Blobrunner - Apace Debug Shellcode Extracted During Malware Analysis


BlobRunner is a uncomplicated tool to speedily debug shellcode extracted during malware analysis.
BlobRunner allocates retentivity for the target file in addition to jumps to the base of operations (or offset) of the allocated memory. This allows an analyst to speedily debug into extracted artifacts amongst minimal overhead in addition to effort.

To role BlobRunner, you lot tin download the compiled executable from the releases page or fix your ain using the steps below.

Building
Building the executable is conduct forrad in addition to relatively painless.
Requirements
  • Download in addition to install Microsoft Visual C++ Build Tools or Visual Studio
Build Steps
  • Open Visual Studio Command Prompt
  • Navigate to the directory where BlobRunner is checked out
  • Build the executable past times running:
cl blobrunner.c

Building BlobRunner x64
Building the x64 version is most the same equally above, but only uses the x64 tooling.
  • Open x64 Visual Studio Command Prompt
  • Navigate to the directory where BlobRunner is checked out
  • Build the executable past times running:
 cl /Feblobrunner64.exe /Foblobrunner64.out blobrunner.c

Usage
To debug:
  • Open BlobRunner inwards your favorite debugger.
  • Pass the shellcode file equally the offset parameter.
  • Add a breakpoint earlier the bound into the shellcode
  • Step into the shellcode
BlobRunner.exe shellcode.bin
Debug into file at a specific offset.
BlobRunner.exe shellcode.bin --offset 0x0100
Debug into file in addition to don't recess earlier the jump. Warning: Ensure you lot convey a breakpoint laid earlier the jump.
BlobRunner.exe shellcode.bin --nopause

Debugging x64 Shellcode
Inline assembly isn't supported past times the x64 compiler, in addition to thence to back upwards debugging into x64 shellcode the loader creates a suspended thread which allows you lot to house a breakpoint at the thread entry, earlier the thread is resumed.

Remote Debugging Shell Blobs (IDAPro)
The procedure is most identical to debugging shellcode locally - amongst the exception that the you lot withdraw to re-create the shellcode file to the remote system. If the file is copied to the same path you lot are running win32_remote.exe from, you lot exactly withdraw to role the file mention for the parameter. Otherwise, you lot volition withdraw to specify the path to the shellcode file on the remote system.

Shellcode Samples
You tin speedily generate shellcode samples using the Metasploit tool msfvenom.
Generating a uncomplicated Windows exec payload.
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -o test2.bin

Feedback / Help
  • Any questions, comments or requests you lot tin detect us on twitter: @seanmw or @herrcore
  • Pull requests welcome!


Popular posts from this blog

Osweep - Don't Simply Search Osint, Sweep It

Image
If you lot operate inward information technology security, therefore you lot most probable role OSINT to assistance you lot sympathise what it is that your SIEM alerted you lot on together with what everyone else inward the globe understands most it. More than probable you lot are using to a greater extent than than 1 OSINT service because most of the fourth dimension OSINT volition entirely render you lot amongst reports based on the final analysis of the IOC. For some, that's practiced enough. They do network together with electronic mail blocks, do novel rules for their IDS/IPS, update the content inward the SIEM, do novel alerts for monitors inward Google Alerts together with DomainTools, etc etc. For others, they deploy these same countermeasures based on provided reports from their third-party tools that the fellowship is paying THOUSANDS of dollars for. The work amongst both of these is that the analyst needs to dig a footling deeper (ex. FULLY deobfuscate a PowerShel
Read more

Efiguard - Disable Patchguard Together With Dse At Kicking Time

Image
EfiGuard is a portable x64 UEFI bootkit that patches the Windows kicking manager, kicking loader too center at kicking fourth dimension inward club to disable PatchGuard too Driver Signature Enforcement (DSE). Features Currently supports all EFI-compatible versions of Windows x64 e'er released, from Vista SP1 to Server 2019. Easy to use: tin live on booted from a USB stick via a loader application that automatically finds too boots Windows. The driver tin also live on loaded too configured manually using either the UEFI rhythm out or the loader. Makes extensive utilization of the Zydis disassembler library for fast runtime pedagogy decoding to back upwardly to a greater extent than robust analysis than what is possible amongst signature matching, which oftentimes requires changes amongst novel OS updates. Works passively: the driver does non charge or start the Windows kicking manager. Instead it acts on a charge of bootmgfw.efi yesteryear the firmware kicking
Read more

Telekiller - A Tool Session Hijacking In Addition To Stealer Local Passcode Telegram Windows

Image
H5N1 Tools Session Hijacking And Stealer Local passcode Telegram Windows. Features : Session Hijacking Stealer Local Passcode Keylogger Shell Bypass ii Step Verification Bypass Av (Coming Soon) Installation Windows git clone https://github.com/ultrasecurity/TeleKiller.git cd TeleKiller pip install -r requirements.txt python TeleKiller.py Dependency : python 2.7 pyHook pywin32 Video Tutorial Operating Systems Tested Windows 10 Windows 8.1 Windows 8 Windows 7 Contact WebSite Ultra Security Team: https://ultrasec.org Channel Telegram: https://t.me/UltraSecurity Thanks to Milad Ranjbar MrQadir Download TeleKiller
Read more