Jamaal Speights - devblog

Installing SoundPimp on OSX 10.10 with JackOSX.0.90 and LineIn.

2015-09-13T23:32:00.002-07:00

SoundPimp produces 3D high fidelity audio like you've never heard it before. Checkout a demo of what the software can do here (does not work with headphones). It took me quite some time to figure out how to get SoundPimp working on OSX 10.10 and to understand the entire jack audio routing concept. The original SoundPimp tutorial for OSX will no longer work from SoundPimps website when using 10.8x versions of OSX. The reason is due to the fact that JackRouter doesn't have a signed driver which is a new security feature to prevent malicious drivers from being loaded. The JackRouter driver is no longer needed and my steps are much cleaner and simpler. No more Soundflowerbed that crashes all the time. No more frustration with setting up SoundPimp. This guide will teach you and you gon learn today. I'm better at doing over explaining so lets rock.

Software Required:

SoundPimp http://www.soundpimp.com/

Jack2 http://jackaudio.org/downloads/

Mixed 64/32 bit, 0.90 of JackOSX for Snow Leopard

LineIn https://www.rogueamoeba.com/freebies/

(SoundFlower https://rogueamoeba.com/freebies/soundflower/ OR
WavTape https://github.com/pje/WavTap)

Patchage http://drobilla.net/software/patchage/

Order is important. Remember that after you've done these steps to always load SoundPimp last after you reboot. I will be working on an automation script when I get time.

1) Install SoundPimp

2) Install Soundflower or WavTap.

3) In System Preferences under Sound select Soundflower (2ch) as your default interface for Output. If you installed WavTap, select the WavTape device as your output.

4) Install Patchage

5) Install Jack2 (Reboot will be required after install).

6) After the system reboots open JackPilot.

7) From the JackPilot menu select Preferences

Make sure the Input/Output Device are your computers speakers. In my case I have an external USB sound card. After this is complete, select Save

8) Click Start to start JackServer

9) Open Patchage / From the System drop down menu select "Connect to Jack"

10) Open LineIn. For Input from select Soundflower (2ch). For Output to: select JackRouter and click Play Thru

) Go back to Patchage and you will see the following. Note under View deselect Spring LayOut.

11) Finally Open SoundPimp and make sure the "Jack Direct Connection" option is selected. Click the Gear Icons if you do not see this. Once selected, press the Cycle button in SoundPimp (bottom left corner). In Patchage you will see the following.

12) The routing is incorrect. To Fix this, click and hold down the mouse from Capture_1. A green cable will appear. Connect that green cable to Input_1 on SoundPimp. This will delete that connection. Do the same thing for Capture_2 to Input_2. The end result will look like the following:

13) Click out1 from LineIn and drag the cable to SoundPimps Input_1. Do the same for out2 to Input_2. Once the connections are complete play some Audio!

I keep the Jack slider (bottom) around the same decibel level and turn the input volume level all the way up. Of course you have to play around with the system volume to find a nice balance however I found out that sometimes less is more regrading fine tuning SoundPimp.

Side Notes:

Patchage Crashes a lot. Simply restart and reconnect it to jack.
If you're seeing audio sent to soundpimp because the decibel levels are changing but can't hear anything, rebooting will usually fix the problem.

Creating Tiny BareBone executables in Python for debugging shellcode and function stubs

2015-01-29T15:12:00.002-08:00

The following python script creates a barebone exe called out.exe that does nothing. Its extremely useful when you need to debug shellcode or an application stub. Simply load out.exe into Immunity, allocate a buffer, cut and paste the shellcode into the new buffer via the hex dump window, or just cut and paste the shellcode below the return at address 0x00401010 (for example) in the hex dump window. Finally modify RETN to JMP + ADDR of the shellcode you would like to execute.

out.exe loaded into immunity debugger.

Simply modifying the RETN command to JMP 00401010 for example and paste your shellcode at that address in the hex window. Next press F7 to step into your stub or shellcode.

miniexe.py

import re
import sys
import binascii
import os
exe_str = "4D5A9" + ("0" * 4) + "3" + ("0" * 7) + "4" + ("0" * 6) + "FFFF" + ("0" * 4) + \
"B8" + ("0" * 14) + "4" + ("0" * 71) + "B" + ("0" * 8) + \
"E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24" + \
("0" * 14) + "BB41E4DAFF208A89FF208A89FF208A89FF208A89FE208A8990561789FE208A8952696368FF208A89" + \
("0" * 16) + "5045" + ("0" * 4) + "4C0101004C9AF85" + ("0" * 17) + "E" + ("0" * 4) + \
"2010B010A" + ("0" * 5) + "2" + ("0" * 22) + "1" + ("0" * 7) + "1" + ("0" * 7) + \
"2" + ("0" * 9) + "4" + ("0" * 5) + "1" +("0" * 8) + "2" + ("0" * 5) + "5" + ("0" * 3) + \
"1" + ("0" * 11) + "5" + ("0" *3) + "1" + ("0" * 12) + "2" + ("0" * 8) + "2" + ("0" * 13) + \
"3004085" + ("0" * 4) + "1" + ("0" * 5) + "1" + ("0" * 9) + "1" + ("0" * 5) + "1" + ("0" * 13) + \
"1" + ("0" * 263) + "2E74657874" + ("0" * 7) + "1" + ("0" * 8) + "1" + ("0" * 8) + \
"2" + ("0" * 7) + "2" + ("0" * 28) + "2" + ("0" * 5) + "6" + ("0" * 97) + "C3"+ ("0" * 1022)
f = open("out.exe", 'wb')
f.write(binascii.unhexlify(exe_str))
f.close()

hexdump of out.exe

hexdump -C out.exe
00000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 |MZ..............|
00000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 00 |................|
00000040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
00000080 bb 41 e4 da ff 20 8a 89 ff 20 8a 89 ff 20 8a 89 |.A... ... ... ..|
00000090 ff 20 8a 89 fe 20 8a 89 90 56 17 89 fe 20 8a 89 |. ... ...V... ..|
000000a0 52 69 63 68 ff 20 8a 89 00 00 00 00 00 00 00 00 |Rich. ..........|
000000b0 50 45 00 00 4c 01 01 00 4c 9a f8 50 00 00 00 00 |PE..L...L..P....|
000000c0 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 02 00 00 |................|
000000d0 00 00 00 00 00 00 00 00 00 10 00 00 00 10 00 00 |................|
000000e0 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 |. ....@.........|
000000f0 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 |................|
00000100 00 20 00 00 00 02 00 00 00 00 00 00 03 00 40 85 |. ............@.|
00000110 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 |................|
00000120 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................|
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001a0 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 |.........text...|
000001b0 01 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 |................|
000001c0 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 |............ ..`|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400

EOF

Vol-MsDecompress

2014-10-08T23:30:00.001-07:00

Vol-MsDecompress

Malware I've ran across in the past used LZNT1 compression to help hide/pack itself in memory. To help defeat this I've created Vol-MsDecompress. Vol-MsDecompress is a plugin to help forensics investigators recover compressed data in memory. Currently Vol-MsDecompress supports the lznt1 decompression algorithm, however Xpress and Xpress + huffman will be added soon. Vol-MsDecompress uses a slightly modified version of ms-compress. The modified version exports the lznt1_decompress_chunk function which Vol-MsDecompress uses to precisely decompress data.

[Vol-MsDecompress Repository]

A basic build environment is required for building Vol-MsDecompress. (OSX: xcode, Linux: build-essential, Win: MS Visual Studio)

Install (OSX/Linux):
1) Download ms-voldecompress.zip from the repository
2) Unzip the the file $ unzip ms-voldecompress.zip

3) Build it

$ ./build.sh (build.bat for windows)

Compiling dynamic shared library...

In file included from lzx.cpp:22:0:

etc..

4) Check for the lib and its exports

$ ls -l libMSCompression.so

-rwxrwxr-x 1 ff ff 113000 Sep 30 22:25 libMSCompression.so

$ nm -D libMSCompression.so | grep -i decompress

00000000000025d0 T decompress

0000000000003450 T lznt1_decompress

0000000000003080 T lznt1_decompress_chunk

0000000000006540 T lzx_cab_decompress

0000000000006010 T lzx_wim_decompress

0000000000011be0 T xpress_decompress

0000000000012d70 T xpress_huff_decompress

Copy libMSCompression.so to another location or just call it from its current location (next step will demonstrate)

5) Copy the msdecompress.py plugin to vols plugin directory

6) Example usage:

python vol.py msdecompress -f ../zeus.vmem -D out4 -P ~/projects/mchammer/libMSCompression.so -A lznt1 -C -M 5

Options:

-P path to the LibMScompress file

-A algorithm to use [lznt1 for now]

-C Dump the compress data along with the decompress data blocks (useful for comparing compressed and decompressed bytes)

-M Specify the minimum compressed data size to decompress in bytes (default is 20 bytes)

Sample Output

Decompresing data for PID: 4, Process: System, Page: 0x81008000, Offset: 0x0

Decompresing data for PID: 4, Process: System, Page: 0x81009000, Offset: 0x4dc

Decompresing data for PID: 4, Process: System, Page: 0x8100a000, Offset: 0x1fd

Decompresing data for PID: 4, Process: System, Page: 0x8100b000, Offset: 0x49e

Decompresing data for PID: 4, Process: System, Page: 0x8100c000, Offset: 0x702

Decompresing data for PID: 4, Process: System, Page: 0x8100d000, Offset: 0x528

Decompresing data for PID: 4, Process: System, Page: 0x8100e000, Offset: 0x321

Decompresing data for PID: 4, Process: System, Page: 0x81011000, Offset: 0x36c

Decompresing data for PID: 4, Process: System, Page: 0x81013000, Offset: 0x1b3

About 225 compressed steams were recovered using LZNT1 for the Zeus.vmem sample. The decompressed data recovered by the plugin can be found in the msdecompress_zeus.zip

Examining the compressed and decompressed data found in memory.

