Malware Development: Native API

[@crr0ww]

📌 Use code "CROW10" for 10% off your order when you checkout at Maldev Academy FOR A LIMITED TIME! ---> maldevacademy.com/?ref=crow Font: DinaRemasterII Theme: Zero (Dark Theme)

[@CaptainLeviOfTheScoutRegiment]

I can't find the theme, could you give me the link for it

[@drishalballaney]

if possible could you please also cover these videos in rust?

[@TheCalinative707]

this man is the best teacher I've ever seen, strictly on his use of comedy and 4th wall breaks, while being detailed and informative

[@crr0ww]

i appreciate that so much! thank you :')

[@malcomclark2261]

I thought I was crazy for thinking that too. Something about the way he explains things just works for my mush-brain.

[@nero2k619]

Best part of using native APIs in usermode is the things you can do that you would never be able to achieve with using just win APIs. Of course native APIs add a lot more code but the amount of flexibility and control you can achieve is just pure gold.

[@crr0ww]

agreed! it's also just a lot of fun to see how everything comes together! thank you so much for commenting!

[@0x370c2de]

This man is one of a kind. Seriously, so informative, but keeping it fun and cool! So much love, looking forward for the next episode ❤

[@crr0ww]

thank you so much! that's so kind of you

[@JohnDoe-cx6zd]

Man, I literally have been watching your buffer overflow video right now, and just noticed an upload! What a timing

[@phantompuma228]

LETS GOOO HES BACK, I HOPE YOU GET SOME REST CROW!!! I SEE THE EFFORT!! THANKS FOR ALWAYS PUTTING OUT LEGIT CONTENT!!

[@crr0ww]

ILY LEGEND

[@Brahvim]

It was 1 AM and yet I clicked. Was not disappointed, and *genuinely* enjoyed the jokes, and knowledge shared (thanks to knowing the non-WinAPI parts in advance, I guess!). Thank you, crow!

[@crr0ww]

it's my pleasure! thank you so much for commenting

[@upliftingspirit6873]

saw your videos yesterday and all i have to say is ... please never stop doing what you are doing. you are really talented and good at explaining. i really like that your teaching method is not possessed by elitism which as you said (and i agree) is one of the biggest problems in this field. you never take anything for granted and you are willing to explain even the slightest thing to your "students". subscribed, of course :)

[@ttj_]

as soon as i saw you posted a new video i got so excited, you’re my favourite youtuber. malware development is so fascinating when coming from a software dev background

[@sinatra02]

thought i was losing it seeing a crow notification

[@piyayozeo]

I thank the universe for putting your video on my feed, it was so well explained and you kept my attention at all times with the memes and jokes. Thank you Crow!

[@ikennamanagwu9646]

Wooooooowww..... Maldev academy is literally what I've been looking for for years ..!!!!

[@pspnerd45]

That coding montage at 4:30 is so smooth. Could have that playing in the background while I work/study.

[@ai_coding]

I swear ur the best teacher out there!! Glad i stumbled upon ur channel even tho im not into malware dev im learning a lot.

[@urxai]

don’t care who says what this man needs and 100k play button

[@vittoriomondelli7172]

bro this is actually so much enternaining thanks for your work boss

[@Proferk]

yay, our beloved malware man crow is back

[@justin7oo994]

Oh wow look my favourite bird is back

[@mrpoodoboo6785]

awesome video, thanks for addressing the goto statement, immediately started having flashbacks to uni...

[@안꾸-z2g]

I've been waiting for your new teaching

[@fxiqval]

i actually found out a weird thing with object_attributes. the length member is optional on some functions, but required on others. but the interesting thing with that is with e.g. NtOpenProcess the lengh can be 0, but the actual pointer to the object attributes can't be nullptr/NULL/0, otherwise the function will fail.

[@omfg4956]

BABE WAKE UP NEW CROW DROPPED

[@p3tergriffin]

Recently discovered your channel and the content is great. Thanks man.

[@crr0ww]

thank you so much!

[@SZTUKAHARDKORU]

nice channel, will watch all today

[@christian_leone]

I love you crow, your videos are really simple but interesting, thanks so much!!!

[@crr0ww]

aw thank you so much, that's so heartwarming to hear

[@sy-tv3ic]

i hope bro keeps getting butterflies after referring to past videos. goatttt

[@backinyourcommentsectionag3191]

HE HAS RETURNED ALL HAIL ALL HAIL

[@PandaGoesMoo]

return of the -king- crow

[@0dayhta]

YES ANOTHER CROW VIDEO!!!

[@trintlermint]

I LOVE YOU CROW!! hope youre doing well!

