(untitled)

Thread for discussing Windows Reverse Engineering: Topics including kernel drivers, Kernel RE, new subsystems like VBS all acceptable. Anyone here use the new windbg?

>>4875 I always wanted to give a try to windows reversing. Give me some good sources. I already own Practial Reverse Engineering by Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sébastien Josse but I haven't read it yet.

Does anyone know how the paged pool chose which pool to allocate in ? They are 4 paged pool and from experimentation it just increment an index and goes back to 0 at the end but I can't be sure it will always behave like that. >>4876 What's your experience in reverse engineering ? I think there is a chapter specifically about it in practical reverse engineering so probably start with that.

>>4877 Great question. To help you out, I'd to know: * Can you give me your general purpose? It's ok if it's hush hush. * What versions of Windows are you dealing with? The Kernel Pool behavior has evolved rapidly since Windows 8. Kernel pool based exploits have been mitigated in a number of ways. Check page 63 of this document: http://illmatics.com/Windows%208%20Heap%20Internals.pdf This helped me too: https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-Slides.pdf I don't think either explicitly answers your question, but reading between the lines I think it would be safe to assume that the first pool on the list with compatible chunks of memory will receive the allocation. You also have to figure out if you are dealing with the nx paged pool. If this is used, there is additional decision making to decide whether to use a nx pool, or a non- nx pool.

>>4877 My experience is about 2 years of playing ctfs and wargames/hackmes I have some knowledge about linux re/pwn but I have never tried windows (only some basics like cracking simple keygen with ollydbg)

>>4882 And it's not like I am linux wizard or something, I haven't even analyzed kernel stuff yet.

>>4875 looking at WINE source would probably be very useful.

>>4885 What software do you use when doing crackmes on windows? On linux I use gdb/peda, radare2, ltrace, strace, plasma and more What are equivalents for windows? I know that IDA is importatnt but I don't want to download it's cracked version as it will have probably viruses attached (I am thinking about setting up special VM only for cracked IDA). I personally can't see any good alternative to gdb, windbg seems alright if you want to debug kernel, x64dbg seems great, but it lacks command interface which I love in gdb, like x/10x $rbp x/20s $rsp p $ebp+20 and more (how to do it in x64dbg?) and I haven't really tried radare2 debugger but it has similar problem -> I need something better than inelegant cmd.exe (I don't like powershell too), git-bash seems not bad but it lacks something. I've tried running my favourite tools via cmd but it was pain in the ass. What cmd replacement would you recommend?

>>4887 I recommend: -x64 debug for user land debugging -windbg for user/kernel if you like the command line better. It's a little more like gds. -binary ninja for disassembling -IDA pro in case that breaks. -Radare if open source is open important to you. x64dbg has a little scripting api that lets you do the things you talked about. I don't know how mature it is. It's basically a re-implementation of ollydbg, where all the commands did work. When I approach a Windows crackme, I usually have a side by side debugger/diassembler combo. Binja + x64 debug isn't a bad combo. Last few crackmes I did, I just solved using sat solvers and called it a day.

>>4897 Yeah, sat solvers are great Can you tell me any good linux like terminal for windows? Also do you have any reference for x64dbg commands? I've been also interested in setting up a malware lab on my PC Virtual Machine should be enough? Are there any programs which let you run software in sandbox without VM?

>>4887 Can you direct me to documentation or guidance about using the Linux tools you've mentioned? I recently tried to debug a binary using gdb but got overwhelmed by its interface. Previously I have only dealt with debugging my own code.

>>4887 Didn't IDA recently upgrade it's "demo" version to support 64 bit binaries?

>>4906 Two approaches to this: 1) Use Cygwin: the best supported Windows/Unix shell experience I know of. There's also bash for Windows, but I haven't tried it. I don't know if it's good. 2) Learn Powershell. You can use a lot of Linux like commands, and it's what the "cool kid" Windows people do for scripting, but I personally find the language to be pretty bad. Too verbose. >Also do you have any reference for x64dbg commands? https://x64dbg.readthedocs.io/en/latest/commands/ >Virtual Machine should be enough? I haven't done malware in a while, but the way most pros do it is with VM's running sandbox software on isolated hardware. Buy an Intel NUC or something, and run cookoo sandbox. Be warned, for complex malware you will spend a lot of time getting it to work in the sandbox. By it's nature, the malware will want to do things the sandbox wont let it do - like speak out to its C&C server. >Are there any programs which let you run software in sandbox without VM? Most people I know use cookoo sandbox. I believe that's qemu based, but I haven't run it in ages.

>>4908 Firstly don't use bare gdb There is plenty of add-ons which make working with gdb more user-friendly (and are easy to install). I can recommend gdb-peda (it's exploit focused, but have some other functionalities which are generally useful). I also heard that gdb-dashboard is nice. About learning materials: nice reference card: http://users.ece.utexas.edu/~adnan/gdb-refcard.pdf some basics (I haven't read that, but my university lecturer recommended this): http://www.unknownroad.com/rtfm/gdbtut/ It's hard for me to give you any special link because I learned gdb in parts while I was learning asm and reverse engineering in my magical teenage years. I just learned it bydoing crackmes and I don't remember any sources Here is nice article with radare2 basics: https://www.megabeets.net/a-journey-into-radare-2-part-1/ >>4912 thanks Intel NUC seems cool I haven;t heard about cookoo sandbox, it looks great (I only heard about sandboxie, how good is it in comparison with cookoo?) >>4911 I tried IDA "demo" a few years ago and it just wasn't my thing. I think I will give it a try again.

>>4915 Thank you! >It's hard for me to give you any special link because I learned gdb in parts while I was learning asm and reverse engineering in my magical teenage years. That's fine, I imagined it would be hard since I pretty much learn things the same way, chaotically from different references. Recently I started learning asm again for a course my adviser is teaching on my graduate program, and I got interested in debugging again. That and I have a program that has a stupid feature that is getting in my way and it feels like something pretty simple to disable.

>>4915 thanks for your post, installed gdb-dashboard and it seems pretty cool.

>>4918 >>4926 It's good to be appreciated. If you are interested in debugging then after learning gdb check QIRA debugger (and timeless debuggers in general, it's awesome concept). I haven't used it yet but I am definitely going to give it a try during summer.

>>4930 I'm not >>4908, but thanks for the recommendation anyways. I looked at the page for the QIRA debugger, but other than some pretty visualizations I'm not sure what it gets me that gdb reverse execution doesn't, https://sourceware.org/gdb/onlinedocs/gdb/Reverse-Execution.html

>>4934 Qira is kind of abandonware at this point, I don't think geohot works on it anymore. GDB reverse execution, for me, typically refuses to work on some binaries. I've never had good luck actually getting it to work.

>>4954 What do you think about clipper for radare2?

>>4954 >>4960 Sorry, I meant cutter. Not a huge fan of debuggers with web UI's due to the larger overhead, especially in a VM, but it works really well and isn't that slow. IMO very intuitive. Just needs a dark theme for my poor retinas.