diff --git a/idacheatsheet.html b/idacheatsheet.html new file mode 100644 index 0000000..d486637 --- /dev/null +++ b/idacheatsheet.html @@ -0,0 +1,190 @@ + + + + + + + + + + + + + + + + + +
+

IDAPro
Cheat Sheet

+ + + + + + + + + + + + + + + + +

Navigation

Jump to operandEnter
Jump in new windowAlt+Enter
Jump to previous positionEsc
Jump to Next positionCtrl+Enter
Jump to addressG
Jump by nameCtrl+L
Jump to functionCtrl+P
Jump to segmentCtrl+S
Jump to segment registerCtrl+G
Jump to problemCtrl+Q
Jump to cross referenceCtrl+X
Jump to xref to operand X
Jump to entry pointCtrl+E
Mark PositionAlt+M
+ + + + + + + + + + + + + +

Search

Next codeAlt+C
Next dataCtrl+D
Next exploredCtrl+A
Next unexploredCtrl+U
Immediate valueAlt+I
Next immediate valueCtrl+I
TextAlt+T
Next textCtrl+T
Sequence of bytesAlt+B
Next sequence of bytesCtrl+B
Not functionAlt+U
+ + + + +

Graphing

Flow chartF12
Function callsCtrl+F12
+ + + + + + + +

Comments

Enter commentShift+;
Enter repeatable comment;
Enter anterior linesIns
Enter posterior linesShift+Ins
Insert predefined commentShift+F1
+ + + + +

Data Format Options

ASCII strings styleAlt+A
Setup data typesAlt+D
+		 + + + + + + + + + + + +

Open Subviews

NamesShift+F4
FunctionsShift+F3
StringsShift+F12
SegmentsShift+F7
Segment registersShift+F8
SignaturesShift+F5
Type librariesShift+F11
StructuresShift+F9
EnumerationsShift+F10
+ + + + + + + + +

File Operations

Parse C header fileCtrl+F9
Create ASM fileAlt+F10
Save databaseCtrl+W
+ + + + + + + + + + + +

Debugger

Star processF9
Terminate processCtrl+F2
Step intoF7
Step overF8
Run until returnCtrl+F7
Run to cursorF4
Breakpoints
Breakpoint listCtrl+Alt+B
+ + + + +

Watches

Delete watchDel
+ + + + +

Tracing

Stack traceCtrl+Alt+S
+ + + + + + + + + +

Miscellaneous

CalculatorShift+/
Cycle through open viewsCtrl+Tab
Select tabAlt + [1…N]
Close current viewCtrl+F4
ExitAlt+X
IDC CommandShift+F2
+ +		 + + + + + + + + + + + + +

Edit (Data Types – etc)

CopyCtrl+Ins
Begin selectionAlt+L
Manual instructionAlt+F2
CodeC
DataD
Struct variableAlt+Q
ASCII stringA
ArrayNum *
UndefineU
RenameN
+ + + + + + + + + + + + + + + + + + + + +

Operand Type

Offset (data segment)O
Offset (current segment)Ctrl+O
Offset by (any segment)Alt+R
Offset (user-defined)Ctrl+R
Offset (struct)T
Number (default)Shift+3
HexadecimalQ
DecimalH
BinaryB
CharacterR
SegmentS
Enum memberM
Stack variableK
Change signShift+-
Bitwise negate Shift+`
ManualAlt+F1
+ + + + + +

Segments

Edit segmentAlt+S
Change segment register valueAlt+G
+ + + + + + +

Structs

Struct varAlt+Q
Force zero offset fieldCtrl+Z
Select union memberAlt+Y
+ + + + + + + + + + + +