[@crr0ww]

ILYT THANK YOU TRINTLER, SAME TO YOU HOMIE

[@gregandark8571]

@@crr0ww I was and i'm always wondering - why theres 0 content like this for linux?

[@crr0ww]

@@gregandark8571 well, windows is the most popular platform that people use, so it's natural that most malware is made for it! that isn't to say that there isn't malware for linux, there's a lot out there too (some really really cool techniques as well!) dont worry, i have something planned for linux-based malware development too :) all in due time. thank you so much for commenting!

[@gregandark8571]

@@crr0ww Awesome!

[@jbray250]

I'm trying to play mapleatory with Crow. Also this was so dope

[@DroneMothership]

Yo this is like spooky Christmas

[@Bl45ty]

In love with crow's humour

[@gersonsv12]

idk when I'll have time to try this but it looks fun af

[@phobosmoon4643]

im not sure if shitposting has finally caught up to my refined, god-like tastes and humor, or if I have just been too stupid to hang with the cool kids this whole time? either way: ooh la la.

[@crr0ww]

HAHAHA i'm glad to hear that xD thank you so much for commenting

[@nikos4677]

10:54 Damn I remember reading that from that book

[@detective5253]

ayyee, crow's back to the crew w/ anotha motha video bout maldev series. love ya homie

[@alyxson]

i love your visual identity

[@sinatra02]

HES ALIVEEE

[@crr0ww]

IM ALIVEEEE

[@lysikasaito]

Awesome video!!! What font are you using? It's great (the pixel art font, not iosevka)

[@crr0ww]

thank you so much!! :D it's called "DinaRemasterII"

[@piolix0004]

THE KING IS BACK

[@X_explotion]

Especially you, slouching in your chair. I feel personally attacked

[@curryjl1027]

Another fantastic video, keep it up, legend

[@cjsmax75]

Hi, thanks for the video. for the Object_attributes, the doc says "For standard processes, all fields of ObjectAttributes should be NULL", how can we know that we'll need the size of the struct and not just follow the doc ? Thanks!

[@slamdude321]

wow so informative crow i love you

[@crr0ww]

THANK YOU SM LOVE

[@crckrbrrs]

>disappears for a month >uploads maldev 2, apologizes for not being active >continues to not be active >drops this absolute masterpiece 2 months later, talks on discord for a bit, leaves never change

[@sinatra02]

LMAOOO

[@aa898246]

amazing video

[@Snydzzz]

How do you generate the shellcode for starting the calculator?

[@crr0ww]

well, you could make your own shellcode (which is recommended, but for beginners might be too difficult at first) or you could use a shellcode-generating tool, the most popular of which is called "msfvenom". although, be warned that msfvenom has been heavily scrutinized and documented so pretty much all of its shellcode will get caught by windows defender. now, you could get past this by encrypting the shellcode, or for this example, since we're not doing anything malicious, you can set an exclusion path for windows defender so that your program can run and not get thanos snapped out of existence. hope that helps

[@Snydzzz]

@@crr0ww could I make an exe that starts calculator with system(“calculator.exe”) then try to get the bytes from a disassembler? Btw, I got into this with game hacking stuff like assault cube and your channel now has gotten me into the more general area of malware. I like how you present the information in an entertaining way instead of speed running code with subtitles. Really makes it enjoyable 👍🏼.

[@ismailaf3634]

Finally let's goo

[@peppidesu]

13:44 jyuugatsu 👀

[@crr0ww]

はい！そうですね～ peppiさんの日本語本当に上手ですね。：）コメントありがとうございます！

[@icarlyfan102]

already know its a banger

[@jacobjohnson1501]

YOU GOT A SPONSOR

[@crr0ww]

!!!!!!!!!

[@inn6300]

Crow10 crow10 crow10 !

[@YAHWA-fb7ww]

Best recourse ever !!

[@Trad3st0rm]

Sick new intro mate

[@crr0ww]

thank you so much!

[@sparky1377]

What visual studio theme is that?

[@-uz]

DROP another Banger please 🤝

[@Redyf]

What font is that on vscode? it's pretty cool

[@zvqle]

great video, loved it very much. please do more!

[@brunom12111]

Bro, I absolutely love your content! My book recommendation for anyone trying to understand more about this topic is: Windows Internals by Pavel Yosifovich

[@cadeathtv]

How true is the legendary, "Do not upload to VT"?

