Dumpulator - Using Binary Emulation To Automate Reverse Engineering

แชร์
ฝัง
  • เผยแพร่เมื่อ 2 ต.ค. 2024

ความคิดเห็น • 22

  • @AgentBAV
    @AgentBAV 2 ปีที่แล้ว +1

    Very nice 🔥, another banging videos🤙🏽

  • @EvilSapphireR
    @EvilSapphireR 2 ปีที่แล้ว +8

    MCU: "We have the greatest crossover in history!"
    OALabs:

  • @PlanetModzHD
    @PlanetModzHD 2 ปีที่แล้ว +4

    This tool is amazing! I’m definitely going to use this

  • @Marselmarsemars
    @Marselmarsemars ปีที่แล้ว

    can I implement in memory fuzzing via dumpulator?

  • @BlueDraEv
    @BlueDraEv 2 ปีที่แล้ว +3

    Great Video! Easy to understand.

  • @ferasdour
    @ferasdour 2 ปีที่แล้ว +1

    Wonder how this would work compared to angr. Oh or with angr.... i should check this out

  • @riskydissonance
    @riskydissonance 2 ปีที่แล้ว +1

    Dump it live! This is awesome though :D can't wait to have a play

  • @antonantochi8498
    @antonantochi8498 2 ปีที่แล้ว +1

    Neat! Now we need unicorn engine tutorial in addition)

  • @elisalem164
    @elisalem164 2 ปีที่แล้ว +1

    Very promising tool, love this channel!

  • @joojooo1819
    @joojooo1819 2 ปีที่แล้ว +2

    just wondering, seems like its possible to do this, using IDA's appcall functionality? and/or fox-it reasm tool?

    • @OALABS
      @OALABS  2 ปีที่แล้ว +2

      Yes, sort of... depending on what "this" means. These are actually two very good tools, but they are limited to specific tasks where as dumpulator is a sledgehammer... great for everything so long as you don't mind a bit of overkill. So first appcall can be used to call a function from IDA but it calls the actual function in a debugger (natively) not in an emulator, so it's not safe unless you are using a separate debug VM etc. Also, it's tied to IDA so it's not a good choice for standalone scripts (like config extractors). But assuming you setup your IDA environment safely you could get more or less the same functionality if your goal was to simply call a function and test some input. Now for reasm this quite different ... reasm is good at an algorithm in a compiled windows binary and converting it into native linux library... conceptually this closer to the way we used dumpulator at the end to decrypt Emotet strings. However, the main drawback of reasm is that it can only convert algorithms, as soon as you hit a simple API call you need to work around it somehow... also you are tied to the platform you compile for. Even with the simple Emotet example we showed there are a few API calls buried in the function that are emulated in dumpulator which would fail in reasm. But again, if your goal was to simply convert a complex algorithm into a native library for linux and the algorithm didn't have any API calls reasm would be a good choice as it would be much faster than dumpulator. Hope this answers your questions : )

    • @joojooo1819
      @joojooo1819 2 ปีที่แล้ว

      @@OALABS Thank you, for the informative explanation and comparison of the tools! Yes, you have answered my questions :) looking forward to seeing more use cases for this.

    • @OALABS
      @OALABS  2 ปีที่แล้ว

      Come hang out on our discord! I think you would enjoy the stuff we are working on :)

  • @corejake
    @corejake 2 ปีที่แล้ว +2

    Dumpit!

  • @yazeedmohd3993
    @yazeedmohd3993 2 ปีที่แล้ว

    How would i get the functionality of MiniDump plugin used on windows with x64dbg, on a linux machine?
    In other words, how to use dumpulator on linux? Just a beginner here…

  • @happyman9666
    @happyman9666 2 ปีที่แล้ว +4

    Ghidra is vulnerable to log4j vulnerability

    • @OALABS
      @OALABS  2 ปีที่แล้ว +10

      That is very true... but also very irrelevant to this video 😆😆

    • @happyman9666
      @happyman9666 2 ปีที่แล้ว

      @@OALABS cool

  • @synorine9004
    @synorine9004 2 ปีที่แล้ว +1

    Can you make a video about the new crypter called Babadeda Crypter?

    • @OALABS
      @OALABS  2 ปีที่แล้ว

      Send hashes : )

  • @Meskalin_
    @Meskalin_ 2 ปีที่แล้ว +3

    nice tool. also craqq coqaine.

  • @HackerSumitJi
    @HackerSumitJi 2 ปีที่แล้ว

    Bro I want to contact you for business purpose. Any email id to contact??