Please be sure to download the msdecompress_zeus.zip file to follow the brief example below.

$ hexdump -C 4_System_0x81008000_0x0_lznt1__CompressedBuffer.bin

$ hexdump -C 4_System_0x81008000_0x0_lznt1__UncompressedBuffer.bin

Conclusion:

A lot of compressed data exists in windows memory. This plugin is my first basic attempt for helping others to analyze compressed data in memory (without using a debugger to monitor allocated buffers or seeing the return data from RtlDecompressBuffer). Vol-MsDecompress was able to properly carve and decompress compressed data with much more accuracy than the Lazy_NT python module. No other framework or platform that I know of currently supports the extraction of LZNT1 compressed data from memory. As noted above Xpress and Xpress + huffman will be added eventually. A standalone carver will be released as well along with native python versions of the ms-compression algorithms. Many many thanks to Jeffrey Bush of http://coderforlife.com/ who's code Vol-MsDecompress uses.

Notes:

Visualizing LZNT1 Decompression:

I am very visual so I found an easy solution to replace pin and paper in figuring out how the LZNT1 decompression process works. The below visualization helped me enormously and I will be using this process from here on out. It was created using XMIND. Ultimately the lznt1_uncompressed_size and lznt1_decompress_chunk functions were used to deduce if data was legitimately decompressed by the plugin. The below visualization did serve as an excellent example for understanding complex code for the future.

lznt1 carving process visualization

"The greater the artist, the greater the doubt. Perfect confidence is granted to the less talented as a consolation prize".

Unpacking Zeus Malware

2014-05-27T14:39:00.003-07:00

Unpacking Zeus MALWARE

1) Zeus ntdll.RtlDecompressBuffer

Unpacking Zeus (amdeu_exe) with Immunity Debugger 1.73

This version of Zeus (amdeu_exe) used ntdll.RtlDecompressBuffer to decompress itself into memory allocated using VirtualAlloc. Below are the steps to take to manually unpack the exe. The end result was found by
setting breakpoints on VirtualAlloc calls and the corresponding memory addresses that were allocated.

(Zeus unpacked)

A Hardware Breakpoint would be set on Write to the allocated address and the memory was monitored for changes. Here are instructions to manually unpack this sample quickly.

2) Load the executable and you should be dropped at address:
7C90120F C3 RETN

3) Press Alt + F9 to Execute until User Code. Which should take you to the location: 00401500 Set a soft breakpoint by pressing F2 at address 00401655

4) In the command line type !hidedebug All_Debug and press Enter

Do the same for:
!hidedebug All_Process !hidedebug All_Window

5) Press Play to execute the sample to 00401655. Once the soft BP has been hit, press F7 to step Into the address which should bring you to 00401007

6) Set a Soft BP by pressing F2 at address 0040111A which is the bottom of a loop and click Play

7) When 0040111A is hit, press F7 to step into the address. This should bring us to address 0050100

8) ntdll.RtlDecompressBuffer is our target call which is at address 005012E0. Set a software BP at this address. If you get a warning, just press Ok or Yes to continue when setting this BP and select Play

9) Once our target address has been hit as shown below.

Look in the call stack

The address 011A0000(shown above) will be our dump address. This address was allocated using VirtualAlloc. Right Click on this address and select "Follow In Dump"

10) Press F8 once and Zeus will decompress into the address 011A0000

11) Select "m" at the top of the screen and highlight the target address 011A0000

Right click on the address and select "Dump"

Right click inside the Dump windows, Select "Backup" and select "Save data to file", appened .exe to the name and you're done for the most part.

12) You can now open the dumped file in IDA.

13) You can also used CFF Explorer to rebuild the EXE if it has trouble executing. I used the Rebuild PE Header, Bind Import Table and Update Checksum options to rebuild the exe that was dumped.

Tcp Stream Reassembly Output Normalizer V2 (Libtsron)

2014-05-23T22:52:00.002-07:00

LibTSRONv2

https://code.google.com/p/jamaal-re-tools/source/browse/tsron/

Requirements: python2.7 | dpkt 1.8 | pypcap 1.1

Summary

LibTSRON builds and dumps ordered TCP data streams from Pcaps like TCPFlow and WireSharks (Follow TCP Stream). It Also supports GRE and UDP.
Data streams can be returned to a variable which is perfect for decoding/decrypting network data.
Data streams can be parsed by a user supplied header giving you complete control over each ordered packet returned in a data stream.
Raw data from ordered TCP streams can be saved to an output directory.
LibTsron can quickly analyze pcaps displaying the available streams in a pcap numerically.
Specific streams can be returned or written to disk based upon user input.'
LibTsron works! The assumption that LibTsron "simply puts packets together that have the same (ip.src,tcp.sport,ip.dst,tcp.dport)." is quite simply incorrect.
LibTsron does indeed reassemble packets in order based off simple mathematics.

Basic Usage: Using the built in command line utility to dump TCP/UDP or GRE streams to file

View TCP Streams

$ python libtsron.py -p out_libpcap.pcap -D

Dump TCP Streams

$ python libtsron.py -p out_libpcap.pcap -d out

Analyze the first stream using hexdump:

$ hexdump -C TCP_173.194.63.178_80_192.168.1.30_56195 | less

Calling LibTSRON from python:

LibTSRON is perfect for creating decoders. This example will show you the basics of using the class in order to returned ordered data to your own applications. Analyze the code below and read the comments. I use an advanced example below which covers everything in a little more detail. But for now, the basics.

exampletsron.py

Running exampletsron.py

Notice in the hexdump __libtsron_packet__ splits each packet. So libtsron can rebuild tcp streams while allow the user to specify a delimiter for each packet dumped. This is perfect for writing decoders.

Set 'connheader' to True and see the results:

$ python exampletsron.py out_libpcap.pcap | less

Each ordered packet now has a header that looks similar to this:

<--__=64.233.171.189_443_192.168.1.30_55038=__-->__libtsron_packet__

The connheader or "connection header" option appends Source host and port plus destination host and port to returned streams. This might be useful if you're only interested in decoding source tcp data for example. Parsing individual packets from streams can also be achieved using this option. Note the "header" option does not need to be specified when using "connheader".

Utilizing LibTSRON to Decode zlib compressed TCP Data (la Gh0st Rat)

This example illustrates using LibTsron to find and decompress zlib compressed data. zlib is used in a lot of different malware samples I've analyzed and written decoders for. Ordered data decompression is required for properly recovering executables sent by malware for example.

pcapzlib.py

Running pcapzlib.py

python pcapzlib.py gh0strat.pcap | less

This decompressor builds on the exampletsron.py described above. We are using the header variable to parse data packets defined on line 11 which is utilized on lines 35 and 37. Once the data packets offsets are found between headers, we search for the zlib header defined on line 10. Once the zlib header is found on line 42, we try and decompress the data at line 50. Normally this data would be written to file, but for this example I return the printable data to the screen on line 52 and 53 producing the decompressed output you see above.

Utilizing LibTSRON to Decode Poison Ivy Traffic:

Poison Ivy Rat (Pivy) uses Camellia to encrypt and decrypt network data along with NTDLL.RtlCompressBuffer and NTDLL.RtlDecompressBuffer for compression and decompression of certain data. Poison Ivy provides a perfect example to illustrate the capabilities of LibTSRON because in order for an investigator to properly recover exfiltrated Pivy data from a pcap, each packet must be in its proper order for decompression to work. Using this type of compression is brilliant because it makes data recovery via pcap that much more difficult.

Note: I've ported Pivys implementation of Camellia encryption/decryption functions plus Windows RtlDecompressBuffer function to OSX (.dylib) for this example. The associated files and decoder are outside the scope of this post and will be covered later

1) Import the Tsron Class

2) Like before we're using defining a header to use as a delimiter.

3) Using ctypes we call the port of PIVYs encryption/decryption and key table functions similar to how you would using the .DLL in windows on lines 28 and 29. For PIVY, the password must be less than 12 character lengths. The password providing from the command line used as an argument in the C_SK function to generate a keytable for decryption on lines 38 and 39.

4) "targ" defines the options used to send to Tsron. Note the header variable we defined previously will be used again.