[@crr0ww]

if it's something you care about (i.e., you don't want to get signatured, taken apart, and analyzed), then yeah, don't upload your malware to virustotal. VT will share these samples for the sole purpose of taking it apart and documenting it. it says the following in their historic privacy policy statement: "We share the raw data underlying Samples uploaded to the Services as well as information relating to the submitter (ciphered ID, city, and country) of the Sample, as follows: With our security partners. When you upload a Sample to VirusTotal in order to receive a report about the potential maliciousness of its content, we store it in the Corpus and share it with our partners in the anti-malware and security industry. Partners that participate in VirusTotal are bound by contract to only use the Samples for internal security purposes in compliance with our Terms of Use to detect malicious code and to improve their antivirus engines. All partners receive Samples that their antivirus engines did not detect as potentially harmful if the same Sample was detected as malicious by at least one other partner’s antivirus engine. This information sharing helps correct potential vulnerabilities across the security industry." tl;dr if you care about this malware, something you made for engagements and you want to increase its shelf life, don't upload it to VT. there are alternatives that you can upload your malware to, to see what defensive solutions get triggered by your malware which i can't remember off the top of my head unfortunately, but yeah! i hope that helps! :D

[@cadeathtv]

@@crr0ww thanks for the input. How risky is it to upload it during the development phase? Any tips on how to test the effectivity of your malware?

[@pookbally]

crow ur the best

[@the_internet_332]

Great Video!

[@alexanderdell2623]

Is Ntapi using is same of using syscalls?

[@crr0ww]

Not DIRECTLY. There are certain NTAPI functions (as talked about in the video) that don't actually result in a syscall/int 2eh/sysenter instruction. Those NTAPI that do however, will end up invoking these instructions. so, when we call an NTAPI function, yeah, we will eventually have it perform a syscall, but we're not using syscalls directly, moreso transitively using them through the NTAPI. Using syscalls directly/indirectly is going to be main focus point of the next video, but just remember that when we use syscalls, we're ushering them out directly (typically through our own defined assembly stubs) and not having the NTAPI do it for us! Hope that helps! :)

[@kingananas2.0]

What font is that?

[@Bingo901]

Great video ! What font do you use ?

[@muhamedadel3984]

DinaRemasterII

[@peppidesu]

13:52 osu reference 👀👀

[@crr0ww]

SHIT I'VE BEEN MADE

[@fostn]

What theam you using in Visual stedio

[@crr0ww]

Zero (dark theme)

[@fostn]

@@crr0ww thank you crow

[@Alfakatt]

What is accomplished with a goto that couldn’t just have been a function?

[@coder_rc]

Crow evenly spaces his code 😱😱😱😱😱😱

[@crr0ww]

:GASP: !!! xD tysm for commenting brother

[@coder_rc]

@@crr0ww

[@interrrp_with_three_rs]

good video, you and cazz should collab

[@ryuu8027]

Good video

[@jjurmean]

you could also just do if !Buf if it equals null, good video though

[@freeeverymalloc]

happy halloween

[@crr0ww]

happy (late) halloween!!

[@noorkhara1429]

crows rat 🐀 4 grams protein I’m gonna nomnomnomnom

[@crr0ww]

[crow's rat WILL remember this]

[@MalwareHunter_07]

make videos on EDR Evasion

[@BoopyTheFox]

Man you're cool

[@K4nj]

What's your theme

[@crr0ww]

it's called zero (dark theme): marketplace.visualstudio.com/items?itemName=AgitoReiKen.zerovstheme

[@K4nj]

appreciate it so pleasing on the eye @@crr0ww

[@0xGast]

what font are you using

[@0xGast]

nvm

[@ismaildogukancokluk3679]

Yoooo. Your font looks great mind sharing the name of it ?

[@crr0ww]

sure, it's called "DinaRemasterII"

[@Celestenshi]

Thanks

[@Celestenshi]

idk why it only typed out thanks im gonna cry

[@notechnolife9596]

Marry me !

[@DuckeyDev]

Noice

[@swoodc]

nah its a black cat they wouldve shot it before locking it up lmfao

[@Zetty]

penith

[@daljeetbhati8353]

i want meet you so bad 😭

[@crr0ww]

haha maybe one day, brother

[@desmon3341]

hola desde españa

[@crr0ww]

hola! thank you for commenting

[@jonobrien8848]

gotos are great, old people are just bad at comprehension that dont like gotos.

[@nassvandrunen6020]

lmao

[@Haapavuo]

45 minutes to be able to open Calculator from CMD 😆 Just joking... But for real, I had to skip most parts of the video since I'm in a hurry right now. What is the main achievement here? You still need to be able to run your own exe (or modded exe) on the PC to be able to inject anything. Where is the malware part here? 🙂 Please give us a summary of the achievement of this video. Thanks!

[@alec3217]

GET OUT YOUR COZY BED RIGHT NOW AND MAKE A TUTORIAL ON REFLECTIVE DLL INJECTION CODE BOI