top of page
Search
  • Writer's pictureotw

Reverse Engineering Malware: Reversing and Disassembly Tools

Updated: Dec 28, 2022

Welcome back, my aspiring malware analysts!


In previous tutorials here, I have demonstrated the power of such reversing and disassembly tools as Ollydbg, IDAPro and Ghidra. In this tutorial I'd like to share and demonstrate a few simpler tools that you are certain to want to have in your malware analysis toolbox. Each of these tools does a specific task and can provide a quick glimpse into the files you are analyzing. Their capabilities are included in such comprehensive tools as Ghidra and IDA Pro but they are be useful as a double check the work of these more comprehensive tools.


Let's take a look at some of the most useful of these tools.


file


In nearly every *nix (Linux, Unix, BSD, Solaris, etc) operating system, there is exists the file utility. The file command is used to determine the type of file. It does this by examining specific locations and fields within the file. Most files have a unique field for their specific file type.


This output can either be human readable (ASCII) or MIME.


Let's test this utility on multiple file types.


First, I have an .exe file named yourphone.exe


As you can see, the file utility identifies it as a PE32 for a Intel 80386 processor for Windows.


Now let's try a variety of file types.


As you can see above, the file utility successfully identified everything from the graphics files, XML files, RTF files and Powerpoint.


As a caveat, the file utility is not always accurate. Once again, it is looking at specific fields that indicate the file type and a binary or any other file that has those fields filled with similar data, will be mis-identifed . This why is is always important to use multiple tools and correlate their results.


PE Tools


PE Tools is collection of tools for analyzing binaries on Windows. As you can see below, PE Tools has analyzed the executables on my system identifying the architecture, Process ID, Image Base and Image Size. In the lower window, it provides the path to each executable.



PE Tools can also be used to;


  1. Determine the compiler used

  2. Whether Obfuscation techniques were used

  3. View the executables header


PEiD


PEiD is a Windows program for identifying the compiler used to build the executable (Microsoft Visual C++8).



PEiD has many other capabilities, many which overlap the PE Tool.


ldd (list dynamic dependencies)


ldd is *nix utility used to list the dynamic libraries used by the binary. Below we used ldd to list the dynamic libraries of apache2




strings


Many times embedded strings can be enlightening to the malware analyst. At times, developers leave notes to themselves that can reveal the function and intent of the malware as well as the developers' native language.


Let's look at the help screen for this utility.



Note that the default is to identify strings 4 characters or longer. This can be adjusted by simply adding the --<number> option after the command.


Let's see what strings does when applied to our apache2 binary. Since we expect considerable output, let's pipe the output to more and view the list of strings one page at a time.


kali > strings /usr/sbin/apache2 | more

When scroll down a bit, we can see some more useful and longer strings including reference to some libraries this binary uses.

If we know what we are looking for, we might be able to use the strings utility to find something very specific using the grep filter. If we search the wannacry ransomware and grep for "http", we can immediately locate the Command and Control (C&C) server URL.



ndisasm (Netwide Disassembler)


ndisasm is an x86 binary file disassembler. It is part of the NASM and simply uses the Netwide Assembler to disassemble binary source files.


Let's look at its help file.


Now, let's generate some shellcode with Metasploit's msfvenom and name it chess.exe.


kali > msfvenom -p windows/meterpreter/reverse_tcp -f exe > chess.exe


Now, let's use ndisasm to disassemble chess.exe. Since this shellcode is 32-bit, we need to use the -b option followed by 32 and let's pipe the output to more.


kali > ndisasm -b 32 chess.exe | more


As you can see above, ndism successfully disassembled our msfvenom generated shellcode. Unfortunately, it's hard to work with as stdout, so let's redirect it to a file.


kali> ndiasm -b 32 chess.exe > chess_assembly


Now, let's open it with any text editor, in this case, mousepad.


kali >mousepad /home/kali/chess_assembly

Summary


The tools demonstrated in this tutorial are no substitute for Ghidra or IDA Pro but can be used to double check the results of such tools. In addition, as a newcomer to disassembly, these tools demonstrate some of the capabilities of these more comprehensive tools and further our understanding.

2 Comments


astriddavina54
astriddavina54
Jan 03, 2023

Do you suspect your spouse of cheating, are you being overly paranoid or seeing signs of infidelity…Then he sure is cheating: I was in that exact same position when I met Henry through my best friend James who helped me hack into my boyfriend’s phone, it was like a miracle when he helped me clone my boyfriend’s phone and I got first-hand information from his phone. Now I get all his incoming and outgoing text messages, emails, call logs, web browsing history, photos and videos, instant messengers(facebook, whatsapp, bbm, IG etc) , GPS locations, phone taps to get live transmissions on all phone conversations. if you need help contact his gmail on , Henryclarkethicalhacker@gmail.com, and you can also , whatsap…


Like

Hey everyone , I don’t really know much about this hacking things but I can direct you to a professional hacking company who helped me to track and hack my boyfriend’s iPhone and his Facebook respectively.. If you need to check on your partner’s sincerity, employee’s honesty, recover your email passwords, Social networks (i.e Facebook, Twitter, IG), change your school grades, clear your criminal records, gain access to bank accounts,spy on phone. you can just contact them at … Their charges are minimal and negotiable contact them at Henryclarkethicalhacker @ gmail, com]..tell him you are from me or text him or whatsapp +1 8 1 3 4 2 1 1 3 2 6…. You can thank me later.



Like
bottom of page