5) streamObj.TCP() returns ordered TCP data to variable "x". Next we use the header again to distinguish the start of new packets. Camellia decrypts 16 bytes at a time so our nested for loop handles that at on line 73. On line 75 our port of Camellia is called producing decrypted data. The decrypted data is saved to a temp variable and written to disk on line 77

Typically because we're just dealing with decryption at this stage, I would generate a new pcap using nothing but pypcap and dpkt while calling libpivy.C_D(decryption function). Once the PIVY data has been decrypted on line 75, it could have been placed into a new decrypted pcap. It would have been much easier to just call libtsrons at that point to reassemble ordered TCP data from the new decrypted pcap containing for decompression. Doing things using the method shown above leaves the possibility to decompress decrypted data streams inline without using multiple decoders/applications. The challenge in doing things this way is dealing with decompressed data sizes that extend multiple packets. This issue can be tackled using the "header" delimiter along with the offset variables to concatenate multiple ordered packets based off the amount of data that is needed to be decompressed. Enabling the connheader option when creating an instance or Tsron will allow you to keep track of TCP flow, which in return could be used to reconstruct a complete decrypted and decompressed pcap. :D

But for now I will just call the Pivy data decompressor which in return will use the "pivydecrypted.bin" file to locate compressed data and decompress it to its proper file type based off ofs Pivys data scheme.

6) I ran the Pivy Decompresser against the decrypted data written to disk by LibTsron which has been placed in the "decryptedpivy" directory.

7) Which seeks through decrypted data looking for offsets to decompress based off of PIVYs packet data structure.

8) After decompression we can see the true content of the data stolen using the PIVY RAT.

EOF

How I make High Quality gifs with Gimp.

2014-04-21T02:09:00.001-07:00

My people, it is time to elevate our "gif" game. The days of dailup are over.

This tutorial is aimed at Linux/OSX users. But Windows users can follow the same steps. I'll show you how to create high quality gifs like the one above using Gimp and a few other programs.

You'll need:
python 2.x
youtube-dl | http://rg3.github.io/youtube-dl/
ffmpeg or Openshot | http://www.ffmpeg.org/ | http://www.openshot.org/
Gimp | http://www.gimp.org/

gifsicle | http://www.lcdf.org/gifsicle/

1) Get the video from youtube. This step can be skipped if you already have a video source.

I'll be using "MotoGP™ Motegi 2013 -- Best slow motion"
Video location: https://www.youtube.com/watch?v=UEqzjKrWhAk

Download the video
From terminal execute: youtube-dl -citF https://www.youtube.com/watch?v=UEqzjKrWhAk

22 (best) is the highest quality. Thats our target

From terminal execute: youtube-dl -citf 22 https://www.youtube.com/watch?v=UEqzjKrWhAk

Great, now you've just downloaded your target youtube video in high quality (22). Read the manual on youtube-dl to figure out the command options I used.

2) Convert the target video into PNG

I opened the file "MotoGP™ Motegi 2013 -- Best slow motion-UEqzjKrWhAk.mp4" in the best video viewer VLC (http://www.videolan.org/) to review the video. I know the frames of video I want for the gif are from about 22 seconds to 34 seconds which is a total of 12 seconds. So I will extract that time range using ffmpeg as png files.

From terminal execute the following:

#Make an output directory

ballen:giftut ff$ mkdir pngout

#Use ffmpeg to convert (start time) -ss of 22 seconds for 12 seconds (-t) and output the png files into the above directory.

ffmpeg -i MotoGP™\ Motegi\ 2013\ --\ Best\ slow\ motion-UEqzjKrWhAk.mp4 -ss 22 -t 12 pngout/%05d.png

Change directory into pngout and see the png files we've extracted. We will use these in gimp.

Openshot

If you do not have ffmpeg the same steps can be done in Openshot. For Openshot, Import the video and cut it down to the section of the video you want to gif. Export the section of video you would like using the "Convert into Image Sequence" under advanced options. This will save the video as PNG just like we did above into a target directory you select.

Note, if the video portion you want to "gif" is 5 seconds, extend the video to "6" seconds on the video track. Openshot seems to like to leave out the last bit of the video when converting to PNG for some reason.

3) Creating the animated gif in Gimp.
Open Gimp
next

File > Open

Open the first file 00001.png in Gimp

Next open the rest of the png files as layers in gimp by doing.

File > Open as Layers and select 00002.png to 00300.png and hit Open

(by selecting 00002.png and hold down the shift key, you can scroll down to 00300.png which is the last frame in the animation)

Importing might take some time but the end result is this.

If the view looks odd from Windows menu bar select Single - Window Mode

Next select
Image > Scale Image
Set Width: 360 Height 203
Note: this varies on the size of your gif, in this case the gif is already large, so I made the final animation relatively small
Under Quality select
Interpolation > Sinc (Lanczos3)
Select Scale

(Note, this size is pretty small compared to the normal size I use, however this gif is based off film in slow motion and uses a lot of frames. Next tutorial i'll show a trick you can use to reduce large gif file sizes with gifsicle)

Next select

Image > Mode > Indexed

Use the following options and press Convert

After you've instructed your gif to use an optimum color palette, we need to export the gif with

File > Export As > and give your gif a name and press Export

Use the settings in the Export Image as Gif window below. Notice the time indicates 40 milliseconds. Normally this default value of 100 (per frame) can be too slow for most animations. Setting it to 40 will put this animation on point as far as play speed is concerned. Also notice Loop forever is set. I unset Interlace and Gif Comment to unselected. Frame disposal where unspecified I set to I don't care. Press Export

After the Export is complete check the size of your gif. 13 Megs isn't to bad :D

4) Optimize the final gif with gifsicle

Gifsicle can technically do all of this minus the video conversion. I will cover gifsicle in the next tutorial. For now, we will use it to do a simple Optimization which will reduce the file size some.

All we will do is run a simple optimization

From terminal execute: gifsicle -O3 jsmarcmotogp.gif > jsmarcmotogp2.gif

We save some space on the final gif. This optimization trick can produce good results sometimes.

5) Complete

Uploaded the final version of the gif to http://gfycat.com/ which is using html5 and will compress the gif even future or to G+.

Enjoy,
And ride safe my people

Smashing Themida with Qemu

2013-11-12T09:05:00.005-08:00

Themida by Oreans provides a vast list of protection mechanisms.

I'll explain a very simple approach to defeating Themdia 2.x protection schemes using Qemu, Universal Import Fixer, and Imports Fixer 1.6.

Qemu was the only virtual environment that this Themdia protected exe did not detect and would run in completely. It did an excellent job detecting IDA (even with IDA Stealth) and would not run inside Immunity Debugger.

It also has built in kernel debugging detection. The binary will execute in Vmware, however it doesn't execute its true payload inside Vmware.

Needed for this tutorial are:

Qemu running XP

Universal Import Fixer

Imports Fixer 1.6

5U4N8Q..exe (Malware_5u4n8Q.zip) is the target file we will be unpacking. (Samples not provided)

1) Inside of Qemu double click on 5U4N8Q..exe , open taskmgr and get its PID.
2) Open Universal Import Fixer v1.2, enter the PID (deselect hex), and make sure Fix Directly Imports is checked and click Start

In the log window you'll see UIF finding all the indirect API calls. Take note of the IAT RVA the IAT SIZE and the New IAT VA from UIF

Below is output from the log file (the full log file is attached below as UIF-Log.txt):

Log File
===============================================================
Fixing : 5u4n8Q..exe
Code Start : 00000000 -> Auto: 00400000
Code End : 00000000 -> Auto: 009C5000
New IAT VA : 00000000 -> Auto: 03910000
Fix Directly Imports : Yes
===============================================================
5u4n8Q..exe
00400000 to: 009C5000
Target Module,Skipped...
ntdll.dll
7C900000 to: 7C9B0000
00402714: Directly-> 03910000 : 7C901005 : RtlEnterCriticalSection
0040271C: Directly-> 03910004 : 7C9010ED : RtlLeaveCriticalSection
0040C700: Directly-> 03910000 : 7C901005 : RtlEnterCriticalSection
0040C92C: Directly-> 03910004 : 7C9010ED : RtlLeaveCriticalSection
kernel32.dll
7C800000 to: 7C8F4000
004027A4: Directly-> 03910008 : 7C81CAA2 : ExitProcess
0050A119: 0061F0E4-> 0391000C : 7C810C21 : GetFileSizeEx
----Truncated------------------------------------------------------
xpsp2res.dll
20000000 to: 202C5000
Not Found any Exports...
===============================================================
Fixing Success...
Fixed Module : 5u4n8Q..exe
Image Base : 00400000
IAT RVA : 03510000
IAT Size : 00000410
Normal Imports : 38
Directly Imports : 234
All Imports : 272
===============================================================

End of Log File

3) Open Imports Fixer 1.6, highlight the 5u4n8q..exe process, right click on it and select Dump. In the Dumper Tool window select Dump

Save the file as 5u4n8Q...

4) Back in Import Fixer, select the IT & IAT at the top of the window.

5) In the IT & IAT window select everything under the Code sections and click Get Imports (auto scan)

It should look like this

6) Select Clear Imports clearing all the incorrect imports, under IAT manual adding enter the New IAT VA (0x03910410) from UIF minus it's IAT size (0x410) for the VA address and add 410 for the size below.

