Malware Development: System Calls

[@crr0ww]

📌 Use code "CROW10" for 10% off your order when you checkout at Maldev Academy or use this link: maldevacademy.com/?ref=crow Font: Terminess Nerd Font Mono Colourscheme: Zero (Dark Theme) I sincerely hope you enjoyed watching this installment of our ongoing malware development series. I know the kernel debugging portion was a bit rushed, and for that, I apologize. I had an entire segment dedicated to kernel debugging, the intricacies of MSRs as well as the incredible CPUID instruction, and all of that planned out for this video but as you could imagine, had I included that, the video would be a month-long. So instead, I'm working on a blog post that will take you into harrowing depths of that entire process, so make sure you look out for it here: www.crow.rip/ ERRATA: - I just realized after rewatching this that I was doing "CONST LPCSTR" when that's not necessary at all since LPCSTR is literally: "typedef const char* LPCSTR;" HAHAHAH LOSING MY MIND tysm for watching, nerds. luv u all terribly

[@C5pider]

Oh mom look i made it into a crow video.

[@mohammadalihanfi8237]

Yeah as expected 😅

[@crr0ww]

:blushing_emoji:

[@b3twiise853]

Ohh look it is spider

[@Dnsx_plus]

Aren’t you one of the contributors to Maldev Academy?

[@gato4920]

Have not even made it this far in the series, but I had to show support. Keep it up, we appreciate you.

[@crr0ww]

i really appreciate that! thank you so much

[@gamerkarir306]

omg you gave me a hart attack with the fear and hunger sound 1:25

[@crr0ww]

XDD

[@bamboooz3201]

I am a web developer, i don't understand anything, but i love these videos, keep it up!

[@crr0ww]

aw thank you

[@jaitjacob]

babe wake up crow just uploaded a new malware video

[@crr0ww]

WAKE BABE UP, WE HAVE MALWARE TO MAKE

[@user-ik4px2cu1l]

I literally just finished watching your Native API video and now you upload this, - literally GOD.

[@sxmourai6897]

I'm currently making an os and it's great to see the point of view of the userland people on the other side =) + I've learned some stuff, it's grealty explained, continue like that !

[@crr0ww]

thank you so much! :)

[@Babachick3n]

Literally the Dale Philip of the hacking world

[@Raxis]

Hell yes another crow video! Still need to go back and catch up on the previous vid but it's great seeing more stuff from you!

[@UnhandledErrorWasTaken]

Man!!! Finally a new video :D Didn't still watched it entirely but it's obviously gonna be fantastic. Ik doing this videos takes time and commitment but please do them more often ahah!

[@crr0ww]

thank you so much!! yeah it's a ton of work but your response(s) make all of the grey hairs super worth it :)

[@t32prod.98]

just came across your page by pure chance and watched your processes, handles, and threads video. headed over to your website and your statement in the faq section was very wholesome and encouraging. thank you for documenting your journey and having a positive outlook for newcomers :) deff earned my sub and a bookmark to your blog.

[@deleted_account-u3w]

Your videos are so good, my tiny brain can finally understand all this stuff. Keep it up!

[@4sakenGol3m]

Your LOCO❤😂 4:16 Love the content; keep up the incredible work!

[@phantompuma228]

NEW CROW VID?? LETS GOOO

[@crr0ww]

[@christian_leone]

Nice vid as always crow, thanks

[@crr0ww]

thank you so much! i'm really happy you liked it :)

[@tablettablete186]

This is why we need syscall kernel interception like we do in Linux with SECCOMP. Great video by the way!

[@jonas-ke4qz]

This editing is awesome

[@muha0644]

Man you gotta make more videos, you're the new liveoverflow but more funny and less serious.

[@crr0ww]

thank you so much for your comment; I really appreciate that! liveoverflow's the GOAT tho :')

[@muha0644]

@@crr0ww yeah, he is! But ever since he started using his face on camera his videos seem too "formal" or professional. More like John Hammond, but if he was German I guess...

