From 57a0928cd1c249dda3ebc62d34d612209eca68cf Mon Sep 17 00:00:00 2001 From: Amanda Rousseau Date: Mon, 20 Mar 2017 14:14:16 -0700 Subject: [PATCH] updating retools --- idacheatsheet.html | 190 ++++++++++++++++++++++++++++++++++++++++++++ images/Alt-50.png | Bin 0 -> 995 bytes images/Ctrl-50.png | Bin 0 -> 1014 bytes images/Enter-50.png | Bin 0 -> 1026 bytes images/Shift-50.png | Bin 0 -> 949 bytes malware.md | 17 +++- retools.md | 42 ++++++++-- 7 files changed, 242 insertions(+), 7 deletions(-) create mode 100644 idacheatsheet.html create mode 100644 images/Alt-50.png create mode 100644 images/Ctrl-50.png create mode 100644 images/Enter-50.png create mode 100644 images/Shift-50.png diff --git a/idacheatsheet.html b/idacheatsheet.html new file mode 100644 index 0000000..d486637 --- /dev/null +++ b/idacheatsheet.html @@ -0,0 +1,190 @@ + + + + + + + + + + + + + + + + + +
+

IDAPro
Cheat Sheet

+ + + + + + + + + + + + + + + + +

Navigation

Jump to operandEnter
Jump in new windowAlt+Enter
Jump to previous positionEsc
Jump to Next positionCtrl+Enter
Jump to addressG
Jump by nameCtrl+L
Jump to functionCtrl+P
Jump to segmentCtrl+S
Jump to segment registerCtrl+G
Jump to problemCtrl+Q
Jump to cross referenceCtrl+X
Jump to xref to operand X
Jump to entry pointCtrl+E
Mark PositionAlt+M
+ + + + + + + + + + + + + +

Search

Next codeAlt+C
Next dataCtrl+D
Next exploredCtrl+A
Next unexploredCtrl+U
Immediate valueAlt+I
Next immediate valueCtrl+I
TextAlt+T
Next textCtrl+T
Sequence of bytesAlt+B
Next sequence of bytesCtrl+B
Not functionAlt+U
+ + + + +

Graphing

Flow chartF12
Function callsCtrl+F12
+ + + + + + + +

Comments

Enter commentShift+;
Enter repeatable comment;
Enter anterior linesIns
Enter posterior linesShift+Ins
Insert predefined commentShift+F1
+ + + + +

Data Format Options

ASCII strings styleAlt+A
Setup data typesAlt+D
+		 + + + + + + + + + + + +

Open Subviews

NamesShift+F4
FunctionsShift+F3
StringsShift+F12
SegmentsShift+F7
Segment registersShift+F8
SignaturesShift+F5
Type librariesShift+F11
StructuresShift+F9
EnumerationsShift+F10
+ + + + + + + + +

File Operations

Parse C header fileCtrl+F9
Create ASM fileAlt+F10
Save databaseCtrl+W
+ + + + + + + + + + + +

Debugger

Star processF9
Terminate processCtrl+F2
Step intoF7
Step overF8
Run until returnCtrl+F7
Run to cursorF4
Breakpoints
Breakpoint listCtrl+Alt+B
+ + + + +

Watches

Delete watchDel
+ + + + +

Tracing

Stack traceCtrl+Alt+S
+ + + + + + + + + +

Miscellaneous

CalculatorShift+/
Cycle through open viewsCtrl+Tab
Select tabAlt + [1…N]
Close current viewCtrl+F4
ExitAlt+X
IDC CommandShift+F2
+ +		 + + + + + + + + + + + + +

Edit (Data Types – etc)

CopyCtrl+Ins
Begin selectionAlt+L
Manual instructionAlt+F2
CodeC
DataD
Struct variableAlt+Q
ASCII stringA
ArrayNum *
UndefineU
RenameN
+ + + + + + + + + + + + + + + + + + + + +

Operand Type

Offset (data segment)O
Offset (current segment)Ctrl+O
Offset by (any segment)Alt+R
Offset (user-defined)Ctrl+R
Offset (struct)T
Number (default)Shift+3
HexadecimalQ
DecimalH
BinaryB
CharacterR
SegmentS
Enum memberM
Stack variableK
Change signShift+-
Bitwise negate Shift+`
ManualAlt+F1
+ + + + + +

