Reverse-Engineering Malware Cheat Sheet

This is a cheat sheet of shortcuts and tips for reverse-engineering malware. It covers the general malware analysis process, as well as useful tips for OllyDbg, IDA Pro, and other tools. Feel free to customize it to your own needs. My reverse-engineering malware course explores these, and other useful techniques.

General Approach

1. Set up a controlled, isolated laboratory in which to examine the malware specimen.
2. Perform behavioral analysis to examine the specimen’s interactions with its environment.
3. Perform static code analysis to further understand the specimen’s inner-workings.
4. Perform dynamic code analysis to understand the more difficult aspects of the code.
5. If necessary, unpack the specimen.
6. Repeat steps 2, 3, and 4 (order may vary) until sufficient analysis objectives are met.
7. Document findings and clean-up the laboratory for future analysis.

Behavioral Analysis

Be ready to revert to good state via dd, VMware snapshots,CoreRestore, Ghost, SteadyState, etc.

Monitor local (Process Monitor, Process Explorer) and network (Wireshark, tcpdump) interactions.

Detect major local changes (RegShot, Autoruns).

Redirect network traffic (hosts file, DNS, Honeyd).

Activate services (IRC, HTTP, SMTP, etc.) as needed to evoke new behavior from the specimen.

IDA Pro for Static Code Analysis

Text search	Alt+T
Show strings window	Shift+F12
Show operand as hex value	Q
Insert comment	:
Follow jump or call in view	Enter
Return to previous view	Esc
Go to next view	Ctrl+Enter
Show names window	Shift+F4
Display function's flow chart	F12
Display graph of function calls	Ctrl+F12
Go to program's entry point	Ctrl+E
Go to specific address	G
Rename a variable or function	N
Show listing of names	Ctrl+L
Display listing of segments	Ctrl+S
Show cross-references to selected function	Select function name » Ctrl+X
Show stack of current function	Ctrl+K

OllyDbg for Dynamic Code Analysis

Step into instruction	F7
Step over instruction	F8
Execute till next breakpoint	F9
Execute till next return	Ctrl+F9
Show previous executed instruction	-
Show next executed instruction	+
Return to previous view	*
Show memory map	Alt+M
Follow expression in view	Ctrl+G
Insert comment	;
Follow jump or call in view	Enter
Show listing of names	Ctrl+N
New binary search	Ctrl+B
Next binary search result	Ctrl+L
Show listing of software breakpoints	Alt+B
Assemble instruction in place of selected one	Select instruction » Spacebar
Edit data in memory or instruction opcode	Select data or instruction » Ctrl+E
Show SEH chain	View » SEH chain
Show patches	Ctrl+P

Bypassing Malware Defenses

To try unpacking quickly, infect the system and dump from memory via LordPE or OllyDump.

For more surgical unpacking, locate the Original Entry Point (OEP) after the unpacker executes.

If cannot unpack cleanly, examine the packed specimen via dynamic code analysis while it runs.

When unpacking in OllyDbg, try SFX (bytewise) and OllyDump's "Find OEP by Section Hop".

Conceal OllyDbg via HideOD and OllyAdvanced.

A JMP or CALL to EAX may indicate the OEP, possibly preceded by POPA or POPAD.

Look out for tricky jumps via SEH, RET, CALL, etc.

If the packer uses SEH, anticipate OEP by tracking stack areas used to store the packers' handlers.

Decode protected data by examining results of the decoding function via dynamic code analysis.

Correct PE header problems with XPELister, LordPE, ImpREC,PEiD, etc.

To get closer to OEP, try breaking on unpacker’s calls to LoadLibraryA or GetProcAddress.

In the day I used to have quite a collection of bugs/virii.

But now its so risky, some can get to root and turn invisible,

hide in unusual places, even mark sectors bad and hide there.

Used to lock everything down and then watch them go.

You can't lock everything down any more.

We have special PC for this now, and reformat after.

But even then I'm not 100% confident its gone.

Become a very high risk game.

Its like juggling nitro, could go off even though

you've taken every percaution. It's happened to me

before.

But every once in a while you discover something

than can be used as a cyber sidearm or some other 

mischief.

