MattZelda]

vbreformer.soft112.com Try this. Or just create a new keygen... VB6 is ass.

[@mikoajpisula6756]

Sorry but does someone know the music title?

[@houba1263]

Hey my friend plz i want to learn from 0 hacking and cybersecurity what do u suggest to begin with and what should i learn first plz i hope u answer me

[@Ghost-gj1bx]

I think you should learn proper spelling and grammar.

[@houba1263]

@@Ghost-gj1bx my english is fine actually even though it's not my first language

[@Ghost-gj1bx]

@@houba1263 Sorry, It was early in the morning and I was already annoyed at an earlier event.

[@laxmanadhikari3989]

I am trying to crack old software which only opens when USB is plugged anyone have an idea how to i am tired its seems it staking forever it's really important for me as I am trying to recreate it.

[@pineapplepie4929]

Can you hack a website(/something) using apple shortcuts?

[@kipchickensout]

you used Rabin? And there's a batman reference? no wonder

[@ohboh]

That's from a scene from the LEGO Movie lol

[@natedavis3943]

I dub thee #Code Ninja

[@beratmlb]

👍👍👍👍👍👍

[@user-cx5jj3zq1r]

Great analysis :) btw, don't try to hard for some binary if it's have done, u r too far away

[@LiEnby]

you know ida is also a debugger?

[@brahimaso7205]

what i should to learn to be like him ,please i need some help

[@jimothyus]

brahim aso he has a video on it. How to become a hacker or something like that. Search for it

[@altaccount648]

And that's why.. you do things twice.

[@arcticspacefox864]

Du kannst auch Cutter eine GUI für radare2 verwenden. Macht es sehr viel einfacher! :)

[@Alex-qt9om]

Hi

[@prakashyadav008]

and this video was confusing

[@darkhunter3232]

liFeoverflow 🤔

[@sebastianelytron8450]

😂

[@SmashedHatProject]

it's better to go too far than not far enough

[@MehediHasan-ex7dy]

Why do I have to learn this? Can someone tell me?

[@nothappyz]

You don't have to, if you don't want lol

[@bongani2269]

1st

[@proxy1035]

only thing i can complain about is the fact that the word "legos" doesn't exist.

[@Android480]

Jesus I'm so dumb. I sit here thinking I can code and I come across this madness. What the fuck dude.

[@marcoschincaglia]

Like, then watch

[@tae6175]

and understand like 1%.

[@Davimejor]

Why u are so hacker? Hahaha

[@askhowiknow5527]

Strings with a null character between each character? Wow Windows is even dumb and wasteful down on the binary level.

[@dcnick3]

No, it's not. It's using UCS-2 encoding, where each character uses 2 bytes. And the second byte would be zero only for English letters, but would be used for national alphabets. Also, unlike UTF-8 used in Linux, it gives you O(1) indexing and easier string handling. Actually, even standard C library has functions to work with these strings and they are available on Linux too. So this thing has not been done thoughtlessly, it has some advantages too.

[@arthurvanderwal]

How many millennials watched this and didn't understand it from 0:01 lol