Unpacking Gootkit Malware With IDA Pro and X64dbg - Subscriber Request

[@mrexodia]

Hey, great video again! Just popping in for a few other small x64dbg tricks ;) You can use Debug -> Advanced -> Run until expression (Shift+F4), type 'CreateFileA' and press 'ok' to create a singleshot breakpoint and run there immediately... Instead of scrolling up in the dump/disasm to find the base address and then manually search for that in the memory map you can use the 'Follow in memory map' option to save some time :)

[@OALABS]

Heck yeh! These are awesome tips, thank you! You sir get the pinned comment for this video : ))

[@strugglingforlifesodouble7046]

j u s t b a s e 64 d e c o d e this: Izg2ZjJkNDJmZSBJIGhhdmUgYSBwcm9ibGVtIHVucGFja2luZyB0aGlzIHByb2dyYW0uIElmIHlvdSBjYW4gdW5wYWNrIHRoaXMgaSBjYW4gZ2l2ZSB5b3UgNTAgZG9sbGFycyEgSGVyZSB0aGUgcHJvZ3JhbTogaHR0cDovL3d3dy5tZWRpYWZpcmUuY29tL2ZpbGUvMjlzZm9uNXJuMWljdHkzL3RhcmdldC43ei9maWxlICM4NmYyZDQyZmU=

[@techlord747]

Great video guys ! Even though I've been in the reversing field for over 20 years, I still find that I learn a few new things by watching your videos. Keep them comin' !

[@_nit]

This was absolutely fantastic. Great explanation. Great cuts. Great analysis. I look forward to seeing more from you guys

[@OALABS]

Thank you! : ))

[@eliwhalen604]

Just found this channel, and I can't even begin to describe how fascinating I find the process of reverse engineering. Thank you so much for the treasure trove of information 👌

[@OALABS]

Hey thanks very much Eli, glad you are finding these interesting : ))

[@BinaryAdventure]

These videos are great. I'm going to send people to this channel for malware analysis specific stuff because there simply isn't anything better on KZbin. I love how you take the time to go into detail, explain the reasoning, demo the techniques described, and use real-world samples that are not meeting some ridiculous cookie-cutter ASPack kind of stuff. Great job!

[@OALABS]

Thanks so much : )) We are just trying to show how we do stuff for real, failures, dead ends, wins, and all. I should also mention I'm really digging your x86 tutorial series, post more videos! Please : )

[@BinaryAdventure]

Yeah I got at least 1 coming out today at 5PM pacific. Might do another bonus one too here soon. Thanks a lot, that means a lot coming from you!

[@simpleman8556]

Best videos on malware analysis I have ever found. Thank for sharing your knowledge.

[@Dead4Light]

Definitly a high quality thumbnail (fully resembles how malware analysis works in reallife). Thanks for the video!

[@OALABS]

Exactly how it works in real life 😂🤣😂🤣

[@LearnThenTeach]

Amazingly detailed and information packed video!

[@ISquishWorms]

Another quality video to watch, thank you.

[@SoftDatCLS]

OALabs Very Good !!! great video friend :)

[@johnbackstrom7036]

This is like a violin =)

[@stefannicula3898]

On 26:35, the PE carve out part, could you perhaps help me understand how exactly were the PE files positioned in the dump? Because you just erased whatever was at the top of the PE file header. How can you be sure that you are not including junk memory when carving? Did you investigated specifically if the 2 files were one after another without junk at the top or after them? Thanks for the video!!

[@OALABS]

So all I am doing is using the PE header to locate the PE file in the dump. Then I remove all the data before the header (since the header is the start of the PE). With regards to "How can you be sure that you are not including junk memory when carving? " the answer is I don't really care if there is junk in the buffer since I know there is a PE in there I know that I can always use the above trick to remove the junk after I have dumped it.

[@turner7777]

Hey do you usually use the plugin "ret-sync" which is supposed to link your ida db with x64dbg, and if yes could you please tell me if you experienced this. So when i copy the python scripts into my ida dir under "plugins" or "python" folders ida just doesnt load the plugin at all, im with Python3 and i read the docs on github which said it was supported but ida is not loading the plugin

[@OALABS]

I don't use it as I use different VMs for static analysis and debugging and I found the remote debugging configuration required some network connectivity between the hosts that wasn't comfortable with. It's almost impossible to troubleshoot via KZbin comments like this but the fist thing I would check is the log info in IDA in the Output Window when you load a new binary into IDA. That is when IDA loads the plugins so if there is an error you should see some sort of log message in the output window. If you are really stuck hop on our Discord and maybe someone can help discord.gg/UWdMC3W2qn

[@hapja]

awesome

[@lopo8000]

Do you use Ida Free for debugging together with dbg64x or the paid version of ida pro?

[@OALABS]

IDA Pro ... says so in the title 😉 When this video was released there was no really good option for free IDA but now with their free cloud decompiler (64bit only) I think it would be possible to actually use the free version for some reverse engineering tasks. Still need the paid version for 32bit though (or g-hydra).

[@realgordonramsay37]

Can you do an unpacking of vmprotect v3? I love your tutorials and I think its a good video idea

[@OALABS]

Thanks for the support. I replied to your comment on our other video... still love the name though 😹😹

[@markyrocks69]

What freaks me out is that there's a file I been playing around with that is displaying similar behavior as this one. Its supposed to be a dll for a game exploit but it is doing sneaky stuff in the background....

[@3dadventures792]

Sorry for the unrelated question. I want to play with some live malware samples, but since I'm not an established malware researcher yet I only have access to virus share, no virustotal or Hybrid analysis. How do i find new stuff being used right now in the wild? Thanks.

[@OALABS]

No worries! One of the best places to get new relevant malware samples is from Brad's awesome blog over at www.malware-traffic-analysis.net/2018/index.html Not only is his analysis great but he also uploads the malware samples to his site (zip + password protected) so you can download them and analyze yourself. The links for the samples are at the end of each one of his posts. Hope this helps : )

[@BinaryAdventure]

malware-traffic-analysis.net - Click a year in red, then you can go to town or do ctrl+f to search for specific sample. Note that you will want the zip files which contain the actual sample instead of just the pcaps. He has both on each page.

[@3dadventures792]

This does help. Thank you both :)

[@OALABS]

Also, how could I forget!? Karsten made a whole video about this over on his channel kzbin.info/www/bejne/iXSth4pnep2XfKM

[@BinaryAdventure]

crap I didn't even see this reply somehow haha. Ah well, I bet he knows where to get samples now right?? :P

[@roni5089]

How long have you been doing this?

[@OALABS]

I think at some point we may make a "how I got into reversing" type video ... but until then the short answer is we both have been working in security for 10+ years with a pretty broad base of experience ranging from appsec, to full-on pentesting, to incident response. Personally I (Sergei) have been reversing professionally for about five years... and as a hobby for maybe eight years. But as you can see in the videos I am nowhere near an expert in the field, and I'm always learning new techniques and tricks. I also do a lot of software dev and that helps with honing the reversing skills. If you have any other questions feel free to ask : )

[@DrPastah]

Audio was super quiet in this video.

[@BeingTuluva]

Make video On VM protect v2.07 witj DOS anti dump lock Un packing