IDA Pro Malware Analysis Tips

[@simpleman8556]

Your unpacking technique is saving me a lot of time everyday :)

[@OALABS]

That's awesome to hear! Thanks!

[@QQ-xx7mo]

Thank you so much for everything, I'm learning a lot from your videos.

[@simpleman8556]

Thank you man :-) Really happy that I found your channel :-)

[@andylockhart257]

Truly epic tutorial! Kudo's guys. This is THE best IDA/Malware tutorial I have seen on the net. You guys surpass all! btw, did you know that if you place your cursor somewhere and press F4 it will run until that point. This works in most other debuggers and removes the need to manually set and remove breakpoints :) Also in the last exercise you guys are reversing a DLL. If you simply use View->Open subviews->Functions you should be able to see 'DllEntryPoint' therefore need not calculate DLL rebasing. Good practice though :) Stellar guys....just awesome :) More tutorials! pls I have learnt so much.

[@OALABS]

Hey thanks so much! And thanks for the tips! I'm always excited to learn a new trick with IDA : )

[@breadbaconcheese]

just wanna say thanks alot for this vid. i really learnt alot from your practical tips. the ida/debugger dll base address offsetting, explanations on breakpoint at ordinal vs dll entry point, etc. legit droppin gold nugs!

[@binaryteam5448]

Awesome videooo loveeee it can't wait till you get into kernel so detailed I'm going to be watching your videos all day😊😊

[@nikhilt3755]

18:45 are you referring to stack buffer overflow?where we can use pop pop ... return inorder to execute shellcode

[@OALABS]

No I'm referring to a control flow obfuscation technique where the address of a hidden function is pushed onto the stack and then ret is called to redirect program flow to that function. This is a common technique used in packers which makes static analysis difficult and can also be tricky when debugging.

[@nikhilt3755]

@@OALABS nice and tq

[@lanr3356]

I loved the tutorial. thank you very much for your time and effort to bring it to us.

[@vladimirchudyk995]

In 4:50 you say if the virtual offset would happen to be the real physical offset of the binary then the binary would be very "large". What do you mean exactly? Do you mean the binary would occupy a lot of real physical memory space?

[@OALABS]

Oh haha yeh it would be a huge file if those were the offsets. When the binary is loaded in memory it is loaded with a base address 0x400000 for exes and 0x10000000 for DLLs. So if this was a file on disk the size would be + 0x400000 bytes.

[@vladimirchudyk995]

@@OALABS Thanks for the response! I watched the whole video and really enjoyed it. The only downside to it was when you preferred not to explain further concepts as that would have made the video at least 4 hours long ;)

[@Leonardo47565]

Hello, thanks for the awesome video. I'm having some trouble with the step taken around 34:00 where you see ntdll.dll exports, my IDA (which is free version) says "module 'ntdll.dll' has no names" (and also I can see only ntdll32.dll and ntdll.dll, but NOT C:\Windows\System32 tdll.dll

[@jackz4665]

Wow man you explain things so easily, you kinda spend some time talking about something you are focusing which is not really relevant, like but this is the best way to explain something, you could've turned this video into 45 minutes instead of 1:30 but without your deep explanations on how you think about things wouldve been really hard to grasp, thank you

[@rayray1999100]

I really appreciate this man!

[@muffinberg7960]

Awsome video. Really enjoyed watching it

[@Marselmarsemars]

very useful video, made a lot of bookmarks

[@akiraperera9574]

Hi, in the structures part of IDA, is there a way to display all values of one value in a list? Thanks.

[@OALABS]

I don't know what you are asking, but you have asked it twice on two different videos so A+ for motivation! Join our discord and maybe we can figure it out together?

[@rocketsurgeon7057]

Excellent. Give us more.

[@OALABS]

Moar you shall have! Check us out on Twitch too www.twitch.tv/oalabslive

[@ReubenSammut]

First of all great tutorial. Just getting into Malware analysis (currently reading Practical Malware Analysis) and your tutorials are some of the best I've seen so far. Just a question regarding setting breakpoints after taking memory snapshots (I'm not sure it really makes sense). If ASLR is turned off, shouldn't the base of the exe + stack, heap and libraries be mapped to the same locations in memory, hence allowing you to keep the breakpoints from one run to the other after unpacking?

