Learn Cyber Security

How to Defeat Code Obfuscation While Reverse Engineering Introduction Obfuscation, or code distortion, is found in binaries where the programmer wanted to hide the original code. The programmer might be working for a major company that does not want their source code stolen. The programmer might also be a malware author who is attempting to make the malware binary appear legitimate. Either way, it is common practice in the malware and legitimate software industries to employ obfuscation techniques. In this article, you will learn about various methods involved in breaking open the code and revealing the chewy center where the legitimate code resides. It will discuss how to deal with packed binaries and how to extract obfuscated data directly from memory. Unpacking Packer algorithms are employed in order to distort the code of a compiled binary. A packing application takes the algorithm, runs the data of the binary through it, and attaches a decryption routine to the binary. The...

How to Identify and Bypass Anti-reversing Techniques Learn the anti-reversing techniques used by malware authors to thwart the detection and analysis of their precious malware. Find out about the premier shareware debugging tool Ollydbg and how it can help you bypass these anti-reversing techniques. This article aims to look at anti-reversing techniques used in the wild. These are tricks used by malware authors to stop or impede reverse engineers from analysing their files. As an entry level article we will look at: • Setting up a safe analysis environment • Ollydbg an X86 debugger • Basic techniques like;     • Verification of dropped location     • Anti-debugger     • Obfuscation of strings     • Hiding APIs     • Anti-Virtualisation We will look at the code as written by the malware authors in C++. We will compare this code to the debugger code in Ollydbg. Ollydbg is the x86 debugger of choice for reverse engine...

Deep Inside Malicious PDF Nowadays, people share documents all the time and most of the attacks are based on client side attacks and target applications that exist in the user’s, or employee’s OS. From one single file, the attacker can compromise a large network. PDF is the most common sharing file format, due to the fact that PDFs can include active content, and are passed within the enterprise and across networks. In this article, we will analyze ways to catch malicious PDF files. When we start to check the PDF files that exist in our PC or laptop, we may use an antivirus scanner but these days it might not be good enough to detect a malicious PDF that contains a shell code because the attacker mostly encrypts its content to bypass the antivirus scanner and, many times, targets a zero day vulnerability that exists in Adobe Acrobat reader or a version that has not been updated. Figure 1 shows how PDF vulnerabilities are rising every year. Before we start to analyze malicious PDF...

Android Reverse Engineering: an Introductory Guide to Malware Analysis The Android malware has followed an exponential growth rate in recent years, in parallel with the degree of penetration of this system in different markets. Currently, over 90% of the threats to mobile devices have Android as a main target. This scenario has led to the demand for professionals with a very specific knowledge on this platform. The software reverse engineering, according to Chikofsky and Cross [1], refers to the process of analyzing a system to identify its components and their interrelationships, and create representations of the system in another form or a higher level of abstraction. Thus, the purpose of reverse engineering is not to make changes or to replicate the system under analysis, but to understand how it was built. The best way to tackle a problem of reverse engineering is to consider how we would have built the system in question. Obviously, the success of the mission depends larg...