VA: 03910000
Size: 410

Click Add and you should see the correct imports added as shown below

7) Select Fix dump and use the 5u4n8Q... target file we dumped in step 3 above and you should be rewarded with a message showing that the IAT has been rebuilt.
The file should save as *5u4n8Q.IF.exe.exe and we're done!

8) Because this exe used Delphi7, copy the Delphi7.sig file to the IDA pro signature directory and Open *5u4n8Q.IF.exe.exe inside IDA, just select ok for the warning message about imports
9) As you can see the imports are now showing up along with functions!

10) Looking at the disassembled code however still doesn't look right because we need to apply some sigs.

11) Apply the Delphi 7 and BDS 2005-2007 signatures as shown below. Be sure to apply the Delphi 7 sig first as order seems to matter.

When the Please confirm message box comes up, select Unload library

12) Now the disassembled code looks correct and we have a much better understanding of the malware and we are done.

Themida Packed

1) Just to illustrate the difference, here are some screenshots of the malware before we unpacked it and rebuilt the IAT

2) Import Address Table

Qemu Notes

I ran QEMU inside a Windows VM. To transfer files between the Vmware Env and Qemu, enable File sharing on the vmware Windows C drive.

Also enable the option that says "Allow network users to change my files"

Inside Qemu just point windows Explore to \\10.0.2.2\c which should be the default gateway and also the Vmware XP image.

General Notes
Verified against another sample from the wild.

This worked against 3 Themida packed malware samples using Themida 2.x.
If anyone has any Themida packed samples, please send them to me or try this process to see if it works.

http://www.offensivecomputing.net/?q=ocsearch

MD5:
9a597cae40e4d22695626c84878d80cf SHA1:
850ba4950cc1e9624e85200e48e8a400683ffb12
SHA256:
1129e7372053a9259526b35a41c62373dd1656329287eec69c668252003ec9f8
Original Submitted Filename:
9a597cae40e4d22695626c84878d80cf.exe Date Added:
2009-04-04 04:47:30.931305
Magic File Type:
MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit Packer Signature:

Anti-Virus Results:
BitDefender Trojan.Generic.772406
AVGScan Win32/Themida
Tags:
Add a tag:

This screenshot was taken after using the unpacking methods.

Summary

This attack against this version and implementation of Themida works because we bypass all the protection mechanisms by running the sample in an environment Themida deems as safe. We only need to rebuild the IAT once the sample uncompresses in memory, dump and rebuild the real processes IAT.

vadimm

2013-08-06T11:04:00.001-07:00

This plugin renders VAD information in a format similar to that of immunity debuggers "Memory Map" display window. VadIMM will attempt to display the processes ImageBase plus size and PE section information. I got a lot of help and give credit to code already written by the vol developers, particularly for the Map Types section.

https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/vadimm.py

Example:

python vol.py vadimm -f be2.vmem
Volatile Systems Volatility Framework 2.2

Ethscan: volatility memory forensics framework plugin for recovering Ethernet frames from memory.

2013-07-18T14:18:00.000-07:00

For the The 1st Annual Volatility Framework Plugin Contest: today I turned in my first of (3) plugins called Ethscan.

Ethscan: volatility memory forensics framework plugin for recovering ethernet frames from memory.

Ethscan gives you the ability to scan any type of memory image (Windows, OSX, Linux - 32/64, Vmware Snapshot images .vmem, etc..) or raw file using volatility to extract valid or invalid Ethernet frames (depending on if you're using the Checksum option)

Some Options/features for Ethscan are (please see the README.txt file for all options):

IPv4 and IPv6 support!

Options:
-R, --save-raw Create binary files of each packet found in memory

5__131.107.115.254__47873__172.16.176.143__3332__TCP.bin

3__172.16.176.1__35566__172.16.176.255__35072__UDP.bin

1__172.16.176.1__35054__172.16.176.255__35072__UDP.bin

2__172.16.176.1__34030__172.16.176.255__35072__UDP.bin

-C SAVE_PCAP, --save-pcap=SAVE_PCAP

Create a pcap file from recovered packets of given

name: "Example: -C out.pcap" (requires dpkt)

Every packet ethscan finds in memory can be written to a single pcap file using dpkt for further inspection under wireshark. (Note: some recovered IPv6 packets will cause dpkt to except upon writing, I suggest using the -R option when using the pcap option).

-P, --enable-proc Enable Packet to Process Association: Windows Only

(SLOW)

This option will attempt to associate recovered packets with a Process name/PID (this currently works for valid windows memory images only):

Example:

ProcName: wuauclt.exe PID: 1732 Base Address: 0x15e000 End Address: 0x1000

Ethernet: Src: (00:50:56:f1:2d:82) Dst: (00:0c:29:a4:81:79)

Type: IPv4 (0x0800)

IPv4: Src: 131.107.115.254:47873 Dst: 172.16.176.143:3332

Protocol: TCP (6)

Packet Size: (54) Bytes

0x00000000 00 0c 29 a4 81 79 00 50 56 f1 2d 82 08 00 45 00 ..)..y.PV.-...E.

0x00000010 00 28 29 85 00 00 80 06 bd 41 83 6b 73 fe ac 10 .()......A.ks...

0x00000020 b0 8f 01 bb 04 0d 79 7e 45 77 d8 8d 3f 5e 50 10 ......y~Ew..?^P.

0x00000030 fa f0 84 30 00 00 ...0..

Using a memory image from the Volatility wiki here is a short example with no options.

https://code.google.com/p/volatility/wiki/SampleMemoryImages

Example:

$ python vol.py ethscan -f be2.vmem
Volatile Systems Volatility Framework 2.2
Packets Found: 1
Ethernet: Src: (00:50:56:c0:00:08) Dst: (ff:ff:ff:ff:ff:ff)
Type: IPv4 (0x0800)
IPv4: Src: 172.16.176.1:35054 Dst: 172.16.176.255:35072
Protocol: UDP (17)
Packet Size: (92) Bytes
0x00000000 ff ff ff ff ff ff 00 50 56 c0 00 08 08 00 45 00 .......PV.....E.
0x00000010 00 4e 77 fa 00 00 40 11 49 83 ac 10 b0 01 ac 10 .Nw...@.I.......
0x00000020 b0 ff ee 88 00 89 00 3a 72 c0 3b 07 01 10 00 01 .......:r.;.....
0x00000030 00 00 00 00 00 00 20 41 42 41 43 46 50 46 50 45 .......ABACFPFPE
0x00000040 4e 46 44 45 43 46 43 45 50 46 48 46 44 45 46 46 NFDECFCEPFHFDEFF
0x00000050 50 46 50 41 43 41 42 00 00 20 00 01 PFPACAB.....

Packets Found: 2
Ethernet: Src: (00:50:56:c0:00:08) Dst: (ff:ff:ff:ff:ff:ff)
Type: IPv4 (0x0800)
IPv4: Src: 172.16.176.1:34030 Dst: 172.16.176.255:35072
Protocol: UDP (17)
Packet Size: (92) Bytes
0x00000000 ff ff ff ff ff ff 00 50 56 c0 00 08 08 00 45 00 .......PV.....E.
0x00000010 00 4e 9b e5 00 00 40 11 25 98 ac 10 b0 01 ac 10 .N....@.%.......
0x00000020 b0 ff ee 84 00 89 00 3a 79 33 34 98 01 10 00 01 .......:y34.....
0x00000030 00 00 00 00 00 00 20 41 42 41 43 46 50 46 50 45 .......ABACFPFPE
0x00000040 4e 46 44 45 43 46 43 45 50 46 48 46 44 45 46 46 NFDECFCEPFHFDEFF
0x00000050 50 46 50 41 43 41 42 00 00 20 00 01 PFPACAB.....

Packets Found: 3
Ethernet: Src: (00:50:56:c0:00:08) Dst: (ff:ff:ff:ff:ff:ff)
Type: IPv4 (0x0800)
IPv4: Src: 172.16.176.1:35566 Dst: 172.16.176.255:35072
Protocol: UDP (17)
Packet Size: (92) Bytes
0x00000000 ff ff ff ff ff ff 00 50 56 c0 00 08 08 00 45 00 .......PV.....E.
0x00000010 00 4e b2 89 00 00 40 11 0e f4 ac 10 b0 01 ac 10 .N....@.........
0x00000020 b0 ff ee 8a 00 89 00 3a 65 8d 48 38 01 10 00 01 .......:e.H8....
0x00000030 00 00 00 00 00 00 20 41 42 41 43 46 50 46 50 45 .......ABACFPFPE
0x00000040 4e 46 44 45 43 46 43 45 50 46 48 46 44 45 46 46 NFDECFCEPFHFDEFF
0x00000050 50 46 50 41 43 41 42 00 00 20 00 01 PFPACAB.....

