Internet Anthropologist Think Tank: 8/29/10 - 9/5/10

  • Search our BLOG


  • HOME
    Terrorist Names SEARCH:
    Loading

    Friday, September 03, 2010

    Reverse-Engineering Malware Cheat Sheet




    Reverse-Engineering Malware Cheat Sheet

    This is a cheat sheet of shortcuts and tips for reverse-engineering malware. It covers the general malware analysis process, as well as useful tips for OllyDbg, IDA Pro, and other tools. Feel free to customize it to your own needs. My reverse-engineering malware course explores these, and other useful techniques.

    General Approach

    1. Set up a controlled, isolated laboratory in which to examine the malware specimen.
    2. Perform behavioral analysis to examine the specimen’s interactions with its environment.
    3. Perform static code analysis to further understand the specimen’s inner-workings.
    4. Perform dynamic code analysis to understand the more difficult aspects of the code.
    5. If necessary, unpack the specimen.
    6. Repeat steps 2, 3, and 4 (order may vary) until sufficient analysis objectives are met.
    7. Document findings and clean-up the laboratory for future analysis.

    Behavioral Analysis

    Be ready to revert to good state via ddVMware snapshots,CoreRestoreGhostSteadyState, etc.
    Monitor local (Process MonitorProcess Explorer) and network (Wiresharktcpdump) interactions.
    Detect major local changes (RegShotAutoruns).
    Redirect network traffic (hosts file, DNS, Honeyd).
    Activate services (IRC, HTTP, SMTP, etc.) as needed to evoke new behavior from the specimen.

    IDA Pro for Static Code Analysis

    Text searchAlt+T
    Show strings windowShift+F12
    Show operand as hex valueQ
    Insert comment:
    Follow jump or call in viewEnter
    Return to previous viewEsc
    Go to next viewCtrl+Enter
    Show names windowShift+F4
    Display function's flow chartF12
    Display graph of function callsCtrl+F12
    Go to program's entry pointCtrl+E
    Go to specific addressG
    Rename a variable or functionN
    Show listing of namesCtrl+L
    Display listing of segmentsCtrl+S
    Show cross-references to selected functionSelect function name » Ctrl+X
    Show stack of current functionCtrl+K

    OllyDbg for Dynamic Code Analysis

    Step into instructionF7
    Step over instructionF8
    Execute till next breakpointF9
    Execute till next returnCtrl+F9
    Show previous executed instruction-
    Show next executed instruction+
    Return to previous view*
    Show memory mapAlt+M
    Follow expression in viewCtrl+G
    Insert comment;
    Follow jump or call in viewEnter
    Show listing of namesCtrl+N
    New binary searchCtrl+B
    Next binary search resultCtrl+L
    Show listing of software breakpointsAlt+B
    Assemble instruction in place of selected oneSelect instruction » Spacebar
    Edit data in memory or instruction opcodeSelect data or instruction » Ctrl+E
    Show SEH chainView » SEH chain
    Show patchesCtrl+P

    Bypassing Malware Defenses

    To try unpacking quickly, infect the system and dump from memory via LordPE or OllyDump.
    For more surgical unpacking, locate the Original Entry Point (OEP) after the unpacker executes.
    If cannot unpack cleanly, examine the packed specimen via dynamic code analysis while it runs.
    When unpacking in OllyDbg, try SFX (bytewise) and OllyDump's "Find OEP by Section Hop".
    Conceal OllyDbg via HideOD and OllyAdvanced.
    A JMP or CALL to EAX may indicate the OEP, possibly preceded by POPA or POPAD.
    Look out for tricky jumps via SEH, RET, CALL, etc.
    If the packer uses SEH, anticipate OEP by tracking stack areas used to store the packers' handlers.
    Decode protected data by examining results of the decoding function via dynamic code analysis.
    Correct PE header problems with XPELister, LordPE, ImpREC,PEiD, etc.
    To get closer to OEP, try breaking on unpacker’s calls to LoadLibraryA or GetProcAddress.

    In the day I used to have quite a collection of bugs/virii.
    But now its so risky, some can get to root and turn invisible,
    hide in unusual places, even mark sectors bad and hide there.

    Used to lock everything down and then watch them go.
    You can't lock everything down any more.
    We have special PC for this now, and reformat after.
    But even then I'm not 100% confident its gone.
    Become a very high risk game.
    Its like juggling nitro, could go off even though
    you've taken every percaution. It's happened to me
    before.
    But every once in a while you discover something
    than can be used as a cyber sidearm or some other 
    mischief.