[@OALABS]

Thank you, and good point! So you may notice that that PE and DLLs do reload in the same location which makes thing easier but I often switch debugging environments so it's a habit to not rely on this. Also, just to clarify the memory snapshot only decorates your IDB it does not reflect the actual debug environment (ie. if you take a snapshot with one debug host and switch to another IDA won't arrange the debug environment to match the snapshot) it is not like a VM snapshot. So if you place breakpoints in the snapshot you cannot rely on them being placed accurately at debug time, I know that was not your question I just wanted to clarify for anyone who may be confused.

[@あまね-y6t]

the best ida tutorial ever seen.Cool

[@willsmith798]

Hello I am not able to locate the file at the link you listed. Is there any new updated version of the link?

[@StefanRothenbuehler]

Great tutorial. I have a similar setup for remote debugging. Is there a particular reason why you don't just leave the path for the remote program to debug as it is? They lay in the same folder on the same shared folder (same drive letter mapped Z:) on both VMs. This is how I do it. I just thought there might be a reason other than to explain the concept why you don't just leave the path as it is. Keep up your great work! Really enjoy it.

[@OALABS]

That would probably be easier haha! I don't really have a good explanation, except this is just the way I started doing it. I'll try your method though, seems like it would save some potential confusion. Thanks for the tip : )

[@chaitanyabhojane498]

where is the demo files guys i cant find? I want to go through by practising on my side too!

[@alyagomaa5101]

do you have any ida how to get IDA's decompiler to show arr[i] instead of *( i + arr)?

[@OALABS]

Yes you will have to define the var "arr" as a struct. We cover this in detail in our reversing C++ tutorial kzbin.info/www/bejne/pV6pd3p_odSrrKc

[@eamonnryan4092]

Excellent video, thanks for making!

[@og46829]

You're awesome! Thank you for your time, efforts and knowledge :) Can you please make a video in which you make something like a long-term roadmap for beginners to learn malware analysis?

[@OALABS]

This is a great suggestion and it has been a long term goal of ours but it is a big project that we don't want to tackle until unpacme is fully stable and doesn't take as much of our time.

[@JohnSmith-mf3dq]

Thanks buddy for the video You ever used capa explorer with IDA pro?

[@OALABS]

Yeh, just released a video on it: kzbin.info/www/bejne/ppelcmmvabt_ra8

[@Jakob6174]

What was the plugin you have installed that caused the crash? I have the same problem. Also this is a fantastic tutorial, I really needed something like this to supplement while reading the IDA Pro book, so thanks a bunch.

[@satya_dau]

Hi, Nice tutorial. But I am facing an issue here. I was following some tutorials on IDA and couldn't figure it out why my IDA doesn't recognize any local variables when I launch any executable. Can anyone help me here?

[@iwanpon_pon3062]

how to edit the file so if there is a hidden command

[@diegocracker]

Melhor dos treinamento, isso porque faço analise de malwares e apreendi muito com esses vídeos teóricos e práticos. Thanks.

[@OALABS]

Muito obrigado!

[@malware_reverse]

Great Video guys. I really learned a lot from it, especially debugging DLL. One question, could you guy do a demo video for debugging DLL contains Sericemain function which is running as a service. It is hard to me to find a effective way to debug using IDA. Thank you so much!

[@OALABS]

Hey that's a great idea! I'll add it to the list. If you know of any malware that installs itself as service can you send it out way? Thanks!

