panda bear 0xcpu

Disassembling 1bitsy examples using radare2

Note that because radare2 uses Capstone to disassemble ARM code, there are issues with the disassembly. arm-none-eabi-objdump -d compiledbinary.elf actually does a better job in some cases. For example, msr isn't decompiled correctly...

First, you have to either strip the default ELF binaries the default Makefiles build when you run make OR you need to just compile .bin files using something like:

make binaryname.bin

Python zipapp web apps

What's a zipapp?

This concept is very much like .jar or .war archives in Java.

NOTE: The built .pyz zipapp can run on both Python 2 & 3 but you can only build .pyz zipapps with Python 3.5 or later.

Initial setup

Malware Sample Inspected

Trickbot COVID macro lure via MSFT: ec34b207d503a3c95ee743ee296a08e93a5e960aa4611ea8c39d8e5d4c5f6593

test.js

eval("WScript.CreateObject(\"WScript.Shell\").Run(\"calc.exe\");");

Assembly Language / Reversing / Malware Analysis / Game Hacking -resources

⭐Assembly Language

Modern x64 Assembly

https://www.youtube.com/playlist?list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA

	#include <Windows.h>
	#include <time.h>

	#include <string>
	using namespace std;

	#define BTF_FLAG 0x300
	#define TRAP_FLAG 0x100

	LONG CALLBACK TraceCallback(LPEXCEPTION_POINTERS ex)

	import os
	import sys
	import logging

	import pefile
	import ucutils
	import unicorn
	import capstone
	import argparse

	#!/usr/bin/env python

	import lief

	shellx = lief.parse("libshellx-2.10.3.1.so")


	# .dynsym
	dt_symtab = shellx[lief.ELF.DYNAMIC_TAGS.SYMTAB]
	dynsym_section = shellx.get_section(".dynsym")

	$AutoLoggerName = 'MyAMSILogger'
	$AutoLoggerGuid = "{$((New-Guid).Guid)}"

	New-AutologgerConfig -Name $AutoLoggerName -Guid $AutoLoggerGuid -Start Enabled
	Add-EtwTraceProvider -AutologgerName $AutoLoggerName -Guid '{2A576B87-09A7-520E-C21A-4942F0271D67}' -Level 0xff -MatchAnyKeyword ([UInt64] (0x8000000000000001 -band ([UInt64]::MaxValue))) -Property 0x41

	//
	// main.m
	// EndpointSecurityDemo
	//
	// Created by Omar Ikram on 17/06/2019 - macOS Catalina 10.15 Beta 1 (19A471t)
	// Updated by Omar Ikram on 15/08/2019 - macOS Catalina 10.15 Beta 5 (19A526h)
	// Updated by Omar Ikram on 01/12/2019 - macOS Catalina 10.15 (19A583)
	// Updated by Omar Ikram on 31/01/2021 - macOS Big Sur 11.1 (20C69)
	// Updated by Omar Ikram on 07/05/2021 - macOS Big Sur 11.3.1 (20E241)
	// Updated by Omar Ikram on 04/07/2021 - macOS Monterey 12 Beta 2 (21A5268h)