Packets Found: 4
Ethernet: Src: (00:50:56:f1:2d:82) Dst: (00:0c:29:a4:81:79)
Type: IPv4 (0x0800)
IPv4: Src: 131.107.115.254:47873 Dst: 172.16.176.143:3332
Protocol: TCP (6)
Packet Size: (58) Bytes
0x00000000 00 0c 29 a4 81 79 00 50 56 f1 2d 82 08 00 45 00 ..)..y.PV.-...E.
0x00000010 00 2c 29 7d 00 00 80 06 bd 45 83 6b 73 fe ac 10 .,)}.....E.ks...
0x00000020 b0 8f 01 bb 04 0d 79 7e 33 45 d8 8d 3c ef 60 12 ......y~3E..<.`.
0x00000030 fa f0 81 13 00 00 02 04 05 b4 ..........

Packets Found: 5
Ethernet: Src: (00:50:56:f1:2d:82) Dst: (00:0c:29:a4:81:79)
Type: IPv4 (0x0800)
IPv4: Src: 131.107.115.254:47873 Dst: 172.16.176.143:3332
Protocol: TCP (6)
Packet Size: (54) Bytes
0x00000000 00 0c 29 a4 81 79 00 50 56 f1 2d 82 08 00 45 00 ..)..y.PV.-...E.
0x00000010 00 28 29 7e 00 00 80 06 bd 48 83 6b 73 fe ac 10 .()~.....H.ks...
0x00000020 b0 8f 01 bb 04 0d 79 7e 33 46 d8 8d 3d 55 50 10 ......y~3F..=UP.
0x00000030 fa f0 98 6a 00 00 ...j..

Packets Found: 6
Ethernet: Src: (00:50:56:c0:00:08) Dst: (ff:ff:ff:ff:ff:ff)
Type: IPv4 (0x0800)
IPv4: Src: 172.16.176.1:35310 Dst: 172.16.176.255:35072
Protocol: UDP (17)
Packet Size: (92) Bytes
0x00000000 ff ff ff ff ff ff 00 50 56 c0 00 08 08 00 45 00 .......PV.....E.
0x00000010 00 4e 8c fd 00 00 40 11 34 80 ac 10 b0 01 ac 10 .N....@.4.......
0x00000020 b0 ff ee 89 00 89 00 3a 6c f3 40 d3 01 10 00 01 .......:l.@.....
0x00000030 00 00 00 00 00 00 20 41 42 41 43 46 50 46 50 45 .......ABACFPFPE
0x00000040 4e 46 44 45 43 46 43 45 50 46 48 46 44 45 46 46 NFDECFCEPFHFDEFF
0x00000050 50 46 50 41 43 41 42 00 00 20 00 01 PFPACAB.....

Packets Found: 7
Ethernet: Src: (00:50:56:f1:2d:82) Dst: (00:0c:29:a4:81:79)
Type: IPv4 (0x0800)
IPv4: Src: 131.107.115.254:47873 Dst: 172.16.176.143:3332
Protocol: TCP (6)
Packet Size: (1422) Bytes
0x00000000 00 0c 29 a4 81 79 00 50 56 f1 2d 82 08 00 45 00 ..)..y.PV.-...E.
0x00000010 05 80 29 7f 00 00 80 06 b7 ef 83 6b 73 fe ac 10 ..)........ks...
0x00000020 b0 8f 01 bb 04 0d 79 7e 33 46 d8 8d 3d 55 50 18 ......y~3F..=UP.
0x00000030 fa f0 83 08 00 00 16 03 00 11 e9 02 00 00 46 03 ..............F.
0x00000040 00 4c 62 3e 86 1c 84 f1 cb cd fc be 83 d9 b3 31 .Lb>...........1
0x00000050 5b 1d ed e8 37 1b b6 38 31 37 bc 01 cd f0 99 d2 [...7..817......
0x00000060 15 20 30 0d 00 00 cc 24 42 11 1a 50 f3 dc cf 74 ..0....$B..P...t
0x00000070 c4 04 7a f5 da 1b 93 9c 51 f4 46 64 43 b2 55 17 ..z.....Q.FdC.U.
0x00000080 48 f0 00 04 00 0b 00 11 97 00 11 94 00 04 89 30 H..............0
0x00000090 82 04 85 30 82 03 6d a0 03 02 01 02 02 0a 61 12 ...0..m.......a.
0x000000a0 df 52 00 00 00 00 00 12 30 0d 06 09 2a 86 48 86 .R......0...*.H.
0x000000b0 f7 0d 01 01 05 05 00 30 81 a3 31 0b 30 09 06 03 .......0..1.0...
0x000000c0 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 U....US1.0...U..
0x000000d0 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e ..Washington1.0.
0x000000e0 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e ..U....Redmond1.
0x000000f0 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 0...U....Microso
0x00000100 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2b ft.Corporation1+
0x00000110 30 29 06 03 55 04 03 13 22 4d 69 63 72 6f 73 6f 0)..U..."Microso
0x00000120 66 74 20 50 72 6f 64 75 63 74 20 53 65 63 75 72 ft.Product.Secur
0x00000130 65 20 53 65 72 76 65 72 20 43 41 31 20 30 1e 06 e.Server.CA1.0..
0x00000140 09 2a 86 48 86 f7 0d 01 09 01 16 11 70 6b 69 40 .*.H........pki@
0x00000150 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 1e 17 microsoft.com0..
0x00000160 0d 30 39 31 30 31 35 32 32 30 30 33 38 5a 17 0d .091015220038Z..
0x00000170 31 32 30 31 31 35 32 32 30 30 33 38 5a 30 6f 31 120115220038Z0o1
0x00000180 0b 30 09 06 03 55 04 06 13 02 55 53 31 10 30 0e .0...U....US1.0.
0x00000190 06 03 55 04 08 13 07 52 65 64 6d 6f 6e 64 31 0b ..U....Redmond1.
0x000001a0 30 09 06 03 55 04 07 13 02 57 41 31 12 30 10 06 0...U....WA1.0..
0x000001b0 03 55 04 0a 13 09 4d 69 63 72 6f 73 6f 66 74 31 .U....Microsoft1
0x000001c0 0d 30 0b 06 03 55 04 0b 13 04 42 47 4f 53 31 1e .0...U....BGOS1.
0x000001d0 30 1c 06 03 55 04 03 13 15 77 70 61 2e 6f 6e 65 0...U....wpa.one
0x000001e0 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 81 .microsoft.com0.
0x000001f0 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 .0...*.H........
0x00000200 03 81 8d 00 30 81 89 02 81 81 00 be ca f6 17 88 ....0...........
0x00000210 0c a9 e5 de 4d ef 6c 21 e0 46 58 c2 21 20 a3 e3 ....M.l!.FX.!...
0x00000220 7e 6d b0 eb 44 d6 f7 90 cd 56 c3 4b 99 97 09 09 ~m..D....V.K....
0x00000230 da db 68 57 87 e4 0f 19 b8 b8 57 c7 f7 03 75 9a ..hW......W...u.
0x00000240 f4 4e 51 c8 96 9a cb bd 34 fe eb 22 91 88 2b 1f .NQ.....4.."..+.
0x00000250 9a 36 8d d9 35 d3 f4 8d 75 09 a8 2c 31 c3 48 d3 .6..5...u..,1.H.
0x00000260 9c b8 c2 b9 67 70 cc 32 1e 93 16 98 f0 c8 12 47 ....gp.2.......G
0x00000270 5d 7e f7 2b c9 36 65 b1 4e 3a d6 dd ce d8 35 56 ]~.+.6e.N:....5V
0x00000280 76 56 d8 62 ed 7c b0 c9 e1 52 0d 02 03 01 00 01 vV.b.|...R......
0x00000290 a3 82 01 70 30 82 01 6c 30 0e 06 03 55 1d 0f 01 ...p0..l0...U...
0x000002a0 01 ff 04 04 03 02 04 f0 30 13 06 03 55 1d 25 04 ........0...U.%.
0x000002b0 0c 30 0a 06 08 2b 06 01 05 05 07 03 01 30 1d 06 .0...+.......0..
0x000002c0 03 55 1d 0e 04 16 04 14 d1 e7 5a 77 0b fb 90 eb .U........Zw....
0x000002d0 b5 10 1f b9 b3 b7 d9 64 38 07 07 c0 30 1f 06 03 .......d8...0...
0x000002e0 55 1d 23 04 18 30 16 80 14 9e 49 93 71 e6 fa ed U.#..0....I.q...
0x000002f0 97 80 08 89 3e 3c f3 29 cc 71 6d ef 5c 30 81 a6 ....><.).qm.\0..
0x00000300 06 03 55 1d 1f 04 81 9e 30 81 9b 30 81 98 a0 81 ..U.....0..0....
0x00000310 95 a0 81 92 86 47 68 74 74 70 3a 2f 2f 63 72 6c .....Ghttp://crl
0x00000320 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 .microsoft.com/p
0x00000330 6b 69 2f 63 72 6c 2f 70 72 6f 64 75 63 74 73 2f ki/crl/products/
0x00000340 4d 69 63 50 72 6f 53 65 63 53 65 72 43 41 5f 32 MicProSecSerCA_2
0x00000350 30 30 37 2d 31 32 2d 30 34 2e 63 72 6c 86 47 68 007-12-04.crl.Gh
0x00000360 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 ttp://www.micros
0x00000370 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 72 6c 2f oft.com/pki/crl/
0x00000380 70 72 6f 64 75 63 74 73 2f 4d 69 63 50 72 6f 53 products/MicProS
0x00000390 65 63 53 65 72 43 41 5f 32 30 30 37 2d 31 32 2d ecSerCA_2007-12-
0x000003a0 30 34 2e 63 72 6c 30 5c 06 08 2b 06 01 05 05 07 04.crl0\..+.....
0x000003b0 01 01 04 50 30 4e 30 4c 06 08 2b 06 01 05 05 07 ...P0N0L..+.....
0x000003c0 30 02 86 40 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 0..@http://www.m
0x000003d0 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 icrosoft.com/pki
0x000003e0 2f 63 65 72 74 73 2f 4d 69 63 50 72 6f 53 65 63 /certs/MicProSec
0x000003f0 53 65 72 43 41 5f 32 30 30 37 2d 31 32 2d 30 34 SerCA_2007-12-04
0x00000400 2e 63 72 74 30 0d 06 09 2a 86 48 86 f7 0d 01 01 .crt0...*.H.....
0x00000410 05 05 00 03 82 01 01 00 18 5f 91 4e 9d d6 d9 cf ........._.N....
0x00000420 4a 31 44 77 20 87 f8 af e8 a3 ef 18 11 c9 fb 4d J1Dw...........M
0x00000430 c9 e5 09 db 22 91 57 d7 db b7 b7 40 c4 0a 44 74 ....".W....@..Dt
0x00000440 14 cf eb a8 d4 41 7e ab f7 72 f4 c1 fd bb 15 49 .....A~..r.....I
0x00000450 e8 20 3c 4e a3 4b 05 e0 ad a6 4a 14 e6 f6 25 b2 ..<N.K....J...%.
0x00000460 90 26 ac 96 68 43 8c fd 4b 3a 9e a3 09 19 81 de .&..hC..K:......
0x00000470 51 f8 99 47 86 cc 5b 40 a8 d6 f8 a9 b6 b8 0f 5e Q..G..[@.......^
0x00000480 51 ce 1b 84 1b de 38 c2 86 08 34 62 a5 4c ab 4f Q.....8...4b.L.O
0x00000490 b1 91 70 69 7c ec 61 ce 56 44 0e 7a 2e 35 47 86 ..pi|.a.VD.z.5G.
0x000004a0 53 44 4d 08 1a 95 bd 65 c2 7d 47 d1 6e 0a 1c 83 SDM....e.}G.n...
0x000004b0 ff b4 d2 5f 04 1d 65 37 01 07 4c ba 2d 66 be 0f ..._..e7..L.-f..
0x000004c0 89 10 91 7a 3b c8 ec 7e 53 07 b8 6b 2b ab 2c 5b ...z;..~S..k+.,[
0x000004d0 c4 78 55 14 72 40 78 93 8f 74 de 29 b1 28 70 24 .xU.r@x..t.).(p$
0x000004e0 34 d1 42 82 17 65 1f 1f da 2a 0f 4f ec 71 ad 28 4.B..e...*.O.q.(
0x000004f0 aa d4 aa 2c b2 e5 cc 07 00 19 4c f9 7d 63 13 01 ...,......L.}c..
0x00000500 af 62 59 ee 89 c5 b5 ad c0 0d 88 af 98 10 45 53 .bY...........ES
0x00000510 e2 01 e5 a0 41 4e 03 61 00 05 c6 30 82 05 c2 30 ....AN.a...0...0
0x00000520 82 04 aa a0 03 02 01 02 02 0a 61 09 bd fa 00 01 ..........a.....
0x00000530 00 00 00 0f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 ....0...*.H.....
0x00000540 05 05 00 30 81 ac 31 20 30 1e 06 09 2a 86 48 86 ...0..1.0...*.H.
0x00000550 f7 0d 01 09 01 16 11 70 6b 69 40 6d 69 63 72 6f .......pki@micro
0x00000560 73 6f 66 74 2e 63 6f 6d 31 0b 30 09 06 03 55 04 soft.com1.0...U.
0x00000570 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a ...US1.0...U....
0x00000580 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e Washington1.0.