[@MeharKlair]

He's finally back after his hibernation

[@QnF5EPuArXEX3bP]

I've just discovered your channel and OMG keep it up man, you're a GEMMMM

[@Negalijus370]

Inspiring next generation of Greybeards ⚡⚡

[@EnLopXf]

Yow the legend is back!!

[@rosehacksyoutube]

Quality! Your channel is going to blow up.

[@faanross]

He’s back!

[@crr0ww]

hey!! thank you so much for commenting, brother! i LOVE your videos as well, such a unique style! keep up the GREAT work, you'll get really far I can already tell

[@faanross]

@@crr0ww 🖤

[@zombieboyxx]

"If your prefrontal cortex misses a QuickTime event" 😂😂😂 you have to be the funniest cybersec youtuber

[@madezra64]

What's the music at 11:50? Starts a little earlier then that but Shazam as failing me cause it's copyright free music :(

[@VloggerMan-if9bt]

seeing him go from using vscode to neovim was better than watching my child grow up

[@azdirtnaper]

I love watching these even though I don't understand any of the shit that is going on lmaooo

[@11superjump]

this video taught me a lot, love it :)

[@crr0ww]

ah, great!! that means i've done my job haha thank you so much for commenting

[@HTWwpzIuqaObMt]

Welcome back ❤

[@crr0ww]

[@gwnbw]

27:54 lowkey flex, interesting vids!

[@vizzil1675]

I just finished my os class. Really love it haha

[@noorkhara1429]

HES BACKKKKK !!!!! 🎉🎉🎉🎉

[@crr0ww]

[@dadamnmayne]

Thank you. Prob going to watch this at least 100 times.

[@crr0ww]

i appreciate you, brother! thank you so so much

[@dadamnmayne]

@@crr0ww 19:01 that API hooking/unhooking video tho... 🙏

[@korsate]

YAYAYAYAYAYA MY GOAT UPLOADED

[@MeharKlair]

CROW SIR SIR CROW YESSSSSSSSSSSSSS

[@nobody-m6f]

what is the fond and IDE that you are using?

[@alec3217]

LESS FUCKING GOOOOOOOOO, new crow vid

[@crr0ww]

[@alec3217]

@crr0ww do you have a discord server or something similar?

[@gwnbw]

Hows your font so smooth looking though? mine looks crispy like extra sharpened

[@Beryesa.]

Operation Tux continues 😅

[@lime5233]

FINALLY A VIDEO

[@rz0007-k4c]

_

[@crr0ww]

HAHAHAHA LETS GOOOOO i wrote it down on some sticky notes so I don't forget it again :')

[@rz0007-k4c]

@@crr0ww 😂♥

[@stolfoch.]

mr crow i love you

[@dompurified]

mom, look! cr0w uploaded!

[@backinyourcommentsectionag3191]

CROW WHERE HAVE YOU BEEN I MISS YOU LOVE

[@honestsniping1]

Aren't all variables saved in the .TEXT section either way? Why did he manually added that code at 29:00?

[@nikhilt3755]

variables go into .data section. if we specify to allocate in .text section then contents of our variable can be executed because .text section is executable by default

[@honestsniping1]

Thanks for the reply. But if I define the shellcode variable inside main(), it will be located in .TEXT and not .DATA. And after your logic, it would mean that shellcodes defined in the global section of the program (not within main) cannot be executed. I'm probably missing something here...

[@ferverrel5519]

Used your promo for the maldev academy baby!

[@arnabthakuria2243]

Great vid as always. What font is that ?

[@nightlockhayze]

Crow why did you just ignore us and drop this new video asdjasdhakjdadasda ily always

[@czerwonejakmleko401]

does anyone know what font he uses?

[@meharklair3755]

CROW CROW CROW

[@meharklair3755]

i would like to inject my malware into crow :3

[@crr0ww]

BAHAHAHAHAHA

[@HelpersSoftware]

Awesome ❤ Thanks!What a theme name in visual studio bro?

[@vesmirnyjay]

touching everything

[@crr0ww]

😭

[@mnesicles.]

