Skip to content

Commit 13caffa

Browse files
pedramaminipedramamini
committed
initial import.
1 parent 82695a0 commit 13caffa

File tree

1,602 files changed

+489446
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,602 files changed

+489446
-0
lines changed

‎Makefile

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
LATEX_FILE=render.article
2+
3+
all:
4+
<<<<<<< .mine
5+
rm ${LATEX_FILE}.{toc,aux,log,nav,out,pdf,snm}; pdflatex ${LATEX_FILE}.tex && pdflatex ${LATEX_FILE}.tex
6+
7+
=======
8+
rm ${LATEX_FILE}.{toc,aux,log,nav,out,pdf,snm,vrb} 2>/dev/null; pdflatex ${LATEX_FILE}.tex && pdflatex ${LATEX_FILE}.tex; rm ${LATEX_FILE}.{toc,aux,log,nav,out,snm,vrb} 2>/dev/null;
9+
>>>>>>> .r102

‎Makefile.mine

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
#LATEX_FILE=render.presentation
3+
LATEX_FILE=render.article
4+
5+
all:
6+
rm ${LATEX_FILE}.{toc,aux,log,nav,out,pdf,snm}; pdflatex ${LATEX_FILE}.tex && pdflatex ${LATEX_FILE}.tex
7+

‎Makefile.r102

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
LATEX_FILE=render.article
2+
3+
all:
4+
rm ${LATEX_FILE}.{toc,aux,log,nav,out,pdf,snm,vrb} 2>/dev/null; pdflatex ${LATEX_FILE}.tex && pdflatex ${LATEX_FILE}.tex; rm ${LATEX_FILE}.{toc,aux,log,nav,out,snm,vrb} 2>/dev/null;

‎Makefile.r86

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
LATEX_FILE=render.presentation
3+
4+
all:
5+
rm ${LATEX_FILE}.{aux,log,nav,out,pdf,snm,toc}; pdflatex ${LATEX_FILE}.tex
6+

‎TODO.txt

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
* Restructure the PE format section. I like the order you suggested dealing with it at a high-level first, showing it in Olly/LordPE and then start digging into the details of relevant headers...
2+
3+
* Make a high-level, abstract view of a PE file; headers, directories and sections (with file layout and in-memory layout). Show code/data separation. Talk about virtual and raw addresses. Show that in the context of the overall memory space layout of the application, zooming out
4+
5+
* I also want to do some quick drawings for the packer exercise depicting the slack space, the stub code, etc, just to make it more obvious what we are doing.
6+
7+
* Add section about OEP finding (I have my code laying around, do you have yours?)
8+
-Get scripts
9+
-Add basic slides (in packer reconstruction)
10+
-Commit
11+
12+
* Add mention of IDA's fixes for certain PE parsing problems and anti-disassembly tricks
13+
14+
* pydbg dumping + pefile import reconstruction (I have scripts to do a full dump with pydbg/vtrace and then do a "find-intermodular-calls" with the help of pefile)
15+
-Add small section in packer reconstruction, pose it as an exercise
16+
17+
* prolog finding and image reconstruction (have scripts to clean-up a dump, could have some notes on those)

‎Training CD/Exercise Solutions/Anti-Analysis/0x90-fixed.exe

288 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Packer Construction/crypted.exe

28 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Unpacking/OpenRCE ASPack Notes.txt