[@malware_reverse]

@@OALABS Thank you!. I tried to learn how to debug DLL servicemain. Found one:www.virustotal.com/#/file/1b3c22ad57d48674e3cad45794daa6e08edad45ad7a1d1c2ac871e1ff2043a88/details

[@mozark1043]

Hey, great tutorial packed with info. Recommend breaking up the sections in the future for quick access (or have quick nav buttons at the start). Any chance you could cover a "get IDA pro setup with IDA python on Windows" tutorial? The IDA python book assumes it's already installed and online resources are scarce. EDIT: Nevermind, apparantly the free version doesn't support IDAPython

[@OALABS]

Hey glad you enjoyed the tutorial! If you expand the description below the video you will see the quick links you are looking for : )

[@lougvar]

Amazing! Thanks!

[@pentesterdgb6858]

What version of IDA Pro is this? I am not seeing any option for remote debugging in the UI for the 5.0 freeware version.

[@OALABS]

Unfortunately I don't think the the free version of IDA comes with the remote debugger, but I think it has a local debugger that you can use. With the freeware version there is no problem using the local debugger on the same VM as IDA since there is no license that could be stolen by the malware.

[@joppezorro4360]

Very good tutorial. Interesting observation though. In my setup I run two virtual win10 64bit. then the API call (openKeyexW) goes to kernelbase and not advapi32. IDA says advapi32 but if you follow the execution you will see that it goes to kernelbase.

[@sportshome6504]

where can I get the sample of the malware?

[@OALABS]

You can download them from malshare here: malshare.com/sample.php?action=detail&hash=7f0fdddf5905886532c8a652abed1b6c malshare.com/sample.php?action=detail&hash=90aff54cf69ad647eec925f361a34798

[@sportshome6504]

@@OALABS Thank You Sire

[@EnduranceT]

This is awesome. Thanks so much! Please cover some more unpacking techniques for advanced packers; not a lot of good content in English on this and the tuts4you stuff is old and often unreliable. Thanks again!!!! Awesome video!!!! Subscribed/Liked!

[@OALABS]

Thanks so much! We can definitely put out some more unpacking focused videos. I also highly recommend the unpacking tutorials from MalwareAnalysisForHedgehogs kzbin.info/www/bejne/bnLcfmWipN9md7c and the unpacking video series from Hasherezade kzbin.info/www/bejne/jHiymI1nd72HiKc. I learned a ton from both of them : )

[@DL-bp7jp]

hi i am trying to download the sample files (i'm quite new to IDA...) and end up downloading a file called: 90aff54cf69ad647eec925f361a34798 where can i find the real sample files?

[@OALABS]

You can create a free account on malshare and download the sample from there: malshare.com/sample.php?action=detail&hash=90aff54cf69ad647eec925f361a34798

[@DL-bp7jp]

om i got the files - loaded them to ida pro 7 . when i check the imports tab it is empty for the exe sample. any idea why?

[@redpillcommando]

@@OALABS I too am having a bit of trouble finding the exe file. All I got is a .rsrc folder and three other files. I come from a UNIX background, never did a lot of work with Windows. What am I missing?

[@arunp9703]

This is awsome man...keep posting

[@syedalizainnaqvi9450]

Hi. Can you make course or videos on understanding assembly for malware analysis. This is where I am stuck.

[@LolloLong]

Great tutorial

[@OALABS]

Thanks : )

[@nz9273]

Hi, I am having problem to download the tutorial files from the link that you provided in the description as I couldn't find the download button. I would like to recreate your steps so that I could understand as I have unit that is related to this. Thanks.

[@redzaizudin6231]

kzbin.info?q=https%3A%2F%2Fmalshare.com%2Fsample.php%3Faction%3Ddetail%26hash%3D7f0fdddf5905886532c8a652abed1b6c&redir_token=UFvNV5lcUSQmZ1Oum6sHkuh64il8MTU3MDg2NTAxMEAxNTcwNzc4NjEw&stzid=UgwJLRnd_L9K1VpxNGl4AaABAg.8sOD2g3ryJg8sQGZeZhwLx&event=comments kzbin.info?q=https%3A%2F%2Fmalshare.com%2Fsample.php%3Faction%3Ddetail%26hash%3D90aff54cf69ad647eec925f361a34798&redir_token=UFvNV5lcUSQmZ1Oum6sHkuh64il8MTU3MDg2NTAxMEAxNTcwNzc4NjEw&stzid=UgwJLRnd_L9K1VpxNGl4AaABAg.8sOD2g3ryJg8sQGZeZhwLx&event=comments

[@shinvipo]

Are you using Mac OS?