    G

    Thanks to:

    .


    Terrorist Names SEARCH:
    Loading

    Genius Readers 09.03.10


    25% using proxys?



    G

    .

    Terrorist Names SEARCH:
    Loading

    Thursday, September 02, 2010

    Al qaeda loosing gone indoors

    US has been attriting al qaeda successfully.
    Thanks to Islams Secret Mujaheddin,



    al qaeda continues to loose popularity and support
    with in the Afpak theater, the civilians have seen
    the evidence of of them killing Muslims and bombing
    market places and Mosques. Dealing drugs and suicide
    bombers, HAREM. Even Imams and 

    Taliban attacks two Muslim-minority mosques 



    al qaeda cult continues to have problems recruiting
    new members, and funding. Almost half of the
    funding 50% sent to al qaeda cult and the Taliban
    is being pocketed by middle men along the way.
    Everyone takes a cut as they pass it along,
    and even the leadership has squirreled away
    nice chunks for after the insurgency fails.

    And spies among Muslims against the Taliban
    and al qaeda cult are rampant and available in
    legions.
    Internet Anthropologist Think Tank: Afghanistan's Secret Mujaheddin,



    "Critics also fail to realize that a single Al Qaeda operative’s knowledge and experience in guerrilla and terror tactics is of incalculable value as a force multiplier to the Taliban."


    "Al Qaeda’s Arab operatives are considered a fearless elite. They have knowledge of Islam that makes them seem like religious scholars to many Pashtun tribesmen, who they have led into battle in the past."


    They are also considered arrogant and abusive and a little dense.



    "Today, as they withstand CIA’s withering drone onslaught in Pakistan’s tribal belt, the Arabs are more low-key in their Afghan ops than they were in the past. The CIA’s targeted killing of Skeik Mustafa Abu al-Yazid after he left Mir Ali may also have impacted their activities on the other side of the AfPak.
    Arabs from Al Qaeda still fund and train the Taliban, but no longer lead operations from the front, Army Col. Donald C. Bolduc, who leads the Combined Joint Special Operations Task Force, told me in his office at Bagram Airfield this month."
    Sourced from:
    http://counterterrorismblog.org/2010/08/the_real_truth_about_al_qaeda.php

    They no longer go into the field, but stay behind in safety.
    Sending the Taliban's best and dumbest into stupid battles.

    al qaeda consider themselves to be better than the Taliban,  elite snobs.
    And the Taliban cadre are confused and angry.

    Taliban fighting is under staffed and poor morale.

    TALIBAN RANK AND FILE UNDER STAFFED/MANNED.


    Jewish American leader of al qaeda cult.



    "During the winter, Taliban leaders ensconced in Pakistan send in Al Qaeda operatives to train their fighters in bombmaking tradecraft during the lull in fighting, sources said."
    “The Pakistani madrassahs are still the big recruiting and training place. The Afghans go to a madrassah in Pakistan, where an Arab is typically like the dean, or headmaster, and learn how to fight,” the official told me. “Then the Afghan goes back home and teaches others to build bombs or fight — and gets paid handsomely for it.”


    "Meanwhile, as we reported in today's New York Daily News, Taliban leaders in key Afghanistan districts have been "shwacking" each other (Special Forces term) to jockey for "permanent" leadership positions after the U.S. begins to draw down forces next year."


    Maybe US should announce plans for the 2012 withdrawal, could lead to more
    Shwaking, its not like the Taliban have any Honor. They will kill their own for
    the right price.


    In this war US continues to have high suicide rates, but US sends their's
    to therapy, while the Taliban and al qaeda cult strap bombs on them instead
    of trying to help them.


    What ever the US forces are suffering al qaeda and Taliban suffer 10 fold.
    Taliban's Secret wounded part I

    Taliban Secret wounded part II




    Taliban and al qaeda cult is desperate last ditch
    effort to re-establish momentum.


    Even Bin Laden and Mulla Omar have gone AWOL
    deserting the insurgents hopeless cause.
    Giving up the fight.
    Binny's effort at bastardizing Islam is failing,
    and Moslems will be their down fall.


    Every where they go there are Muslim spies
    willing to turn them in for the grace of Allah
    and good of Islam.


    US and Islam continue to crush al qaeda and
    the Taliban.