Packets Found: 8
Ethernet: Src: (00:50:56:c0:00:08) Dst: (ff:ff:ff:ff:ff:ff)
Type: IPv4 (0x0800)
IPv4: Src: 172.16.176.1:33262 Dst: 172.16.176.255:35072
Protocol: UDP (17)
Packet Size: (92) Bytes
0x00000000 ff ff ff ff ff ff 00 50 56 c0 00 08 08 00 45 00 .......PV.....E.
0x00000010 00 4e cf e4 00 00 40 11 f1 98 ac 10 b0 01 ac 10 .N....@.........
0x00000020 b0 ff ee 81 00 89 00 3a 91 a0 1c 2e 01 10 00 01 .......:........
0x00000030 00 00 00 00 00 00 20 41 42 41 43 46 50 46 50 45 .......ABACFPFPE
0x00000040 4e 46 44 45 43 46 43 45 50 46 48 46 44 45 46 46 NFDECFCEPFHFDEFF
0x00000050 50 46 50 41 43 41 42 00 00 20 00 01 PFPACAB.....

--snip---

README.TXT

https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/README.txt

ETHSCAN.PY

https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/ethscan.py

Thanks to MHL, Jamie and Cem for your help in learning the Volatility Framework. Your input was invaluable.

Volatility 2.2 Class/Api Documentation

2013-06-22T19:07:00.004-07:00

Learning how to create plugins for Volatility is forcing me to learn and understand object oriented programming in python which is great. To help out I generated some documentation for the framework using pydoctor.

https://jamaal-re-tools.googlecode.com/git/voldocs/index.html

Note:
Some items are missing from the generated documentation. They are listed below.

volatility.scan.PoolScanner.object_offset
volatility.plugins.procdump.ProcExeDump.dump_pe
volatility.plugins.malware.idt.IDT.get_section_name
volatility.plugins.malware.malfind.MalwareEPROCESS.get_vads
volatility.plugins.malware.malfind.MalwareEPROCESS.search_process_memory
volatility.plugins.malware.malfind.VadYaraScanner.__init__
volatility.plugins.vadinfo.VADDump.dump_vad
volatility.plugins.gui.win32k_core._MM_SESSION_SPACE._section_chunks
volatility.plugins.gui.win32k_core._RTL_ATOM_TABLE.find_atom
volatility.plugins.gui.sessions.SessionsMixin.session_spaces
volatility.plugins.gui.sessions.SessionsMixin.find_session_space
volatility.obj.BaseObject.__nonzero__
volatility.plugins.overlays.windows.windows._UNICODE_STRING
volatility.plugins.overlays.windows.windows.WinTimeStamp.windows_to_unix_time
volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32
volatility.plugins.registry.registryapi.RegistryApi.reg_get_currentcontrolset
volatility.cache
volatility.cache.CacheDecorator.__init__
volatility.conf
volatility.conf.ConfObject.add_option

Symantec Quarantined VBN file decoder

2013-06-13T03:39:00.002-07:00

pyqextract.py will decode Symantec quarantined vbn files. Like many others I couldn't get qextract.exe to work so I wrote my own. This decoder removes the magic bytes Symantec adds to each file that is quarantined. The "magic bytes" break the IAT, data/code segments by offsetting everything in the executable.

Usage: $ python pyqextract.py 5BB7429F.VBN out.exe

Updated version: 6/26/14
Download pyqextract.py

Another Python for Android Project

2012-01-20T00:25:00.000-08:00

This project looks better than SL4A + Py4A. More to come.
http://python-for-android.readthedocs.org/en/latest/index.html

Running Volatility Memory Forensics Framework on your android phone!

2012-01-07T01:55:00.000-08:00

In this post i'll quickly show you how to build your own python egg distribution package for your Android phone and PY4A. Volatility will be our example distribution package we will use. You can use the steps below to build your own python egg files for other modules like Pycrypto for example.

Volatility = The best Memory Forensics Framework
Android with sl4a = Best mobile phone OS + Python!

Please read my past posts on getting python running on your android.

1) Get the android-ndk, uncompress it and setup exports like this:

ff@shoryuken:~$ wget http://dl.google.com/android/ndk/android-ndk-r7-linux-x86.tar.bz2

ff@shoryuken:~$ tar xjvf android-ndk-r7-linux-x86.tar.bz2

ff@shoryuken:~$ mkdir android-toolchain

ff@shoryuken:~$ export ANDROID_NDK=~/android-ndk-r7

ff@shoryuken:~$ export ANDROID_NDK_TOOLCHAIN_ROOT=~/android-toolchain

ff@shoryuken:~$ $ANDROID_NDK/build/tools/make-standalone-toolchain.sh --platform=android-14 --install-dir=$ANDROID_NDK_TOOLCHAIN_ROOT

Auto-config: --toolchain=arm-linux-androideabi-4.4.3

Copying prebuilt binaries...

Copying sysroot headers and libraries...

Copying libstdc++ headers and libraries...

Copying files to: /home/ff/android-toolchain

Cleaning up...

Done.