Segments

Edit segmentAlt+S
Change segment register valueAlt+G
+ + + + + + +

Structs

Struct varAlt+Q
Force zero offset fieldCtrl+Z
Select union memberAlt+Y
+ + + + + + + + + + + +

Functions

Create functionP
Edit functionAlt+P
Set function endE
Stack variablesCtrl+K
Change stack pointerAlt+K
Rename registerV
Set function typeY
+
+ + + + + + \ No newline at end of file diff --git a/images/Alt-50.png b/images/Alt-50.png new file mode 100644 index 0000000000000000000000000000000000000000..78f6b07c676adca6f5cf1bde9db91493cf3fad82 GIT binary patch literal 995 zcmeAS@N?(olHy`uVBq!ia0vp^k|4~%1|*NXY)uAIjKx9jP7LeL$-D$|I14-?iy0WW zg+Z8+Vb&Z8pn}NEkcg59UmvUF{9L`nl>DSry^7odplSvNn+hu+GdHy)QK2F?C$HG5 z!d3~a!V1U+3F|8Y3;nDA{o-C@9zzrKDK}xwt{K19`Se z86_nJR{Hwo<>h+i#(Mch>H3D2mX`VkM*2oZx=P7{9O-#x!EwNQn0$BtH5O0c3d|4@L;p!@;Rg)$-uy*?CIhd;=#Li z+F36dM}dax`)91+>}Zs!X?Sq3q5TKLO@X}?AD$RL(WnqOYZ_HOrVdi!*r{a(I2YV$H|TF-A_&{y~pQavp?ZO$RPoI|b0+#YJjG@Y9N;FX;AyHnXW zn$$nUsoyrpWi9HTUD6 z8F~HHN&9EBygneTEcmcgD)3(Asysa_OHTI5KC{~jzV!Xtyk+gW#aARB-VIQ?^gHaa z=ncn@=2ND`KM-AWNJ-;n!{NTN*Ejo8Ql1@e%scHpqltM%)1$rp5LKYxBjxhu2yafBm04V}r|iiydDo4eYJH=1Q^6U$X7e zsZO_;eQdhZA1c={%l>6({$N>D8fOp3NePZ)# zYxU~M^#+r(?%FB8p6=0H)^Gak`xD-fg*ht|KX|C$)PKzOHvWR|I*BliyucdC*uYTr zF7Z?6mu|nEEMB$Bw%f8R|BuyI?Ow@Jm3!Wz@&>E=r!A}3PIOI=+hFwc;h}qssTrYj TCpLvMgL0mytDnm{r-UW|NScj3 literal 0 HcmV?d00001 diff --git a/images/Ctrl-50.png b/images/Ctrl-50.png new file mode 100644 index 0000000000000000000000000000000000000000..0e0d8e45952c6ed08283003e63fdef9280533109 GIT binary patch literal 1014 zcmeAS@N?(olHy`uVBq!ia0vp^k|4~%1|*NXY)uAIjKx9jP7LeL$-D$|I14-?iy0WW zg+Z8+Vb&Z8pn}NEkcg59UmvUF{9L`nl>DSry^7odplSvNn+hu+GdHy)QK2F?C$HG5 z!d3~a!V1U+3F|8Y3;nDA{o-C@9zzrKDK}xwt{K19`Se z86_nJR{Hwo<>h+i#(Mch>H3D2mX`VkM*2oZx=P7{9O-#x!EwNQn0$BtH5O0c3d|4@L;p!@;Rg)$-uy5=IP=X;=#Li zs;{?LphVk!oy`i$zu22nbcLK^RC9Y`b`&PRu5%R3TeR(^nNq>?`hWuEC)<1luB>7? z+UqEN*+n@1%DUGU{k@ORXum(sd;LuDxjDu5#?P~}whG5SDzogiF1_r3zvShkx)jDz z=lrf)yWd>cJ1??isgKCIgC;!(eLJcSEi3iux8J~$pAf%U?gs~Z!qf5(ucM|eHexU? z5S5$#ME1^hhPl^_+U}dgwz9LGurw^({bF%j;@Jf5q)n#pTMj*EON;KS-BUVsXRh9? z#UC`Qmi%&?`#5)wN9VRc`L=7n?}UcdOuOZBJmf@dPLBFlff!w>l`G7*&Hd_pfq!Y| zsYxzO>iKf>4$JIm(f%No*Id-OYPrFrMgQaHi27U26)WoH>zv?vGJW$uHdg0 zIDL2LhmwG8g&N+W-wrG+iW57?8OzpwOl9{5zTgdva;~q`bC$h$bLhmXtgX39{H{wY z1Glfx*mtJ%mCdQg-yhi8Ydu{2zHFm$X?lvgKTE32=^LHrPOo2o#nscKcY7Dh)U;53 zpGPj{MjfpIPcN>ByPw>CfOGfsttKn;@97yj{rY$9%vXDk#TPPn8ttETBv!Wm*!3g! z3j2dJ%v9Sm7}5^tOPO|llFxrCTyWFXHt}*1-(&gzT|3rA)@4@N9O+ZbiM0OGv-wR) mh>w``>eS~>?td?J{9$hEh+ogbf6@n(89iP7T-G@yGywprgOV)( literal 0 HcmV?d00001 diff --git a/images/Enter-50.png b/images/Enter-50.png new file mode 100644 index 0000000000000000000000000000000000000000..e88513e75f8113a912db0b642749f0a2f3ec1e36 GIT binary patch literal 1026 zcmeAS@N?