G

Thanks to:

http://zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html

.

Genius Readers 09.03.10

25% using proxys?

G

.

Al qaeda loosing gone indoors

US has been attriting al qaeda successfully.
Thanks to Islams Secret Mujaheddin,

al qaeda continues to loose popularity and support
with in the Afpak theater, the civilians have seen
the evidence of of them killing Muslims and bombing
market places and Mosques. Dealing drugs and suicide
bombers, HAREM. Even Imams and 

Taliban attacks two Muslim-minority mosques 

al qaeda cult continues to have problems recruiting
new members, and funding. Almost half of the
funding 50% sent to al qaeda cult and the Taliban
is being pocketed by middle men along the way.
Everyone takes a cut as they pass it along,
and even the leadership has squirreled away
nice chunks for after the insurgency fails.

And spies among Muslims against the Taliban
and al qaeda cult are rampant and available in
legions.
Internet Anthropologist Think Tank: Afghanistan's Secret Mujaheddin,

"Critics also fail to realize that a single Al Qaeda operative’s knowledge and experience in guerrilla and terror tactics is of incalculable value as a force multiplier to the Taliban."


"Al Qaeda’s Arab operatives are considered a fearless elite. They have knowledge of Islam that makes them seem like religious scholars to many Pashtun tribesmen, who they have led into battle in the past."


They are also considered arrogant and abusive and a little dense.



"Today, as they withstand CIA’s withering drone onslaught in Pakistan’s tribal belt, the Arabs are more low-key in their Afghan ops than they were in the past. The CIA’s targeted killing of Skeik Mustafa Abu al-Yazid after he left Mir Ali may also have impacted their activities on the other side of the AfPak.
Arabs from Al Qaeda still fund and train the Taliban, but no longer lead operations from the front, Army Col. Donald C. Bolduc, who leads the Combined Joint Special Operations Task Force, told me in his office at Bagram Airfield this month."
Sourced from:
http://counterterrorismblog.org/2010/08/the_real_truth_about_al_qaeda.php

They no longer go into the field, but stay behind in safety.
Sending the Taliban's best and dumbest into stupid battles.

al qaeda consider themselves to be better than the Taliban,  elite snobs.
And the Taliban cadre are confused and angry.

Taliban fighting is under staffed and poor morale.

TALIBAN RANK AND FILE UNDER STAFFED/MANNED.

Jewish American leader of al qaeda cult.

"During the winter, Taliban leaders ensconced in Pakistan send in Al Qaeda operatives to train their fighters in bombmaking tradecraft during the lull in fighting, sources said."

“The Pakistani madrassahs are still the big recruiting and training place. The Afghans go to a madrassah in Pakistan, where an Arab is typically like the dean, or headmaster, and learn how to fight,” the official told me. “Then the Afghan goes back home and teaches others to build bombs or fight — and gets paid handsomely for it.”

"Meanwhile, as we reported in today's New York Daily News, Taliban leaders in key Afghanistan districts have been "shwacking" each other (Special Forces term) to jockey for "permanent" leadership positions after the U.S. begins to draw down forces next year."


Maybe US should announce plans for the 2012 withdrawal, could lead to more
Shwaking, its not like the Taliban have any Honor. They will kill their own for
the right price.


In this war US continues to have high suicide rates, but US sends their's
to therapy, while the Taliban and al qaeda cult strap bombs on them instead
of trying to help them.


What ever the US forces are suffering al qaeda and Taliban suffer 10 fold.
Taliban's Secret wounded part I

Taliban Secret wounded part II




Taliban and al qaeda cult is desperate last ditch
effort to re-establish momentum.


Even Bin Laden and Mulla Omar have gone AWOL
deserting the insurgents hopeless cause.
Giving up the fight.
Binny's effort at bastardizing Islam is failing,
and Moslems will be their down fall.


Every where they go there are Muslim spies
willing to turn them in for the grace of Allah
and good of Islam.


US and Islam continue to crush al qaeda and
the Taliban.