    Muslims issue fatwa against bin Laden - Times Online  Spain
    Fatwa Issued Against Osama Bin Laden and Al Qaida « Afghanistan 
    Taisaruddin Mufti of Darul Ifta Majidia (Varanasi, India) issued a Fatwa












    Gerald
    Anthropologist




    Muslim Ulemas and Imams, over 6,000 :
    .Abdulkadir, Dr. Deina FCNA (U.S.) Fatwa against terrorism 7/05
    Abdullah, Shaikh Muhammad Nur (U.S.) FCNA Fatwa against terrorism 7/05
    Afghan clerics issue fatwa against bin Laden 1999
    al Alwani, Shaykh Taha Jabir (U.S.) against 9/11 attack 9/01
    Al Alwani, Dr. Taha Jabir (U.S.) FCNA Fatwa against terrorism 7/05
    Al-Awdah, Shaykh Salman (Saudi Arabia) condemns terrorism 5/03
    Al Hanooti, Shaikh Muhammad (U.S.) FCNA Fatwa against terrorism 7/05
    al-Hanooti, Sheikh Muhammad Ali – against 9/11 (U.S.) 9/01
    al-Hitar, Judge Hamoud (Yemen) he and four other Islamic scholars used Qur’an to challenge Al Qaeda’s views on terror 2/05
    al Luheidan, Shaikh Saleh Chairman of the Supreme Judicial Council (Saudi Arabia) against 9/11 9/01
    al Qaradawi, Shaykh Yusuf (Qatar) against 9/11 attack 9/01
    Al-Qaradawi, Shaykh Yusuf – condemns Bali attacks 10/02
    al-Qaradawi, Shaykh Yusuf – against harming places of worship (specifically a Jewish synagogue) 4/02
    al Sabil, Shaykh Muhammad bin ‘Abdallah member of the Council of Senior Religious Scholars (Saudi Arabia) against terrorism, obligation to protect non Muslims 12/01 Agence France Press
    al Saffar, Hasan Shiite Islamic Spokesperson (Saudi Arabia) 2/06 Danish cartoons
    al-Shaykh, Shaykh Abd al-Aziz bin Abdallah Aal of Saudi Arabia issues fatwa against suicide terrorist attacks 4/2001
    al-Sistani, Grand Ayatollah Ali issues fatwa to Muslims in Western nations, urging them to obey the laws of the countries in which they live. 6/06
    Al Tantawi, Shaykh Muhammed Sayyid Imam of al Azhar Mosque (Egypt) against 9/11 attack 9/01
    Al-Tantawi, Sheikh Muhammad Syed (Egypt) Condemned suicide bombings against Israeli civilians, and all terrorism 12/01
    Alush Shaykh, Shaykh ‘Abdul ‘Aziz Grand Mufti (Saudi Arabia) against 9/11 attack 9/01
    Alush Shaykh, Shaykh ‘Abdul ‘AzizGrand Mufti (Saudi Arabia) against suicide terrorism 5/01
    Awwa, Muhammad S (Egypt) against 9/11 attack 9/01
    Badawi, Dr. Jamal (U.S.) FCNA Fatwa against terrorism 7/05
    Bagby, Dr. Ihsan (U.S.) FCNA Fatwa against terrorism 7/05
    Bayyoumi, Abdel Mo’tei al Azhar Islamic Research Academy, Cairo (Egypt) against 9/11 attack 9/01
    Belkaziz, Dr. AbdelaouahedSecretary General of the OIC against 9/11 attack 9/01
    Bishri, Tariq (Egypt) against 9/11 attack 9/01
     120 Canadian Imams issue fatwa against terrorism and extremism 7/05
    Mustafa Ceric, Grand Mufti of Bosnia – A Declaration of European Muslims
    Fadlallah, Muhammad Husayn Renowned Shiite Scholar (Lebanon) against 9/11 9/01
    French Muslim Leaders Rioting, 11/05
    Ghannoushi, Rashid President, Nahda Renaissance Movement (Tunisia) condemning 9/11 attack 9/01 signed by 46 scholars & leaders
    Hammad, Dr. Nazih (U.S.) FCNA Fatwa against terrorism 7/05
    Hindi, Shaikh Yahya (U.S.) FCNA Fatwa against terrorism 7/05
    Huwaydi, Fahmi (Egypt) against 9/11 attack 9/01
    Jackson, Dr. Abdul Hakim (U.S.) FCNA Fatwa against terrorism 7/05
    Khamene’i, Ayatollah Ali supreme jurist ruler of (Iran) ** “Killing of people, in any place and with any kind of weapons, including atomic bombs, long range missiles, biological or chemical weapons, passenger or war planes, carried out by any organization, country or individuals is condemned. … It makes no difference whether such massacres happen in Hiroshima, Nagasaki, Qana, Sabra, Shatila, Deir Yassin, Bosnia, Kosovo, Iraq or in New York and Washington.” ** Islamic Republic News Agency, September 16, 2001,
