Learning IDA Hex Rays Python API to Analyze Sliver Obfuscation (Stream - 21-06-2024)
In this stream we focused on learning the IDA Hex Rays Python API to capture information needed to deobfuscate Sliver payloads that are obfuscated using Garble (https://github.com/burrowers/garble)
Training: https://training.invokere.com/course/imbt
Notes: https://github.com/Invoke-RE/stream-notes/tree/main/red-team
Twitch: https://www.twitch.tv/InvokeReversing
Twitter: https://twitter.com/InvokeReversing
Mastodon: https://infosec.exchange/@invokereversing
0:00 Introduction
3:49 GoReSym, IDACode and Obfuscation Overview
14:00 IDAPython to Detect XOR Obfuscation
21:24 Exploring Hex Rays Microcode API
33:56 CTree Expression Visitor
52:30 CTree Instruction Visitor
1:09:30 HRDevHelper for Visualizing Hex Rays Objects
1:13:49 Identifying For Loop
1:32:17 Capturing Variables in For Loop
1:47:07 Capturing Integers from Variable Names
1:58:36 Fingerprinting Obfuscation Algorithm
2:04:49 Reimplementing Obfuscation Algorithm
Видео Learning IDA Hex Rays Python API to Analyze Sliver Obfuscation (Stream - 21-06-2024) канала Invoke RE
Training: https://training.invokere.com/course/imbt
Notes: https://github.com/Invoke-RE/stream-notes/tree/main/red-team
Twitch: https://www.twitch.tv/InvokeReversing
Twitter: https://twitter.com/InvokeReversing
Mastodon: https://infosec.exchange/@invokereversing
0:00 Introduction
3:49 GoReSym, IDACode and Obfuscation Overview
14:00 IDAPython to Detect XOR Obfuscation
21:24 Exploring Hex Rays Microcode API
33:56 CTree Expression Visitor
52:30 CTree Instruction Visitor
1:09:30 HRDevHelper for Visualizing Hex Rays Objects
1:13:49 Identifying For Loop
1:32:17 Capturing Variables in For Loop
1:47:07 Capturing Integers from Variable Names
1:58:36 Fingerprinting Obfuscation Algorithm
2:04:49 Reimplementing Obfuscation Algorithm
Видео Learning IDA Hex Rays Python API to Analyze Sliver Obfuscation (Stream - 21-06-2024) канала Invoke RE
Комментарии отсутствуют
Информация о видео
7 июля 2024 г. 9:53:21
02:07:23
Другие видео канала
Reverse Engineering with AI: Binary Ninja MCP Development Stream (20/05/2025)
x64dbg Christmas Theme
Stealer Malware Analysis Part 3 (Stream - 22/04/2025)
Exploring the Sliver and Havoc C2 Frameworks (Stream - 30-03-2024)
Introduction to Malware Binary Triage (Course Trailer)
Time Travel Debugging in Binary Ninja with Xusheng Li
Analyzing and Unpacking Qakbot Using Binary Ninja Automation Part 2
Beginner Malware Analysis: DCRat with dnSpy (Stream 03/06/2025)
Malware Network Monitoring (Course Preview)
Golang Deobfuscation with Binary Ninja (Stream - 04/01/2025)
Binary Ninja Sidekick 2.0: Analyzing Ransomware with Large Language Models
Malware Loader Reverse Engineering with IDA Pro (Stream - 06/05/2025)
Binary Ninja Sidekick: Reverse Engineering Malware with Large Language Models
BRC4 Malware Analysis and Deobfuscation (Stream - 9/11/2024)
Introduction to Malware Binary Triage Course (Binary Ninja Edition)
IDA Hex-Rays Automation for BRC4 Obfuscation (Stream - 22/12/2024)
AI Malware Reverse Engineering with Binary Ninja MCP Server (Stream - 11/04/2025)
IMBT Binary Ninja Edition Teaser
Stealer Malware Analysis Part 2 (Stream - 15/04/2025)
Beginner Malware Analysis: Babuk Ransomware with IDA Pro (Stream - 13/05/2025)
