Shellcode Analysis - Part 1: Extraction with x64dbg

Рет қаралды 2,788

Күн бұрын

Пікірлер: 43

@gandalf9526 Ай бұрын

Thanks a lot for making these videos! They're really well structured and they provide decent information for people that are into malware analysis.

@sonianuj Ай бұрын

Thank you for leaving a comment. Glad to hear you're benefitting from the videos!

@natedunlap9226 Ай бұрын

Really excited to see the rest of this series. Keep up the amazing work!

@sonianuj Ай бұрын

Thanks so much!

@damianlaw1689 Ай бұрын

Excellent video! I really appreciate how you explain how to identify malicious patterns used by malware, even when they are very simple. It’s incredibly helpful for beginners starting with malware analysis at the ASM level.

@sonianuj Ай бұрын

Glad you enjoyed it!

@purekillah Ай бұрын

The hex values is api hashing at work. I believe you go into great detail about this in your FOR710 course.

@sonianuj Ай бұрын

You got it!

@Drew-bugfireio Ай бұрын

Great as always, thanks for the new series!

@CosmodiumCS Ай бұрын

Great video, Anuj! I love how you explain common patterns you look for when going through the analysis process.

@DEVStoreApp 11 күн бұрын

Amazing content bro 😎 we’re subscribers as of now learning a lot too by the way thx ☺️

@sonianuj 8 күн бұрын

Appreciate the kind words!

@boogieman97 Ай бұрын

Welcome back Anuj, very happy to see a notification that you placed another video! Do you know by any chance if FOR710, will get an exam ? I did the course in January 2023, with Nick as instructor. Would look forward to certify this one.

@sonianuj Ай бұрын

Thanks, it’s good to be back! Regarding the exam, unfortunately it’s completely out of my control. I do hope GIAC creates an exam soon, but I’m not aware of the timeline.

@boogieman97 Ай бұрын

@sonianuj for what they told me back then it highly depends on the subscription and interest for the course. I can imagine it needs to be profitable. Apart from all of that, the course content is amazing, highly recommendable, I have learned so much from it.

@yur5670 Ай бұрын

These videos are really high quality. Amazing work

@sonianuj Ай бұрын

Appreciate that, thanks for watching!

@mustaphaaitichou1519 Ай бұрын

Amazing video and good explaination thank you for sharing.

@sonianuj Ай бұрын

My pleasure!

@samjohn1098 Ай бұрын

Thanks for the video indeed useful waiting for part 2

@sonianuj Ай бұрын

Thank you for watching!

@Bchicken2 Ай бұрын

Thank you for the video! It was really useful 👍

@sonianuj Ай бұрын

You’re welcome, glad it was helpful!

@manassalian Ай бұрын

Excellent video Anuj. Could you possibly discuss about the job prospects for a malware analyst and the skills required for such a job. Thank you

@sonianuj Ай бұрын

Hi there, thank you! I appreciate the suggestion and will definitely give this some thought. Generally on the the channel I'm trying to focus on technical demos, but perhaps there is a different format I can use to share my thoughts on the topic you suggested (future live stream, community section of KZbin). I'll reflect on this some more, thanks again.

@RhysFrostt Ай бұрын

More content...Yes please!

@memeemperor4154 Ай бұрын

Excellent contents!!!

@sonianuj Ай бұрын

Thank you!

@boogieman97 Ай бұрын

The hex references are memory addresses to dynamically resolve Windows API's, known as API hashing. Correct ?

@sonianuj Ай бұрын

You got it!

@Aaron199s Ай бұрын

I'm assuming those hex values are the expected hash values for certain modules that the malware wants to locate and load?

@sonianuj Ай бұрын

You got it, API hashing at work!

@Faisal-t4h2b Ай бұрын

useful

@davidmohan2698 Ай бұрын

Are you able to make a video detailing API hashing?

@sonianuj Ай бұрын

Hi @davidmohan2698. It's a great suggestion, but also something that takes quite a bit of time to discuss properly (I spend more than an hour digging into the specifics in my SANS 710 course). To be honest, so far, my KZbin stats indicate people watch my videos for 5 minutes on average. If I see an uptick in those numbers and more interest in longer videos, I'll definitely reconsider though. Again, I really appreciate you offering a suggestion!

@Mezzosd Ай бұрын

how to find strings using dbg and modify them?

@sonianuj Ай бұрын

Not exactly sure if I understand your question - but in general, if you view strings in x64dbg (right-click > Search for > Current Region > String references), you can dump any string to the dump window and edit those bytes.