(olHy`uVBq!ia0vp^k|4~%1|*NXY)uAIjKx9jP7LeL$-D$|I14-?iy0WW zg+Z8+Vb&Z8pn}NEkcg59UmvUF{9L`nl>DSry^7odplSvNn+hu+GdHy)QK2F?C$HG5 z!d3~a!V1U+3F|8Y3;nDA{o-C@9zzrKDK}xwt{K19`Se z86_nJR{Hwo<>h+i#(Mch>H3D2mX`VkM*2oZx=P7{9O-#x!EwNQn0$BtH5O0c3d|4@L;p!@;Rg)$-uzmte+4dVAA!nHQ*=nABI*J<%^nb{wqXPRI0cZPRdyEV#1HQ zdB(qOH^1Ncd`@+KlIr<6d#}f3uity^-;T|jat&uDd|N)_-Sgk&jNA2(rfu5PP{_0< zaW|v;19hICyBcIah^;&HThaMg+7ruJ;RVcP2LsH`{gll+SZKkzc#>vC(_GhMFlIf{hw@k=z1^cwj*YBSg zSxjHPV47Od(i5+CSNRG(aM@TNSaNd1itVRF+t)e%vj6a6T5|QpSe?z1E_c^o%C}FO z#GtiX{45Vo0mCVbE9HJ|j(AuP9`b`uB~W7R_yb=jt8F zlkoG5TIv$Zc%GzAzQd6}!X6lF++`?kp0&#FtLx>HSGD6-WKZy3u}*t`V9zw2=C4^- zUaqidEd8Ksl;A7&=(FLjpErfyM0qx_XV@KBYIMm)aP8H!Z^vKk?qA+*w{PmrYqm3k zE>-e~KhV3wXnexfFkAgLclrahJ#5+wdLIX0n%>D~+%|Q3^@{uH7X0&0u`ICEc6L1T zNU_3R@BA*`OgH9?m5$+?7UunMtO(DSry^7odplSvNn+hu+GdHy)QK2F?C$HG5 z!d3~a!V1U+3F|8Y3;nDA{o-C@9zzrKDK}xwt{K19`Se z86_nJR{Hwo<>h+i#(Mch>H3D2mX`VkM*2oZx=P7{9O-#x!EwNQn0$BtH5O0c3d|4@L;p!@;Rg)2@K?~o-U3d9=v;} z?Dk@I6luG@!Z51C?4Fh4`h@hytlHesTSXlOzIfL3B&4P%u5Vo`7N*JK_~Fu$iz4^_ z<i+d-{Sd7XWLgrjXAM3qSFn3alG2w zapk<;QD>2bdVOvwp9}>}jxg(Q{3zUiK7d`OGhE|ME}N@Hl(4qx9M6Z9ioA(;YQox| z|M5Ar<44{_5214FsW#%`N38WXGJag-cI4g>Hb=G1=Ypy^q+?Ea-(ABJ7c{3dvj2IgYF5WJnf=Y3^`d{u zmiSj$&uh8bGGp3D1tsSrm0|6>=3d#g#^Jj5wDfl0S@%D^iSdgHIv1I+<8Ii8=Rs>b zeW!7MJ6KSf*>q@jpjgf9Q-}5znk3HOGcEOiLvYf~*}>aSYj1zbAM1V1Rq8Q+runiT ziz}3i78|Hv>wMq&dC_mLPg`ZKgjXD0ceeb$%M-KjO2MLg1D^;dp9-0CW6=&3x$fmM zNuo9jEDNJ^x?EYG=&@#PJ38%z_`HQORb7_9RAOUyNnI#xv+E9>nxnM!(yFbep8jW8 X;S_wFW0TejP+szM^>bP0l+XkKTSj*) literal 0 HcmV?d00001 diff --git a/malware.md b/malware.md index 58b269a..efc1946 100644 --- a/malware.md +++ b/malware.md @@ -43,7 +43,7 @@ title: Malware Techniques * [Enigma Protector](http://www.enigmaprotector.com) * [EXE Bundle](http://www.webtoolmaster.com/exebundle.htm) * [EXE Stealth](http://www.webtoolmaster.com/exestealth.htm) - * [eXPressor(http://www.cgsoftlabs.ro/express.html) + * [eXPressor](http://www.cgsoftlabs.ro/express.html) * [FSG](http://xtreeme.prv.pl/) * [kkrunchy](http://www.farbrausch.de/~fg/kkrunchy/) * [MEW](https://web.archive.org/web/20070831063728/http://northfox.uw.hu/index.php?lang=eng&id=dev) @@ -58,6 +58,8 @@ title: Malware Techniques * [VMProtect](http://vmpsoft.com/products/vmprotect) * [XComp/XPack](http://soft-lab.de/JoKo) +
