Reversing Cerber VB packer – Part 1 : shellcode extraction

In this post series, we are going to fully reverse the inner working of a Visual Basic packer, used at least by some Cerber ransomware sample. My whole methodology, meaning each and every step I took, will be documented here. We’ll end up with a complete view of the whole unpacking process before the actual payload is started, and I hope it will help you learn to do this on your own !

Continue reading

Solving an IDA Bug – struct list with blank elements

The other day, I encountered an isse with IDA pro 7.5: my struct and enum list left panel became empty, with blank elements. As you can see belo, It was unusable:

IDA bug struc

I have no idea how this happended exactly. IN the end I had to contact the support, and here is their solution, a single python commnd:

import ida_netnode
ida_netnode.netnode("$ dirtree/structs").kill()

You can then save and reopen the idb, the list should have been updated and be fine. You’ll lose the folders though, but it’s not that long to do so it’s ok.
This command also works with enums instead of structs, and maybe other pannels like this.

Writing a PE packer – Part 4 : packing with no relocation

At the end of the last part, I drawed your attention toward the fact that Mingw32 doesn’t produce movable binaries: it cannot create relocation table. You can force it to put the “Dll can move” flag, but without a relocation table, this binary would not work. We are going to change our packer to handle such non movable binaries.

Continue reading