Muslims issue fatwa against bin Laden - Times Online  Spain
Fatwa Issued Against Osama Bin Laden and Al Qaida « Afghanistan 
Taisaruddin Mufti of Darul Ifta Majidia (Varanasi, India) issued a Fatwa

Gerald
Anthropologist




Muslim Ulemas and Imams, over 6,000 :
.Abdulkadir, Dr. Deina FCNA (U.S.) Fatwa against terrorism 7/05

Abdullah, Shaikh Muhammad Nur (U.S.) FCNA Fatwa against terrorism 7/05

Afghan clerics issue fatwa against bin Laden 1999

al Alwani, Shaykh Taha Jabir (U.S.) against 9/11 attack 9/01

Al Alwani, Dr. Taha Jabir (U.S.) FCNA Fatwa against terrorism 7/05

Al-Awdah, Shaykh Salman (Saudi Arabia) condemns terrorism 5/03

Al Hanooti, Shaikh Muhammad (U.S.) FCNA Fatwa against terrorism 7/05

al-Hanooti, Sheikh Muhammad Ali – against 9/11 (U.S.) 9/01

al-Hitar, Judge Hamoud (Yemen) he and four other Islamic scholars used Qur’an to challenge Al Qaeda’s views on terror 2/05

al Luheidan, Shaikh Saleh Chairman of the Supreme Judicial Council (Saudi Arabia) against 9/11 9/01

al Qaradawi, Shaykh Yusuf (Qatar) against 9/11 attack 9/01

Al-Qaradawi, Shaykh Yusuf – condemns Bali attacks 10/02

al-Qaradawi, Shaykh Yusuf – against harming places of worship (specifically a Jewish synagogue) 4/02

al Sabil, Shaykh Muhammad bin ‘Abdallah member of the Council of Senior Religious Scholars (Saudi Arabia) against terrorism, obligation to protect non Muslims 12/01 Agence France Press

al Saffar, Hasan Shiite Islamic Spokesperson (Saudi Arabia) 2/06 Danish cartoons

al-Shaykh, Shaykh Abd al-Aziz bin Abdallah Aal of Saudi Arabia issues fatwa against suicide terrorist attacks 4/2001

al-Sistani, Grand Ayatollah Ali issues fatwa to Muslims in Western nations, urging them to obey the laws of the countries in which they live. 6/06

Al Tantawi, Shaykh Muhammed Sayyid Imam of al Azhar Mosque (Egypt) against 9/11 attack 9/01

Al-Tantawi, Sheikh Muhammad Syed (Egypt) Condemned suicide bombings against Israeli civilians, and all terrorism 12/01

Alush Shaykh, Shaykh ‘Abdul ‘Aziz Grand Mufti (Saudi Arabia) against 9/11 attack 9/01

Alush Shaykh, Shaykh ‘Abdul ‘AzizGrand Mufti (Saudi Arabia) against suicide terrorism 5/01

Awwa, Muhammad S (Egypt) against 9/11 attack 9/01

Badawi, Dr. Jamal (U.S.) FCNA Fatwa against terrorism 7/05

Bagby, Dr. Ihsan (U.S.) FCNA Fatwa against terrorism 7/05

Bayyoumi, Abdel Mo’tei al Azhar Islamic Research Academy, Cairo (Egypt) against 9/11 attack 9/01

Belkaziz, Dr. AbdelaouahedSecretary General of the OIC against 9/11 attack 9/01

Bishri, Tariq (Egypt) against 9/11 attack 9/01

 120 Canadian Imams issue fatwa against terrorism and extremism 7/05

Mustafa Ceric, Grand Mufti of Bosnia – A Declaration of European Muslims

Fadlallah, Muhammad Husayn Renowned Shiite Scholar (Lebanon) against 9/11 9/01

French Muslim Leaders Rioting, 11/05

Ghannoushi, Rashid President, Nahda Renaissance Movement (Tunisia) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Hammad, Dr. Nazih (U.S.) FCNA Fatwa against terrorism 7/05