[Top^](#techniques-overview)
+ ## Obfuscation * Deliberate act of creating obfuscated code that is difficult for humans to understand @@ -116,15 +118,26 @@ Example: Mimikatz credential theft * Gain knowledge about the system and internal network. -## Lateral Movement +## Lateral Movement + +* Enable an adversary to access and control remote systems on a network and could ## Execution +* Techniques that result in execution of adversary-controlled code on a local or remote system +* scripts +* post-exploitation + ## Collection +* Identify and gather information, such as sensitive files, from a target network prior to exfiltration + ## Exfiltration +* Removing files and information + ## Command and Control +* Communicate with systems under their control [x86 Assembly <- Back](https://securedorg.github.io/RE101/section1.3) | [Next -> Section 3](https://securedorg.github.io/RE101/section3) diff --git a/retools.md b/retools.md index 51b4ded..61e6a53 100644 --- a/retools.md +++ b/retools.md @@ -7,10 +7,42 @@ title: RE Tools # Section 3: Reverse Engineering (RE) Tools # -* Disassembler -* Decompilers -* Debugger -* Information Gathering -* Support + +## Disassembler + +* [Ida](https://www.hex-rays.com/products/ida/) + * Free (Used in this worksop) + * Pro +* [Radare](https://www.radare.org) +* [Capstone](http://www.capstone-engine.org/) + +## Decompilers + +* [Snowman](https://derevenets.com/) +* [dotPeek](https://www.jetbrains.com/decompiler/) .NET decompiler + +## Debuggers + +* [x64dbg](http://x64dbg.com/) (Used in this worksop) +* [Immunity](https://www.immunityinc.com/products/debugger/) +* [OllyDbg](http://www.ollydbg.de/) (Most Popular) +* [WinDbg](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit) + +## Information Gathering + +* [CFF Explorer](http://www.ntcore.com/exsuite.php) +* [Sysinternals Suite](https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx) + * procmon + * procexplorer +* [InetSim: Internet Services Simulation Suite](http://www.inetsim.org/downloads.html) +* [Yara: pattern matching rule engine](https://virustotal.github.io/yara/) +* [Wireshark](https://www.wireshark.org/download.html) - network sniffing +* [API Monitor](http://www.rohitab.com/downloads) + +## Support + +* [HxD Hex Editor](https://mh-nexus.de/en/hxd/) +* [Python](https://www.python.org/downloads/) - used for automating tasks + [Section 2 <- Back](https://securedorg.github.io/RE101/section2) | [Next -> Section 4](https://securedorg.github.io/RE101/section4)