Sos un capo cuervito. Excelente contenido ✨

[@tracetv8115]

A video about antivirus intrusion would be nice.

[@Trikstarck]

Let’s GOOOOOO 🎉🎉🎉🎉🎉🎉

[@PlanetComputer]

thanks crow

[@crr0ww]

it's my pleasure

[@mohammedzaid6634]

Hey crow whats up man ✋

[@crr0ww]

hey!! how are you :P

[@ericytff7388]

MORE TUTORIALLS WE SHALL SEE

[@dneial.]

Can anyone link the equivalent of this but on Mac plz 🤗

[@gordonfreimann]

whats your font in vs?

[@mastergame1599]

+1

[@hiddengo3232]

how to modify exploit code

[@illumin8-r]

all your syscalls are belong to us

[@GHOST-qx6wi]

finally

[@brunom12111]

that's my goat right there

[@DaxSudo]

All of this just serves my point. The NT Kernel f***ing sucks balls.

[@hell0kitje]

MOB PSYCHO 100!

[@fodk7021]

What do you mean ?

[@hell0kitje]

@@fodk7021 its anime.

[@fodk7021]

@@hell0kitje yes but where is it in the video.

[@hell0kitje]

@@fodk7021 its in thumbail

[@fodk7021]

@@hell0kitje I thought it was midoriya from my hero academia

[@DM-qm5sc]

Imagine calling pantaloons trousers LuL

[@synrage]

finally bro

[@jacobjohnson1501]

heyyo you're alive ?

[@crr0ww]

YESSIR!!! :)

[@4sakenGol3m]

WTF 9:56 😂😂😂😂😂😂😂😂

[@raven-vr5yz]

yo man nice nickname

[@crr0ww]

thank you RAVEN, nice nickname as well, RAVEN :>

[@uh3906]

Lmao just thought about you yesterday

[@FictionHubZA]

Nice

[@lumikarhu]

a more in-depth video on indirect syscalls would be great, im not sure everything was covered, noob here. i can only cross check with the maldevs module. PS. i came with the power of thousand suns, you should get exclusive rights for maldev sponsoring, why watch boring jurassic park man when crow videos exist? lmfao please mr. d0x do this, the world will be a better place if crow becomes THE teacher. me not knowing C and low level programming well had some difficulties understanding the material but now so much has gotten clearer it's not even funny. ILY Crow

[@snapshot8886]

Bro!!!

[@nordgaren2358]

Lmao. Urien spotted.

[@marcelocabral389]

I'm not gonna lie, i didn't understand almost anything from the video, this "layer" of execution in assembly code and things written in hexadecimal gave me a headache, great video anyway!

[@SpYlE-]

bro.. iam from bangldesh ..plzz make more video

[@sinatra02]

a group of crows are called a murder... are we, as your fan base... murderers?

[@mongru]

ah yes here i am again

[@crr0ww]

and i'm so happy u are

[@lavender0666]

hot

[@Mika_565]

Thats cool but how do I get free robux

[@crr0ww]

YOU THINK I'M AT *THAT* LEVEL, MIKA? THAT'S TOO ADVANCED FOR ME!1:$!$:

[@cagdasisk7640]

ur the best

[@meharklair3755]

crow is so sexy

[@theexplosionist2019]

I don't understand what you're trying to achieve. You can't do "useful" functions such as virtualalloc or openprocess to modify processes' memory without admin access. Inline assembly works in VS2022 just fine. I was thinking rax is the GetProcAddress but its a special number. That makes using syscall even more pointless. unsigned long long count = 9; __asm { mov rax, 31H lea r10, count xor edx,edx xor r8d, r8d xor r9d, r9d sub rsp,40 syscall add rsp,40 } std::cout

[@lumikarhu]

psst hey kid, wanna buy some skooma?

[@Sp00ky__12]

cool ass dude

[@Bo_om2590]

do you have a job? what is it?

[@imahotdogdonteatme8722]

Holy shit! I thought yt assasinated him!

[@crr0ww]

THEY GOT REALLY *REALLY* close 😓 still have more videos to make, can't stop now :')