lobitracking.blogg.se

1. #Ollydbg tutorial encryptstick how to#
2. #Ollydbg tutorial encryptstick .exe#
3. #Ollydbg tutorial encryptstick Patch#
4. #Ollydbg tutorial encryptstick trial#

is one of the best tutorial about how to use Ollydbg :D.

#Ollydbg tutorial encryptstick trial#

This one covers programs that come with a time trial which stops the program running when they run out.

#Ollydbg tutorial encryptstick Patch#

:: How to use Ollydbg This flash tutorial shows you how to use Ollydbg to patch exe files to avoid restrictions. Moreover, as expected, malware start launching calc.exe in the host at an interval of 30 secs(sleep=30000).Ollydbg Tutorial (Tutorials) Ollydbg Cracking Tutorials For Beginners Then we ran the sample and routed the traffic using fakedns.

This will be command passed through ads.php to the specimen to execute it in the system.

#Ollydbg tutorial encryptstick .exe#

Since the malware is looking for ads.php, we will create repsctive page in our web server stub.Īs per our assumption, cexe is an alias for exec so it should use an executable path as argument. It looks like malware is trying to get away with some command signatures and is using cexe as an alias for exec, tixe as an alias for the exit, etc. However, how is this triggering? If we remember we saw the below in. Ok, so we now know that the malware is enumerating the system for running services. Moreover, we found below in decodedtest.txt We will first convert the file into raw and then use a utility translate.py with ‘byte ^ 0x5b’ to decide the content. If you remember, we have saved the content previously but for a quick recap below are obfuscated content that we need to de-obfuscate. It is common to find out the author using one-byte key in algorithms like XOR, ROT, ROR, etc. In the above URL, we see a parameter encode=5b which might be the key the author is using to obfuscate the contents. We will get around this, but first, we need to decode the response from the specimen which we saw earlier that it is encrypted. However, since our web server does not hold any ads.php, the specimen was not able to complete the action or receive any command back from the server. These are the indeed the contents of the. Remember ads.php? Yeah, it was the URL the specimen was trying to ask through a GET. Looking at the stack for these, we find out the following ASCII text. Why eax? Because eax holds the return value of the function and as per Documentation of CryptDecrypt, if the function succeeds then the function returns a non-zero value, which is exactly our case. Below is the CryptDecrypt function, we need to see what this function returns, so we will place the breakpoint in the instruction right after the cryptdecrypt function where the function is checking for the value in eax and make a respective jump. tmp file.įind out CryptDecrypt function(easy way is to go to Names window > look for references and then follow in disassembler). Remember we have seen a function call CryptDecrypt which might reveal the content of this. tmp file is encrypted, and thus we do not know what malware is doing in the underlying system.

Let’s look at the handles and see what does this handle resolves to:īingo, this is what we were expecting it to read the. After placing a breakpoint, we ran the sample and below are the contents of the stack.Īs per Microsoft ReadFile function documentation, hFile is “A handle to the device (for example, a file, file stream, physical disk, volume, console buffer, tape drive, socket, communications resource, mailslot, or pipe).” This means this is a pointer to a file. We need to look at what is ReadFile reading, so we need to place a breakpoint at this statement. To see if our understanding is correct or not, let’s see ReadFile referencesīelow what we can see is the ReadFile reference in the code. If you recall, we saw an encrypted version of a. This looks like specimen is trying to read some file and also call Windows decryption function. Nice we see references to ReadFile and CryptDecrypt.