Offensive Programming

Hi, What languages do you recommend for malware development and why? I have wrote some simple malware in Go. I was using the Coldfire (https://github.com/redcode-labs/Coldfire) library, but it turns out it is not complete. One is a crypto miner and the other is uncompleted ransomeware. I know some Python and C++. I am thinking about: 1. ASM (FASM, NASM) 2. Hare 3. Nim 4. Zig 5. Rust 6. C But maybe you have some other recommendations. Thanks.

Why would you learn a skill with the least-fitting tool? C and C++ are extremely well established when it comes to interacting with the OS's underlying APIs, the main source of power for malware. Become proficient at using NASM in x64 for use in droppers. /sec/ already has a maldev thread, by the way. Also, are you even aware of the underlying concepts at play yet? Use toy languages when you can already make a good product.

>>35245 Do you have any resources for learning the underlying concepts? For example, stuff involving bootloaders or communication between processes or networking.

>>35245 Go is not least fitting at all, it is in fact exploding in popularity for malware. Seems you have no idea what you are talking about

>>35247 Well, what are your intended targeted systems? Linux and Windows are quite different in this regard. >>35251 My targets for that statement were Hare, Nim, and Zig. The fact, however, that Go is popular in malware development has no bearing on how fitting it is for malware development.

>>35253 >Well, what are your intended targeted systems? Windows or linux. My problem is that I don't want to sift through hundreds of pages to understand what is going on. But I don't have enough information to get good in one particularr area.

>>35254 So, basically, you want to be smart but refuse to learn? Put the books under your pillow while you sleep, maybe the knowledge will transfer into your lazy naive brain. Mate, hundreds of pages to read seems a lot for a 5th grade kid, intellectual people read that much every month, some of them every week. Your only choice is to be a script kiddie, buy a rootkit on some hacker forum and use it. <spoiler>Then get baton bumsex from the police and some real bumsex from cellmates</spoiler>

>>35254 Yes, that was my question. Windows ^ Linux, not Windows | Linux. >>35258 You're completely correct, and I hope OP gets your point. Malware development requires you to actively seek out holes in the programs made by people smarter and better paid than you. If msdn or manpages are too much, with absolute good faith, I recommend a different goal than malware development.

>>35241 OP here. I have heard of an OS called KolibriOS that is written in FASM and makes learning FASM easier. Have you lainons heard of it? If yes do you recommend it for learning FASM? Maybe you think that NASM is better than FASM, if so let my know why. As for programming languages. Almost every programming language has a library to use OS's APIs. Currently I'm thinking about Rust. Rust has a lot of haters, but the only bad thing about it is that when you want to use a library you need to compile half of crates. I would really appriciate some aruments why Rust is (not) a good programming language (for maldev).

>>35254 >My problem is that I don't want to sift through hundreds of pages to understand what is going on Don't pick Asm (too simple, doing anything requires a lot of code) or Rust (as complex as C++), unless you are willing to read a lot. You can use C++ or Python, since you have some experience with them. I think Hare is too small lang to be even considered. Go should be also on your list, imo.

>>35258 Alright you cocky bastard. I used to spend a lot of time reading every day. But I realize a lot of the books that you find on the topic are mostly a waste of time. For example, 1000 pages of linux kernel documentation might help me, but I can certainly find more helpful resources that take less time to read. I don't mind reading a book on say, bootloader exploits if it is full of relevant information and not just company history and personal anecdotes.

>>35267 Maybe you can find a nice Youtube channel if that's more your speed :)

>>35275 Eh. Not reply, but alot of the youtube channels that presents hacking stuff (that i've seen) is... poorly presented. They are entertaining, but I'm not going to rewatch the same video a couple of times to properly digest the content. I would prefer blogposts about some CTF. They always have a theme and is usually about exploits of some sort.

>>35277 Eh. Not reply, but alot of the youtube channels that presents hacking stuff (that i've seen) is... poorly presented. They are entertaining, but I'm not going to rewatch the same video a couple of times to properly digest the content. I know, I'm making fun of the asshole who made this junk thread

>>35251 You got this one wrong lain. Toy Languages are sometimes popular because they don't show up PSP/EDR products. Go is popular with malware dev for a couple reasons: 1.) Its made for making network services and makes it easy 2.) On Linux, at least, it makes its own syscalls. Nim is another toy language that has had some popularity for the reason that it avoids common heuristic checks in anti-malware products. >https://thesecmaster.com/uncommon-programming-languages-for-malware-development/ >https://threatpost.com/malware-makers-using-exotic-programming-languages/168117/

I find Java to be extremely offensive, if it helps.

>>35283 You're supposed to quote text. I had to raise the thermostat so my room temp iq could figure out what the hell you meant to say.

>>35309 You're supposed to quote text. I had to raise the thermostat so my room temp iq could figure out what the hell you meant to say. Get good retard

>>35241 I would suggest C++ because of what >>35245 said, plus you have the features and standard library which would save you time (for example std::filesystem, generic containers...), also if you just want to throw something you won't have to deal with C where everything requires more lines of code, plus you say you have experience with it so it should be the best choice. >but C++ is bloat meh, just use it as C + the good stuff

>>35241 F# because the dotnet ecosystem is security-fuarrrked

>>35305 >I find Java to be extremely offensive With GraalVM native-image you can compile Java code to native binaries with no extra dependencies at runtime.

>>35370 How's that better? You still have to write Java.

>>35370 Jesus what is this frankenstein system.

>>35397 and the jvm tooling which is the strongest selling points doesnt work as well or at all for graal

>>35405 The JDK tools I use work on my machine. You have to use the graal-specific versions, not the openjdk ones.