Functions

Create functionP
Edit functionAlt+P
Set function endE
Stack variablesCtrl+K
Change stack pointerAlt+K
Rename registerV
Set function typeY
+
+ + + + + + \ No newline at end of file diff --git a/images/Alt-50.png b/images/Alt-50.png new file mode 100644 index 0000000..78f6b07 Binary files /dev/null and b/images/Alt-50.png differ diff --git a/images/Ctrl-50.png b/images/Ctrl-50.png new file mode 100644 index 0000000..0e0d8e4 Binary files /dev/null and b/images/Ctrl-50.png differ diff --git a/images/Enter-50.png b/images/Enter-50.png new file mode 100644 index 0000000..e88513e Binary files /dev/null and b/images/Enter-50.png differ diff --git a/images/Shift-50.png b/images/Shift-50.png new file mode 100644 index 0000000..1fbb5d8 Binary files /dev/null and b/images/Shift-50.png differ diff --git a/malware.md b/malware.md index 58b269a..efc1946 100644 --- a/malware.md +++ b/malware.md @@ -43,7 +43,7 @@ title: Malware Techniques * [Enigma Protector](http://www.enigmaprotector.com) * [EXE Bundle](http://www.webtoolmaster.com/exebundle.htm) * [EXE Stealth](http://www.webtoolmaster.com/exestealth.htm) - * [eXPressor(http://www.cgsoftlabs.ro/express.html) + * [eXPressor](http://www.cgsoftlabs.ro/express.html) * [FSG](http://xtreeme.prv.pl/) * [kkrunchy](http://www.farbrausch.de/~fg/kkrunchy/) * [MEW](https://web.archive.org/web/20070831063728/http://northfox.uw.hu/index.php?lang=eng&id=dev) @@ -58,6 +58,8 @@ title: Malware Techniques * [VMProtect](http://vmpsoft.com/products/vmprotect) * [XComp/XPack](http://soft-lab.de/JoKo) +
[Top^](#techniques-overview)
+ ## Obfuscation * Deliberate act of creating obfuscated code that is difficult for humans to understand @@ -116,15 +118,26 @@ Example: Mimikatz credential theft * Gain knowledge about the system and internal network. -## Lateral Movement +## Lateral Movement + +* Enable an adversary to access and control remote systems on a network and could ## Execution +* Techniques that result in execution of adversary-controlled code on a local or remote system +* scripts +* post-exploitation + ## Collection +* Identify and gather information, such as sensitive files, from a target network prior to exfiltration + ## Exfiltration +* Removing files and information + ## Command and Control +* Communicate with systems under their control [x86 Assembly <- Back](https://securedorg.github.io/RE101/section1.3) | [Next -> Section 3](https://securedorg.github.io/RE101/section3) diff --git a/retools.md b/retools.md index 51b4ded..61e6a53 100644 --- a/retools.md +++ b/retools.md @@ -7,10 +7,42 @@ title: RE Tools # Section 3: Reverse Engineering (RE) Tools # -* Disassembler -* Decompilers -* Debugger -* Information Gathering -* Support + +## Disassembler + +* [Ida](https://www.hex-rays.com/products/ida/) + * Free (Used in this worksop) + * Pro +* [Radare](https://www.radare.org) +* [Capstone](http://www.capstone-engine.org/) + +## Decompilers + +* [Snowman](https://derevenets.com/) +* [dotPeek](https://www.jetbrains.com/decompiler/) .NET decompiler + +## Debuggers + +* [x64dbg](http://x64dbg.com/) (Used in this worksop) +* [Immunity](https://www.immunityinc.com/products/debugger/) +* [OllyDbg](http://www.ollydbg.de/) (Most Popular) +* [WinDbg](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit) + +## Information Gathering + +* [CFF Explorer](http://www.ntcore.com/exsuite.php) +* [Sysinternals Suite](https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx) + * procmon + * procexplorer +* [InetSim: Internet Services Simulation Suite](http://www.inetsim.org/downloads.html) +* [Yara: pattern matching rule engine](https://virustotal.github.io/yara/) +* [Wireshark](https://www.wireshark.org/download.html) - network sniffing +* [API Monitor](http://www.rohitab.com/downloads) + +## Support + +* [HxD Hex Editor](https://mh-nexus.de/en/hxd/) +* [Python](https://www.python.org/downloads/) - used for automating tasks + [Section 2 <- Back](https://securedorg.github.io/RE101/section2) | [Next -> Section 4](https://securedorg.github.io/RE101/section4)