Hindi, Shaikh Yahya (U.S.) FCNA Fatwa against terrorism 7/05

Huwaydi, Fahmi (Egypt) against 9/11 attack 9/01

Jackson, Dr. Abdul Hakim (U.S.) FCNA Fatwa against terrorism 7/05

Khamene’i, Ayatollah Ali supreme jurist ruler of (Iran) ** “Killing of people, in any place and with any kind of weapons, including atomic bombs, long range missiles, biological or chemical weapons, passenger or war planes, carried out by any organization, country or individuals is condemned. … It makes no difference whether such massacres happen in Hiroshima, Nagasaki, Qana, Sabra, Shatila, Deir Yassin, Bosnia, Kosovo, Iraq or in New York and Washington.” ** Islamic Republic News Agency, September 16, 2001,

Khatami, Muhammad President (Iran) at U.N. against 9/11 attack 9/01

Khayyat, Haytham (Syria) against 9/11 attack 9/01

Maghraoui, Dr. Mukhtar (U.S.) FCNA Fatwa against terrorism 7/05

Mustafa Mashhur General Guide, Muslim Brotherhood (Egypt) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Muhammad, Dr. Akbar (U.S.) FCNA Fatwa against terrorism 7/05

Nizami, Mufti Rahman, Ameer Jamaat e Islami (Bangladesh) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Nour, Fazil President, PAS Parti Islam Se (Malaysia) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Qadri, Tahirul head of the Awami Tehrik Party (Pakistan) against 9/11 attack 10/01

Qazi Hussain Ahmed Ameer, Jamaat e Islami (Pakistan) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Qazwini, Shaikh Hassan (U.S.) FCNA Fatwa against terrorism 7/05

Rabbani, Shaykh Faraz on kidnapping and terrorism

Saudi religious scholars issue fatwa against terrorism 6/04

Sayf, Ahmad NurDirector of Islamic Sciences & Research Institute (UAE) 2/06 Danish cartoons

Al-Tantawi, Shaykh M. Sayyid condemns bin Laden 11/01

Shah, Dr. Zulfiqar Ali (U.S.) FCNA Fatwa against terrorism 7/05

Shleibak, Dr. Ahmad (U.S.) FCNA Fatwa against terrorism 7/05

Sheikh, Dr. Muhammad Adam (U.S.) FCNA Fatwa against terrorism 7/05

Shinwari, Fazli Hadi Council of Islamic Leaders (Afghanistan) against kidnapping & harming foreigners 5/05

Siddiqi, Dr. Muzammil H (U.S.) FCNA Fatwa against terrorism 7/05 – on jihad and terrorism 7/07

Sultan, Dr. Salah (U.S.) FCNA Fatwa against terrorism 7/05

Taisaruddin Mufti of Darul Ifta Majidia (Varanasi, India) attacking houses of worship & terrorism

Ul-Qadri, Tahir – condemns bin Laden (Pakistan)

U.S. Muslim scholars issue fatwa against terrorism FCNA 7/05

Usmani, Sh.Grand Mufti, Dar ul Uloom (Punjab, India) terrorism 7/06

Yilmaz, Mehmed Nuri Directorate of Religious Afairs (Turkey) against 9/11 attack 9/01

Yassin, Shaykh Ahmad Founder, Islamic Resistance Movement HAMAS (Palestine) condemning 9/11 attack 9/01 signed by 46 scholars & leaders

Those who believe, fight in the Cause of Allâh, and those who disbelieve, fight in the cause of the (false moujadeem), Tâghût (Satan). So fight you against the friends of Shaitân (Satan). Ever feeble indeed is the plot of Shaitân (Satan the false Moujahedeen ). ] al-Nissa:76.

Allah said : (Allah has promised, to those among you who believe and work righteous deeds, that He will, of a surety, grant them in the land, inheritance (of power), as He granted it to those before them; that He will establish in authority their religion -the one which He has chosen for them; and that He will change (their state), after the fear in which they (lived), to one of security and peace: 'They will worship Me (alone) and not associate aught with Me. 'If any do reject Faith after this, they are rebellious and wicked.) 55,AlNOOR.

Allah said: "The punishment of those who wage war against Allah and His Messenger, and strive with might and main for mischief through the land is: execution, or crucifixion, or the cutting off of hands and feet from opposite sides, or exile from the land: that is their disgrace in this world, and a heavy punishment is theirs in the Hereafter." 33:Al-Maeda .



.A Ramadan letter to Osama bin Laden.
Had its effect, he quit al qaeda.


.