Reverse Engineering Warzone RAT - Part 1

A tutorial on reverse engineering the Warzone RAT, covering IDA Pro setup, C++ reversing basics, and struct reconstruction.

Join us as we reverse engineer Warzone Rat! Expand for more details.... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Chapters: 0:00 Introduction 4:25 Setting Up IDA 6:15 How to Force hex-rays to Decompile All Functions 7:42 Methodology for Identifying an Embedded Configuration File 9:16 C++ Reversing Basics 18:53 Adding a Struct in IDA 22:10 Fixing Incorrect Struct Size 26:39 Quickly Reversing Functionality 28:42 Reverse Engineering With Structs 32:04 Malware Trick Used to Locate Address in Memory 36:43 Walking a PE File Using Pointers 41:21 Creating and Importing IDC Files Automated unpacking: unpac.me/#/ Unpacked sample malshare.com/sample.php?action=detail&hash=48ff98ed6ae74da9c… IDC script (download don't copy paste): gist.github.com/herrcore/ccf46adc5f68dd4b3c74f74e1317e235 The following tutorials may help with some of the basic concepts presented in this video. C++ Reversing Basics youtube.com/watch?v=o-FFGIloxvE IDA Pro Microcode and x86 Calling Conventions youtube.com/watch?v=T0tdj1WDioM RC4 Crypto youtube.com/watch?v=CiJocXXMXK4 Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #ReverseEngineering #Malware #WarZoneRat