2) Grab the Standalone library for compiling modules from http://code.google.com/p/python-for-android/downloads/list in this case we're getting http://python-for-android.googlecode.com/files/python-lib_r16.zip

From your $HOME directory

--> ff@shoryuken:~$ wget http://python-for-android.googlecode.com/files/python-lib_r16.zip

Unzip python-lib_r16.zip

ff@shoryuken:~$ unzip python-lib_r16.zip

Archive: python-lib_r16.zip

inflating: setup.sh

inflating: python.sh

---------snip-------------------------------------

3) Make sure python-setuptools is installed and grab volatility and uncompress

ff@shoryuken:~$ sudo apt-get install python-setuptools

ff@shoryuken:~$ wget https://www.volatilesystems.com/volatility/2.0/volatility-2.0.tar.gz

ff@shoryuken:~$ tar zxvf volatility-2.0.tar.gz

volatility-2.0/

volatility-2.0/contrib/

volatility-2.0/contrib/plugins/

volatility-2.0/contrib/plugins/disablewarnings.py

volatility-2.0/contrib/plugins/example.py

volatility-2.0/contrib/plugins/verinfo.py

volatility-2.0/contrib/plugins/psdispscan.py

---------snip-------------------------------------

4) Building the volatility egg,...

Change into the volatility directory

ff@shoryuken:~$ cd volatility-2.0/
We need to update setup.py and setup.cfg. Add the following to the top of the setup.py file in the volatility-2.0 directory.

from py4a import patch_distutils
patch_distutils()

So the setup.py file should look like this....

ff@shoryuken:~/volatility-2.0$ cat setup.py | less

---------snip-------------------------------------

# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

from py4a import patch_distutils #Add these 2 lines to the top of the setp.py file

patch_distutils()

try:

from setuptools import setup

except ImportError:

---------snip-------------------------------------

Edit your setup.cfg file to it looks like this:

ff@shoryuken:~/volatility-2.0$ cat setup.cfg

[egg_info]

tag_build =

tag_date = 0

tag_svn_revision = 0

[bdist_egg]

plat-name=linux-armv

Source the python-lib setup.sh file from the volatility and build the egg..
ff@shoryuken:~/volatility-2.0$ source ../python-lib/setup.sh

Build the egg file...

ff@shoryuken:~/volatility-2.0$ python2.6 setup.py bdist_egg

running bdist_egg

running egg_info

writing volatility.egg-info/PKG-INFO

writing top-level names to volatility.egg-info/top_level.txt

writing dependency_links to volatility.egg-info/dependency_links.txt

reading manifest file 'volatility.egg-info/SOURCES.txt'

reading manifest template 'MANIFEST.in'

---------snip-------------------------------------

In ~/volatility-2.0/dist you should see the file "volatility-2.0-py2.6.egg"
ff@shoryuken:~/volatility-2.0/dist$ ls

volatility-2.0-py2.6.egg

5) Running Volatility on your android phone

Push the egg to your phone. We place the file into the /sdcard/Download directory like so..

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push ~/volatility-2.0/dist/volatility-2.0-py2.6.egg /sdcard/Download

Open Python for Android on your phone and click Import Modules

Under the Import Module menu select volatility-2.0-py2.6.egg file.

You should get a message letting you know the module imported correctly.

Copy the main vol.py script to your phone

ff@shoryuken:~/volatility-2.0/dist$~/android-sdks/platform-tools/adb push ~/volatility-2.0/vol.py /sdcard/sl4a/scripts/

Save the following script into a file called runvol.py:

ff@shoryuken:~/volatility-2.0/dist$ cat runvol.py

import android

import os

import sys

droid = android.Android()

cmd = "vol.py -h"

#print os.path.realpath(os.path.dirname(sys.argv[0]))

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp pslist")

#os.system("/mnt/sdcard/sl4a/scripts/vol.py -h")

#print sys.executable

Dumping Memory with Qemu

In this example I've made an memory image from Windows XP running on Qemu using pmemsave from the Qemu monitor. I saved the memory image file to xp.dmp. The script will run pslist against the xp.dmp file. For more information on getting a memory image using QEMU read http://web.cs.du.edu/~mitchell/forensics/projects/memory/Setup.pdf

To help you out some in order to get the image size we take the windows XP memory image SIZE times (1024^2) = mem_size. So for example if we have a windows image running in qemu thats using 128megs of memory, from the Qemu Monitor we would type: (CTRL-ALT-2 to enter Qemus monitor, CTRL-ALT-1 to switch back to the OS)

(qemu) pmemsave 0 134217728 xp.dmp

How did we get the number 134217728? 128 * (1024^2) = 134217728

Above the command "pmemsave 0 134217728 xp.dmp" breaks down like this

-> pmemsave - the command to save memory

-> 0 is the first offset in memory to start from

-> 134217728 (basically 128M)

-> xp.dmp (output file)

Next we need to copy this memory image to your phone....

Coping the memory image to your phones Download directory

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push xp.dmp /sdcard/Download/xp.dmp

Copy the runvol.py script (above) to /sdcard/sl4a/scripts/

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push runvol.py /sdcard/sl4a/scripts/

Open sl4a and click runvol.py

When you click on runvol.py select the black terminal box to the left and you should be reward with something like this!

Ignore the Traceback error for now, however if you've gotten this far you've installed Volatility on your phone! We can update the script to run "volshell"

In the runvol.py script change:

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp pslist")

To..

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp volshell")

And repush the script to your phone

ff@shoryuken:~/android-sdks/platform-tools$ ./adb push runvol.py /sdcard/sl4a/scripts/
On your phone rerun the runvol.py script and type hh() and ps() for example like so

This post showed you how to build and import a python egg file for The Volatility Framework running on your android phone with python 4 android. Now you can do memory forensics from anywhere!

The Mobile Malware mini dump

2012-01-05T14:51:00.000-08:00

If you're researching malware on android this page is a wonderful resource for malware samples.

http://contagiominidump.blogspot.com/

App Inventor for Android

2012-01-03T13:38:00.001-08:00

I came across this on the way, it looks promising.

http://www.appinventorbeta.com/about/

How to increase the internal partition size an emulated android device

2012-01-01T16:57:00.000-08:00

By default the Android emulator will run only using a small amount of memory and you'll run out quick. Here's how to increase the memory size without recreating your emulation avd

-partition-size 512

Example Script

ff@shoryuken:~/android-sdks/tools$ more phoneup.sh

#Phone up script
#device A
sudo umount /home/ff/android-sdks/tools/a
sudo mount -o loop smsAC /home/ff/android-sdks/tools/a
./emulator -partition-size 512 -avd smsA -sdcard ./smsAC &
ff@shoryuken:~/android-sdks/tools$

QR Code Generator

2012-01-01T09:23:00.000-08:00

Use http://zxing.appspot.com/ to create your own 2D barcodes

Creating an Android Emulator Quickly

2011-12-31T13:04:00.000-08:00

Here's how to setup an Android Phone emulator, make sure the SDK + tools are installed (see my first post). You might have multiple Android SDK target versions to see which Android versions you have installed run the following:

ff@shoryuken:~/android-sdks/tools$ ./android list
Available Android targets:
----------
id: 1 or "android-7"
Name: Android 2.1
Type: Platform
API level: 7
Revision: 3
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WVGA854, QVGA
ABIs : armeabi
----------
id: 2 or "android-14"
Name: Android 4.0
Type: Platform
API level: 14
Revision: 3
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WXGA720, WSVGA, WVGA854, QVGA, WXGA800
ABIs : no ABIs.
----------
id: 3 or "android-15"
Name: Android 4.0.3
Type: Platform
API level: 15
Revision: 1
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WXGA720, WSVGA, WVGA854, QVGA, WXGA800
ABIs : armeabi-v7a
----------
id: 4 or "Google Inc.:Google APIs:15"
Name: Google APIs
Type: Add-On
Vendor: Google Inc.
Revision: 1
Description: Android + Google APIs
Based on Android 4.0.3 (API level 15)
Libraries:
* com.google.android.media.effects (effects.jar)
Collection of video effects
* com.android.future.usb.accessory (usb.jar)
API for USB Accessories
* com.google.android.maps (maps.jar)
API for Google Maps
Skins: WVGA854, WQVGA400, WSVGA, WXGA720, HVGA, WQVGA432, QVGA, WVGA800 (default), WXGA800
ABIs : armeabi-v7a
Available Android Virtual Devices:
Name: galaxy
Path: /home/ff/.android/avd/galaxy.avd
Target: Android 4.0.3 (API level 15)
ABI: armeabi-v7a
Skin: WVGA800

In my case I would like to emulate id 4 ("id: 4 or "Google Inc.:Google APIs:15"
") so I would run the following command:

ff@shoryuken:~/android-sdks/tools$ ./android create avd -n phoneA -t 4
Created AVD 'phoneA' based on Google APIs (Google Inc.), ARM (armeabi-v7a) processor,
with the following hardware config:
hw.lcd.density=240
vm.heapSize=48
hw.ramSize=512

Now to run the emulator we type:
ff@shoryuken:~/android-sdks/tools$ ./emulator -avd phoneA &

We're done!

