Reverse Engineering

Windows Network Monitor

Windows Debugger (WinDBG) Standalone Downloads http://codemachine.com/downloads.html

Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

Process injection info graphic

A source for pcap files and malware samples... http://www.malware-traffic-analysis.net/

Persistent IAT hooking application - based on bearparser https://github.com/hasherezade/IAT_patcher

https://youtu.be/1RNcZpBLZHs Manual unpacking using dnspy and class constructor ( .cctor ) Note. No need actually for using ilspy you can modify the entry point by editing module settings: Right click on it in modules tree Edit module Choose mananged Choose the main method Save module

Deobfuscate strings using De4dot https://github.com/0xd4d/de4dot d4dot.exe -strtyp delegate -strtok <deobfuscation function token> <file>

Radare2 Emulation commands initialize emulation: aei deinitialize emulation: aed emulate a whole function: aef single-step: aes

Four Ways to Bypass Android SSL Verification and Certificate Pinning https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/

This script creates a NATed or Bridged WiFi Access Point. https://github.com/oblique/create_ap

Non-HTTP Protocol Extension (NoPE) Proxy and DNS for Burp Suite. https://github.com/summitt/Burp-Non-HTTP-Extension

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection. https://github.com/LordNoteworthy/al-khaser

PE 101/102 - a windows executable walkthrough https://github.com/corkami/pics/tree/master/binary/pe101 https://github.com/corkami/pics/tree/master/binary/pe102

DLL import hinting https://blogs.msdn.microsoft.com/oldnewthing/20100317-00/?p=14573/

EXPLORING THE PE FILE FORMAT VIA IMPORTS DLL Name RVA: A pointer (address) to the name of the imported DLL. Import Address Table (IAT) RVA is populated by the loader when the executable and its imported DLLs are mapped into memory, and it is a table of pointers to the imported functions. Each entry in the table is called a “thunk” and the table is referred to as a “thunk table.” With that in mind, the RVA in this field points to the address of the imported function within the IAT https://malwology.com/2018/10/05/exploring-the-pe-file-format-via-imports/