    Khatami, Muhammad President (Iran) at U.N. against 9/11 attack 9/01
    Khayyat, Haytham (Syria) against 9/11 attack 9/01
    Maghraoui, Dr. Mukhtar (U.S.) FCNA Fatwa against terrorism 7/05
    Mustafa Mashhur General Guide, Muslim Brotherhood (Egypt) condemning 9/11 attack 9/01 signed by 46 scholars & leaders
    Muhammad, Dr. Akbar (U.S.) FCNA Fatwa against terrorism 7/05
    Nizami, Mufti Rahman, Ameer Jamaat e Islami (Bangladesh) condemning 9/11 attack 9/01 signed by 46 scholars & leaders
    Nour, Fazil President, PAS Parti Islam Se (Malaysia) condemning 9/11 attack 9/01 signed by 46 scholars & leaders
    Qadri, Tahirul head of the Awami Tehrik Party (Pakistan) against 9/11 attack 10/01
    Qazi Hussain Ahmed Ameer, Jamaat e Islami (Pakistan) condemning 9/11 attack 9/01 signed by 46 scholars & leaders
    Qazwini, Shaikh Hassan (U.S.) FCNA Fatwa against terrorism 7/05
    Rabbani, Shaykh Faraz on kidnapping and terrorism
    Saudi religious scholars issue fatwa against terrorism 6/04
    Sayf, Ahmad NurDirector of Islamic Sciences & Research Institute (UAE) 2/06 Danish cartoons
    Al-Tantawi, Shaykh M. Sayyid condemns bin Laden 11/01
    Shah, Dr. Zulfiqar Ali (U.S.) FCNA Fatwa against terrorism 7/05
    Shleibak, Dr. Ahmad (U.S.) FCNA Fatwa against terrorism 7/05
    Sheikh, Dr. Muhammad Adam (U.S.) FCNA Fatwa against terrorism 7/05
    Shinwari, Fazli Hadi Council of Islamic Leaders (Afghanistan) against kidnapping & harming foreigners 5/05
    Siddiqi, Dr. Muzammil H (U.S.) FCNA Fatwa against terrorism 7/05 – on jihad and terrorism 7/07
    Sultan, Dr. Salah (U.S.) FCNA Fatwa against terrorism 7/05
    Taisaruddin Mufti of Darul Ifta Majidia (Varanasi, India) attacking houses of worship & terrorism
    Ul-Qadri, Tahir – condemns bin Laden (Pakistan)
    U.S. Muslim scholars issue fatwa against terrorism FCNA 7/05
    Usmani, Sh.Grand Mufti, Dar ul Uloom (Punjab, India) terrorism 7/06
    Yilmaz, Mehmed Nuri Directorate of Religious Afairs (Turkey) against 9/11 attack 9/01
    Yassin, Shaykh Ahmad Founder, Islamic Resistance Movement HAMAS (Palestine) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

    Those who believe, fight in the Cause of Allâh, and those who disbelieve, fight in the cause of the (false moujadeem), Tâghût (Satan). So fight you against the friends of Shaitân (Satan). Ever feeble indeed is the plot of Shaitân (Satan the false Moujahedeen ). ] al-Nissa:76.

    Allah said : (Allah has promised, to those among you who believe and work righteous deeds, that He will, of a surety, grant them in the land, inheritance (of power), as He granted it to those before them; that He will establish in authority their religion -the one which He has chosen for them; and that He will change (their state), after the fear in which they (lived), to one of security and peace: 'They will worship Me (alone) and not associate aught with Me. 'If any do reject Faith after this, they are rebellious and wicked.) 55,AlNOOR.


    Allah said: "The punishment of those who wage war against Allah and His Messenger, and strive with might and main for mischief through the land is: execution, or crucifixion, or the cutting off of hands and feet from opposite sides, or exile from the land: that is their disgrace in this world, and a heavy punishment is theirs in the Hereafter." 33:Al-Maeda .



    .A Ramadan letter to Osama bin Laden.
    Had its effect, he quit al qaeda.


    .