Getting the SDcard can be found here.
http://blog.jayway.com/2009/04/22/working-with-sd-cards-in-the-android-emulator/

The quick version is simply cd into the tools directory under the android sdk:

$ cd /home/ff/android-sdks/tools
$ ff@shoryuken:~/android-sdks/tools$./mksdcard 128M phoneAsdCard
$ ff@shoryuken:~/android-sdks/tools$ mkdir sdcardA
$ ff@shoryuken:~/android-sdks/tools$ sudo mount -o loop phoneAsdCard sdcardA/
$ ff@shoryuken:~/android-sdks/tools$ ./emulator -avd phoneA -sdcard ./phoneAsdCard

Reading Google Books offline in Ubuntu

2011-12-31T12:51:00.000-08:00

If you want to read your google ebooks, install the "Google Ebooks App" for Chrome found here:
https://chrome.google.com/webstore/detail/mmimngoggfoobjdlefbcabngfnmieonb

One installed click Launch App which will take you here. "http://books.google.com/ebooks/app"

Under each book, select "Make Available offline" and bookmark the page "http://books.google.com/ebooks/app"

The plugin will download your ebook and now you don't have to be online in order to read your books anymore while on your computer :)

Installing Scripting Layer for Android, Android SDK and Python Quickly on Ubuntu plus sending yourself an SMS

2011-12-20T20:23:00.000-08:00

If you have Attention deficit hyperactivity disorder like me or don't want to read 40 pages for something that should take 5 minutes to install this blog is for you. If you want to read 40 pages about stuff you really don't care about (apple press) just to install python on Android here's the link

Else lets go, If you're rocken linux get the sdk

#If need be read my first post on getting java 32bit or the 64bit version with ia32-lib installed

#Using the barcode scanner install SL4A and Python for Android Both programs need to be installed.

#Installing the SDK
$ tar zxvf android-sdk_r15-linux.tgz
$ android-sdk-linux/tools/android #execute the installer

#Select Tools, Android 4.0.3 and Extra, you should have around 14 packages in the bottom right hand corner to install.

#Once installed on the phone click on Settings -> Developer options

# Under Developer options Select USB debugging and Stay awake

#Back in Ubuntu in your home directory "cd" into ~/android-sdks/platform-tools directory and add the following script to a file called adbserver.sh, don't forget to chmod ug+x adbserver.sh

#adbserver.sh server script to start python server on android
./adb shell am start -a com.googlecode.android_scripting.action.LAUNCH_SERVER \

-n com.googlecode.android_scripting/.activity.ScriptingLayerServiceLauncher \

--ei com.googlecode.android_scripting.extra.USE_SERVICE_PORT 45001

port=`./adb logcat -d | grep "Bound to" | tail -n 1 | grep '127.0.0.1' | sed -e 's/.*://g'`

./adb forward tcp:9999 tcp:$port
export AP_PORT=9999
echo "server started on port:$port"

(for some reason the USE_SERVICE_PORT option doesn't work, however the script takes care of this)

#On the phone from the top window drop down you can see the server running. It's in dark grey and extremely hard to see.

#If you click on the server listing, it will bring you to the following screen showing the server port on 42409

#We need to move android.py from the phone to python2.6 ubuntu's python2.6 dist-packages directory. Make sure python2.6 is installed.
$ ./adb pull /sdcard/com.googlecode.pythonforandroid/extras/python/android.py .
$ sudo cp android.py /usr/local/lib/python2.6/dist-packages/

#Add the following to hellosms.py and run it using python2.6
import android
droid = android.Android()
droid.smsSend("9999999999", "testing") #replace 9999999999 with your number

$ python2.6 hellosms.py

#You should get a text from yourself to yourself and you're done! I hope this helps.

Getting Eclipse and ADT working on Ubuntu 64

2011-12-15T23:20:00.000-08:00

Getting Eclipse to run on Ubuntu 11.10 64bit with the Android Development Tools (32bit).

This is how I was able to get the Android Development Tools working on my Ubuntu 11.10 64bit machine. The problem is that when you install eclipse using apt-get, you'll get the 64bit version, however the android sdk needs a 32bit version of java. We can solve this issue by installing both the 64bit and 32bit versions of Java, this is how I did it.

#install the ia32-libs so you can run 32bit apps and shit
$ apt-get --reinstall install ia32-libs-multiarch ia32-libs

#install eclipse, this will install the 64bit version
$ apt-get install eclipse

#Get Oracles 32bit and 64 bit version of JDK
http://www.oracle.com/technetwork/java/javase/downloads/jdk-7u2-download-1377129.html

#Decompress each tarball and rename the 64 bit folder and move both the /usr/lib/jvm
$ mv jdk1.7.0_02/ /usr/lib/jvm/ <---mv 32bit version to /usr/lib/jvm
$ mv jdk1.7.0_02/ jdk64_1.7.0_0 <---rename 64bit version
$ mv jdk64_1.7.0_0 /usr/lib/jvm <---mv 64 bit version

#Chown dem bitches
$ chown -R root:root /usr/lib/jvm/jdk1.7.0_02/
$ chown -R root:root /usr/lib/jvm/jdk64_1.7.0_02/

#Select the JDK using the following steps from http://www.webupd8.org/2011/09/how-to-install-oracle-java-7-jdk-in.html
$ add-apt-repository ppa:nilarimogard/webupd8
$ apt-get update
$ apt-get install update-java

#run update-java so Android SDK will us 32bit version
$ update-java (and select the 32 bit version (jdk1.7.0_02))

#update /etc/eclipse.ini to make eclipse run the 64 version of java
#nano /etc/eclipse.ini add the first two lines below
#-vm
#/usr/lib/jvm/jdk64_1.7.0_02/bin

$ cat /etc/eclipse.ini
-vm
/usr/lib/jvm/jdk64_1.7.0_02/bin
-startup
plugins/org.eclipse.equinox.launcher_1.2.0.dist.jar
--launcher.library
plugins/org.eclipse.equinox.launcher.gtk.linux.x86_64_1.1.100.dist
-showsplash
org.eclipse.platform
--launcher.XXMaxPermSize
256m
--launcher.defaultAction
openFile
-vmargs
-Xms40m
-Xmx384m
-Dorg.eclipse.equinox.p2.reconciler.dropins.directory=/usr/share/eclipse/dropins

#Run eclipse and install ADT (Android Development Tools) http://developer.android.com/sdk/eclipse-adt.html

#If you get the following error after installing ADT Software being installed: Android Development Tools 11.0.0.v201105251008-128486 (com.android.ide.eclipse.adt.feature.group 11.0.0.v201105251008-128486) Missing requirement: Android Development Tools 11.0.0.v201105251008-128486 (com.android.ide.eclipse.adt.feature.group 11.0.0.v201105251008-128486) requires 'org.eclipse.wst.sse.core 0.0.0' but it could not be found
Here is the fix
http://stackoverflow.com/questions/6482268/eclipse-indigo-cannot-install-android-adt-plugin

#Next read http://developer.android.com/sdk/adding-components.html to get the SDK and other comopnents working

#b00m

Jamaal Speights - devblog

Installing SoundPimp on OSX 10.10 with JackOSX.0.90 and LineIn.

Creating Tiny BareBone executables in Python for debugging shellcode and function stubs

Vol-MsDecompress

Examining the compressed and decompressed data found in memory.

Conclusion:

Notes:

Visualizing LZNT1 Decompression:

Unpacking Zeus Malware

Tcp Stream Reassembly Output Normalizer V2 (Libtsron)

Requirements: python2.7 | dpkt 1.8 | pypcap 1.1

Summary

$ hexdump -C TCP_173.194.63.178_80_192.168.1.30_56195 | less

Calling LibTSRON from python:

Utilizing LibTSRON to Decode zlib compressed TCP Data (la Gh0st Rat)

Running pcapzlib.py

Utilizing LibTSRON to Decode Poison Ivy Traffic:

How I make High Quality gifs with Gimp.

Smashing Themida with Qemu

Themida by Oreans provides a vast list of protection mechanisms.

I'll explain a very simple approach to defeating Themdia 2.x protection schemes using Qemu, Universal Import Fixer, and Imports Fixer 1.6.

Qemu was the only virtual environment that this Themdia protected exe did not detect and would run in completely. It did an excellent job detecting IDA (even with IDA Stealth) and would not run inside Immunity Debugger.

It also has built in kernel debugging detection. The binary will execute in Vmware, however it doesn't execute its true payload inside Vmware.

Themida Packed

Qemu Notes

General NotesVerified against another sample from the wild.

Summary

vadimm

Ethscan: volatility memory forensics framework plugin for recovering Ethernet frames from memory.

Volatility 2.2 Class/Api Documentation

Symantec Quarantined VBN file decoder

Another Python for Android Project

Running Volatility Memory Forensics Framework on your android phone!

The Mobile Malware mini dump

App Inventor for Android

How to increase the internal partition size an emulated android device

QR Code Generator

Creating an Android Emulator Quickly

Reading Google Books offline in Ubuntu

Installing Scripting Layer for Android, Android SDK and Python Quickly on Ubuntu plus sending yourself an SMS

Getting Eclipse and ADT working on Ubuntu 64

General Notes
Verified against another sample from the wild.