born – Page 2 – nullteilerfrei

Java Test Coverage and The Missing Path

born code, technology 2020-09-20

I started learning JUnit 4 and encountered the message "1 of 4 branches missed." when testing a code fragment like x && y where x and y depend on each other in a particular way. Here is my journey and a "solution". You want to know more? !

Which Raspberry Pi do I have?

born hardware, technology 2020-09-19

Run

grep Revision /proc/cpuinfo

and look it up on https://elinux.org/RPi_HardwareHistory. For posterity I copied the table by the time of writing...!

VMware for Homelab

born technology

I am currently comparing different virtualization solutions for my home. This is because I want to do all kinds of things like openhab, cronjobs, DNS-based adblocking, and gateways both in via SSH and out via different VPNs/Tor, and splitting those into different machines sounds not only reasonable but is also necessary in some cases when there are different operating systems involved. This blag post will document a few nuggets of knowledge I collected while trying out VMware as hypervisor. You want to know more?

Programmatically NOP the Current Selection in Ghidra

born malware-analysis, technology 2020-08-23

The Zlob malware contains lots of bogus API calls to hinder analysis. This blag post describes how to use a script in Ghidra to automate the process of patching out those calls with NOP instructions. Is that even hard?!

Custom JSONEncoder and JSONDecoder to handle datetime in Python’s json library

born technology 2020-07-11

Sometimes it really surprises me how something as mundane as JSON encoding and decoding datetime objects in Python is not readily solve-able with a simple google query. I guess this is caused by the sheer amount of code fragments floating around confusing The Kraken. With this blag post, I'd happily like to add to this mess: Show me your code snippet!

How to Update ArangoDb when running it in Docker

born technology 2020-06-28

Since I already ran into this problem twice, here is a tiny reminder for my future self and potentially others that google something along the lines of the title. If you did docker pull arangodb at some point in the past, then ran a ArangoDB container for a while with something like the command blow and want to update, just follow the error messages! Follow them already!

API Hashing in the Zloader malware

born malware-analysis, technology 2020-06-11

Directing your attention as a reverse engineer is key for not wasting your life looking at irrelevant code. This blag post will use an anti-analysis technique used in the Zloader malware as an example to practice this art. We will also take a short detour into code-level obfuscation and are going to re-implement the API hashing function from Zloader in Python. This post is aimed towards reverse engineering beginners that have already heard about API hashing. If you don't know, what Ghidra is or how to use it, you will need to brush over some parts of this post. Tell me everything!

String Obfuscation in the Hamweq IRC-bot

born malware-analysis 2020-05-31

In this blog post, we will follow one of herrcore's awesome videos and re-implement the automation as a Ghidra script in Java. The video in question is part of a series about a legacy malware family called Hamweq. CERT Polska published an extensive analysis of Hamweq: The malware implements a IRC-based botnet with worm-like capabilities. In this post we will solely focus on the string deobfuscation functionality in the malware. Show me what you got!

Zloader String Obfuscation

born malware-analysis, technology 2020-05-24

This blag post describes my though-process during identification of the string deobfuscation method in a sample belonging to the Zloader malware family. Specifically, I wanted to identify the function or functions responsible for string deobfuscation only using static analysis and Ghidra, understand the algorithm, emulate it in Java and implement a Ghidra script to deobfuscate all strings in a binary of this family. The target audience of this post are people that have some experience with static reverse engineering and Ghidra but who always asked themselves how the f those reversing wizards identify specific functionality within a binary without wasting hours, days and weeks. Show me what you got!

Use Ghidra to decrypt strings of KpotStealer malware

born malware-analysis, technology 2020-04-26

This post will explain, how to identify a function responsible for string deobfuscation in a native-PE malware sample. We will use a KpotStealer sample as a concrete example. KpotStealer (aka Khalesi or just Kpot) is a commodity malware family probably circulated in the shadowy parts of the internet since 2018. It got its name from a string publicly present on the Admin-Panel. After we found the function we will understand the data structure it uses and emulate the decryption of a string with CyberChef and Binary Refinery. An interesting detail here is that Ghidra currently does not guess the function signature correctly. Finally, we will develop a Java script (hehe) for Ghidra to automatically deobfuscate all strings given the corresponding obfuscation function. Show me what you got!

Defeating Sodinokibi/REvil String-Obfuscation in Ghidra

born malware-analysis, technology 2020-02-02

This post describes the memory layout as well as the method used by the Sodinokibi (or REvil) ransomware to protect its strings. It will then list a few Java snippets to interact with the Ghidra scripting API and finally explain a working script to deobfuscate all strings within a REvil sample. If you don't care about the explaination, you can find the most recent version of the script you can simply import into Ghidra on github. I want it all.

Ghidra Scripts in Java & A Snippet to GetOriginalBytes

born malware-analysis, technology

Since the temperature of scripting in Ghidra is so high at the current point in time, I want to tell you that scripting it in Java is so much better than scripting it in Python. After that I'll randomly motivate why one wants to get the "original bytes" from a sample and how to do it. Show me what you got!

UPX packed ELF binaries of the Peer-to-Peer Botnet Family Mozi

born malware-analysis, technology 2019-12-26

Found another rabbit hole! While reading my daily digest of tubes [an article about the Mozi bot](https://blog.netlab.360.com/mozi-another-botnet-using-dht/) sparked my interest. Peer-to-peer (P2P) botnets are always cool and this one has some worm-like capabilities and seems to hide its traffic within bittorrent communications. Naturally I wanted to take a look at the sample. But you will not believe, what happened next!