#AppCall - Twitter Hashtag

almost 3 years ago

#appcall OOC: Alô, pessoal! Não vou fazer uma call propriamente dita, eu prefiro desenvolver e criar laços naturalmente. Dito isso, o Theo já mora há alguns anos no condomínio, então estejam à vontade para falar na intimidade com ele. Ele é músico, tio do violão na creche +

1

6

0

197

m4n0w4r @kienbigmummy

over 3 years ago

@xorhex @vinopaljiri @nu11charb I think will work sir, cause #AppCall is activated in debugging mode, so you can use Linux version of IDA and remote debug windows bin on Windows VM.

1

2

0

Jiří Vinopal

@vinopaljiri

over 3 years ago

Great job @kienbigmummy 😊Thats beautiful 💙Calling functions with struct* argument using #IDA #appcall 😍

m4n0w4r @kienbigmummy

over 3 years ago

🔥 After discussing with @vinopaljiri, I can build an #IDApython script for extracting #Emotet C2s by using #AppCall feature for function that accepts a structure!!! Thanks so much @vinopaljiri 😘

5

83

15

13

0

15

2

1

0

Jiří Vinopal

@vinopaljiri

over 3 years ago

@kienbigmummy Great job man 👍😍I am glad it works😀I would be curious how many people know or would be interested in a way to call function with struct* as argument, using #IDA #appcall 😉

0

8

1

0

m4n0w4r @kienbigmummy

over 3 years ago

🔥 After discussing with @vinopaljiri, I can build an #IDApython script for extracting #Emotet C2s by using #AppCall feature for function that accepts a structure!!! Thanks so much @vinopaljiri 😘

5

83

15

13

0

Jiří Vinopal

@vinopaljiri

almost 4 years ago

"Native function and Assembly Code Invocation" My first @_CPResearch_ post showing tricks and practical usage of #IDA #Appcall, #Dumpulator @mrexodia and pure #Unicorn. Getting the best and full of annotated code snippets🤗

vinopaljiri's tweet photo. "Native function and Assembly Code Invocation"
My first @_CPResearch_ post showing tricks and practical usage of #IDA #Appcall, #Dumpulator @mrexodia and pure #Unicorn.
Getting the best and full of annotated code snippets🤗 https://t.co/nHAS0ka8cG

Check Point Research

@_CPResearch_

almost 4 years ago

For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. In this article, we explore and compare 3 ways of invoking functions: IDA Appcall, Dumpulator, and Unicorn Engine. https://t.co/QO4yUGx6Eg

0

322

122

77

0

9

136

38

25

0

m4n0w4r @kienbigmummy

almost 4 years ago

📄2nd method: don't care about the #LokiBot's hash function. Use #IDA #Appcall feature to recover the right func. 📕Need to get the correct value of the params before executing the function call in script. Clip: https://t.co/XrEDq6ZYrq

0

48

18

3

0

m4n0w4r @kienbigmummy

about 4 years ago

⚔️I took the time to write #IDA #Appcall scripts that applies to #Emotet 👹binary for the following purposes: - Extracting all C2 addresses. - Decrypting strings. Sample: https://t.co/y2BLMjqYPq 🔥Waiting for Ivan use #CVE-2022-30190 in the next spam!! #VinCSS #MalwareAnalysis

0

27

8

3

0

m4n0w4r @kienbigmummy

about 4 years ago

🔥My Deep Dive into #Zloader - the Silent Night 👹 Including: ⚔️Unpack Zloader Core Dll ⚔️Decrypt strings used by Zloader ⚔️Apply #AppCall to recover the Windows API calls. ⚔️Process Injection technique ⚔️Decrypt configuration https://t.co/DGoOZXGKhc #VinCSS #malwareanalysis

kienbigmummy's tweet photo. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
https://t.co/DGoOZXGKhc
#VinCSS #malwareanalysis https://t.co/eY0eWa3Xww

7

172

64

28

0

m4n0w4r @kienbigmummy

over 4 years ago

@vinopaljiri Yeah, the more tricks with IDA we have, the more easier for our job 💪. Just let's you know I used IDA #AppCall trick to decode strings of #Trickbot sample in my new blog post: https://t.co/l2BX3XA7JJ. Hope you add this trick in your bag and apply it in the new release video!

m4n0w4r @kienbigmummy

over 4 years ago

@_VinCSS_ has successfully detected and prevented a phishing attack campaign to distribute malware to customer that was protected by us. Here is my detail analysis about #Trickbot, one of the most dangerous malware!!! [Eng]https://t.co/ISj9b3j5OO [Vie]https://t.co/6F2v3DP2GB

kienbigmummy's tweet photo. @_VinCSS_ has successfully detected and prevented a phishing attack campaign to distribute malware to customer that was protected by us. Here is my detail analysis about #Trickbot, one of the most dangerous malware!!!
[Eng]https://t.co/ISj9b3j5OO
[Vie]https://t.co/6F2v3DP2GB https://t.co/3algunmnSV

7

72

31

13

0

1

7

1

2

0

m4n0w4r @kienbigmummy

over 4 years ago

I also describe the method to recover the APIs as well as decode the strings of #Trickbot based on IDA #AppCall feature to make the analysis process easier.

kienbigmummy's tweet photo. I also describe the method to recover the APIs as well as decode the strings of #Trickbot based on IDA #AppCall feature to make the analysis process easier. https://t.co/4GqDTlOIE1

1

6

0

m4n0w4r @kienbigmummy

about 5 years ago

@vinopaljiri Yes, the API hashing function from #LokiBot is quite simple, so we can implement our #idapython script for recovering the API name. #Appcall feature was introduced in IDA Pro 5.6, until now there're not many articles referring to this feature.

0

2

0

m4n0w4r @kienbigmummy

about 5 years ago

#LokiBot is like any other malware, API calls are hidden by dynamically resolving them using function hashes. Try playing with IDA #Appcall to evaluate the routine that resolves the API reveal most API names✌️

2

55

15

6

0

Top Tweets for #AppCall

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users