[@OALABS]

Yes MacOS as my host with a Windows VM.

[@LaurentLaborde]

Ctrl-G in the instruction trace window is black magic

[@LaurentLaborde]

i congratulate myself for this comment because i already forgot what it's doing :D

[@LaurentLaborde]

twice now :D i keep watching this video every few month and i still learn from it :)

[@nullnull6032]

That is useful, here is a sub :D

[@albaniaiptv8335]

When i want to mod syntax for arm ,pop up this warning Sorry, this processor module doesn't support the assembler.

[@markmanning2921]

You spend a great edeal of time explaining what you are not going to be explaining instead of explaining all thye things you ARE going to be explaining.

[@OALABS]

This would have been very helpful advice 6 years ago!

[@redpillcommando]

Thank you for this tutorial. Once I have finished watching it and working through the examples, I will return to my lab and plan for tomorrow night, when I will try to take over the WORLD! To save it from the REAL super villains. :-)

[@helbegh3370]

\Sessions\1\BaseNamedObjects\39226fe8-e227-494b-a788-8a992c14d8fe

[@tugelek9678]

dzieki dziala

[@Mezzosd]

how to download ida pro?

[@OALABS]

You can download the freeware version here www.hex-rays.com/products/ida/support/download_freeware.shtml. Or if you want to purchase it and use the full feature set we have displayed here you can use this www.hex-rays.com/products/ida/order.shtml

[@utayasurian419]

How to hide a flag in a malware like most CTFs?

[@alyagomaa5101]

thank you

[@DL-bp7jp]

Hi, Can you share a new download link to tutorial files?

[@OALABS]

You can download them from malshare here: malshare.com/sample.php?action=detail&hash=7f0fdddf5905886532c8a652abed1b6c malshare.com/sample.php?action=detail&hash=90aff54cf69ad647eec925f361a34798

[@jaydev8148]

bro, from where can I download the demo app

[@OALABS]

Oh sorry about that. You can create a free account on malshare and download it there malshare.com/sample.php?action=detail&hash=90aff54cf69ad647eec925f361a34798

[@dirtbikersteve]

please use sites like mega.co.nz that don't require registration

[@000maestro000]

This is such a great tutorial, I wonder if you can share some knowledge about IDA scripting, I am recently getting into it but finding it kinda cryptic.

[@OALABS]

Hi Dan, we can definitely cover some IDA scripting in our upcoming videos ... in the mean time I highly recommend the The Beginner's Guide to IDAPython from Alex Hanel, it's amazing and has tons of great examples leanpub.com/IDAPython-Book

[@LaurentLaborde]

i watch this one one on a regular basis.

[@papusa9878]

Nice

[@zeuscybersec659]

Amazing Content!! I have a youtube channel too and i will be Starting Reverse Engineering after i finish Black Hat Python which i am currently reading. Will appreciate if you can tell me some good resources to get started in Reverse engineering and malware Analysis.How is the book secrets of reverse engineering? Also i would be privileged to have you on my channel for a cybertalk someday❤️

[@RileyPorter]

OALabs. Don't rename the function pointers.... Use the renimp.idc that comes with IDA Pro. It will AUTO populate the IDB with the parameter names as well.

[@OALABS]

Nice tip! Thanks!

[@georgesanderson918]

33:02

[@hS-fx7hr]

hi a great tutorial thank you . make the voice louder

[@OALABS]

Thanks! About the audio our editing skills are slowly improving... audio should be mostly fixed on our newer videos : )

[@saultube44]

Note: ever 0x100000=1 MB

[@bilgenebrudisbudak5288]

dude what is that

[@metaorior]

dude i got win32.pioneer i can't get rid of this shit

[@OALABS]

Best free source for malware removal help: www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-help/