+111
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
------------------------------------------------------------------------------------------------------------------------
2+
Notes
3+
------------------------------------------------------------------------------------------------------------------------
4+
This is an easy one to find the OEP of.
5+
6+
Single step through a couple of opcode tricks and into the main unpack loop. You should notice a JNZ to a *very* distant address.
7+
8+
This distant address turns out to be the end of the packer.
9+
10+
11+
------------------------------------------------------------------------------------------------------------------------
12+
Transfer Command
13+
------------------------------------------------------------------------------------------------------------------------
14+
push [patched value]
15+
ret
16+
17+
18+
------------------------------------------------------------------------------------------------------------------------
19+
Entry Point Signature
20+
------------------------------------------------------------------------------------------------------------------------
21+
22+
.aspack:00412001 public start
23+
.aspack:00412001 start proc near
24+
.aspack:00412001 pusha
25+
.aspack:00412002 call skipBytes
26+
.aspack:00412002 ; ---------------------------------------------------------------------------
27+
.aspack:00412007 db 0E9h
28+
.aspack:00412008 ; ---------------------------------------------------------------------------
29+
.aspack:00412008 jmp short loc_41200E ; ret address
30+
.aspack:0041200A ; ---------------------------------------------------------------------------
31+
.aspack:0041200A
32+
.aspack:0041200A skipBytes: ; CODE XREF: start+1p
33+
.aspack:0041200A pop ebp ; = fx ret addr after call (412007)
34+
.aspack:0041200B inc ebp
35+
.aspack:0041200C push ebp
36+
.aspack:0041200D retn
37+
.aspack:0041200D start endp ; sp = -20h
38+
.aspack:0041200D
39+
40+
.aspack:0041200E
41+
.aspack:0041200E loc_41200E: ; CODE XREF: start+7j
42+
.aspack:0041200E call loc_412014
43+
.aspack:0041200E ; ---------------------------------------------------------------------------
44+
.aspack:00412013 db 0EBh
45+
.aspack:00412014 ; ---------------------------------------------------------------------------
46+
.aspack:00412014
47+
.aspack:00412014 loc_412014: ; CODE XREF: .aspack:loc_41200Ep
48+
.aspack:00412014 pop ebp
49+
.aspack:00412015 mov ebx, 0FFFFFFEDh
50+
.aspack:0041201A add ebx, ebp
51+
.aspack:0041201C sub ebx, 12000h
52+
.aspack:00412022 cmp dword ptr [ebp+422h], 0
53+
.aspack:00412029 mov [ebp+422h], ebx
54+
.aspack:0041202F jnz END_OF_PACKER
55+
56+
.aspack:0041239A END_OF_PACKER:
57+
58+
.aspack:0041239A
59+
.aspack:0041239A mov eax, 0A870h ; original entry point offset
60+
.aspack:0041239F push eax
61+
.aspack:004123A0 add eax, [ebp+422h] ;add image base to offset
62+
.aspack:004123A6 pop ecx
63+
.aspack:004123A7 or ecx, ecx
64+
.aspack:004123A9 mov [ebp+3A8h], eax ;patch 004123BA to be push [offset]
65+
.aspack:004123AF popa
66+
.aspack:004123B0 jnz short loc_4123BA
67+
.aspack:004123B2 mov eax, 1
68+
.aspack:004123B7 retn 0Ch ; error exit ?
69+
.aspack:004123BA ; ---------------------------------------------------------------------------
70+
.aspack:004123BA
71+
.aspack:004123BA loc_4123BA: ; CODE XREF: .aspack:004123B0j
72+
.aspack:004123BA push 0 ; put a ret addr on stack
73+
.aspack:004123BF retn ; ret to pushed address
74+
75+
76+
77+
------------------------------------------------------------------------------------------------------------------------
78+
Known Unpackers
79+
------------------------------------------------------------------------------------------------------------------------
80+
81+
// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
82+
/*
83+
Find target's OEP [ ASPack v2.12 ] v0.1
84+
---------------------------------------
85+
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
86+
Email : [email protected]
87+
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92
88+
Date : 09.10.2004
89+
Config: No BreakPoint sets
90+
Note : Any bug or comments, please report at [email protected]
91+
That's all folks!
92+
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aur�nya :P
93+
*/
94+
95+
eob Rompe
96+
findop eip, #6800000000#
97+
bphws $RESULT, "x"
98+
run
99+
100+
Rompe:
101+
bphwc $RESULT
102+
sto
103+
sto
104+
log "El OEP del programa es:"
105+
log eip
106+
log "Dumpealo ahora y repara la IAT automaticamente con el IREC"
107+
log "Script CracksLatinos by DeAtH #eCh!2004"
108+
log "@: [email protected] WWW: http://www.ech2004.tk"
109+
msg "Script finalizado correctamente. Ahora esta parado en el OEP, dumpealo y arregla la IAT :D"
110+
111+
ret

‎Training CD/Exercise Solutions/Unpacking/OpenRCE UPX Notes.txt

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
------------------------------------------------------------------------------------------------------------------------
2+
Notes
3+
------------------------------------------------------------------------------------------------------------------------
4+
IAT built at runtime Dlls loaded by loader one api entry per dll left
5+
6+
7+
------------------------------------------------------------------------------------------------------------------------
8+
Transfer Command
9+
------------------------------------------------------------------------------------------------------------------------
10+
11+
61 POPAD
12+
E9 [4Bytes] JMP [offset]
13+
14+
15+
------------------------------------------------------------------------------------------------------------------------
16+
Entry Point Signature
17+
------------------------------------------------------------------------------------------------------------------------
18+
19+
60 PUSHAD
20+
BE [4 Bytes] MOV ESI[Value]
21+
8DBE [4 bytes] LEA EDI, DWORD PTR DS:[ESI+Value]
22+
57 PUSH EDI
23+
83CD FF OR EBP, FFFFFFFF
24+
EB 10 JMP SHORT [Relative Jump]
25+
90 NOP
26+
90 NOP
27+
90 NOP
28+
90 NOP
29+
90 NOP
30+
90 NOP
31+
32+
33+
------------------------------------------------------------------------------------------------------------------------
34+
Known Unpackers
35+
------------------------------------------------------------------------------------------------------------------------
36+
37+
//OllyScript Oep finder by shag
38+
// The amazing UPX OEP finder v2
39+
// This script will quickly put you at the OEP of an UPX-packed EXE.
40+
// Just run it!
41+
// Implemented using hardware breakpoints (just for fun).
42+
43+
eob Break
44+
findop eip, #61#
45+
bphws $RESULT, "x"
46+
run
47+
48+
Break:
49+
sto
50+
sto
51+
bphwc $RESULT
52+
ret

‎Training CD/Exercise Solutions/Virii/Analysis I/04c94ee7122a2844e12afe0928806fa0-dump.idb

343 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Virii/Analysis I/04c94ee7122a2844e12afe0928806fa0.idb

114 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Virii/Analysis II/0af7b122bb722fb679c97fdb8cf85d23-dropped-dumped.idb

1.12 MB
Binary file not shown.

‎Training CD/Exercise Solutions/Virii/Analysis II/0af7b122bb722fb679c97fdb8cf85d23-dump1.idb

126 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Virii/Analysis II/0af7b122bb722fb679c97fdb8cf85d23-dumped-2nd-stage.idb

293 KB
Binary file not shown.

‎Training CD/Exercise Solutions/Virii/Analysis II/0af7b122bb722fb679c97fdb8cf85d23.idb

123 KB
Binary file not shown.

0 commit comments

Comments
 (0)