Tool update: MagicNumber Scanner with Packer/Protector Detection

Hello everybody, Long time no see you right? I've been VERY VERY busy, but here we go.

Today, I bring to you the new update for the MagicNumber Scanner which is now including Packer/Protector detection. ]¬)

Take a look:

Grab it from my github right here.

As you can see, the packed file was successfully identified by the script. I love this kind of stuff.

If you fing any bug, please let me know.

Cheers,

!apilookup - Win32 API Function Reference Locator for ImmunityDebugger

Hidey-ho everyone!

Well, after long time while I've been busy with a lot of stuff, finally I am back with a very nice goodie for you. As you have seen I am a big fan of ImmunityDebugger -but also of the old friend OllyDBG of course- and after some time I finally decided to put hands-on and make a plug-in.

Let me introduce you to the "!apilookup - Win32 API Function Reference Locator for ImmunityDebugger". The aim of this PyCommand is to provide quick access to Win32 API functions which are commonly required when performing debugging sessions. Yep!, NO MORE - Google => getprocaddress win32 api - Instead, on the ImmunityDebugger command bar just type this command: !apilookup getprocaddress and you will get direct-access to the required function. - Applauses!

Actually, one good point to note is the ability to provide not the whole word of a function, so you can do either !apilookup isdebuggerpresent or !apilookup isdebug, giving back the same results. RegEx r0x XD

For instance:

At this time I am pretty sure that you are wondering How The F**k I got the Win32.HLP as .CHM? Well, after a lot of time in searching Win32API.chm with no success, I've decided to make it. The support of .HLP files are no longer active for new versions of Windows, so many of the good old help files such as OllyDBG, ImmDBG and others are under this format. No PANIC. I've the CHM version for them too, but for a different post.

OK, so you know how the !apilookup works, this is how to get it. ]¬)

Installation steps:

1. Download the package from my git repo here.
2. Unrar and run the executable as Admin. - The exe looks malicious but it is not - promise. XD
3. Open ImmunityDebugger and in the command bar type: !apilookup <function>
4. Enjoy!

I know that there's an almost the same tool made by the master @MarioVilas, which offer on-line and updated references to APIs, so maybe you can use my "off-line" version when you don't have Inet access like my case when debugging on the bus or from any isolated location. 

That's all. Comment and share!

Tool update: MagicNumber Scanner v1.1.0

UPDATE: I'm glad to announce that my friend preth00nker and I worked together in the new version ( v1.1.0) of MagicNumber Scanner.

CHANGELOG
===========

v1.0

• Initial version

v1.1.0

• Converting to class code
• Refactoring code
• Adding rspec test files
• Adding HTML capability

You can grab your copy directly from git:

https://github.com/chr1x/magicnumscanner/

Download it, test it, and let us know if you find any bug or if you want to contribute with the signatures db.

Thanks!

-chr1x

Tool release: MagicNumber Scanner v1.0

Hello everybody,

As you may know, for certain activities in Reversing -like malware analysis- require a lot of tasks that can be automated using scripting languages and a big question comes here: "How I can do it? How it works?". In order to try to find an answer to those questions I decided to start exploring in how to use Ruby from the "binary" perspective.

There are a lot of different ways to deal with binary data, in this case I found that the simple "File" method can do the job. One important thing here is that you should "open" such file in read-only AND binary mode, otherwise you will get a lot of bad stuff, in terms of processing the right data.

As a result of this little research I wrote a tool called: "MagicNumber Scanner v1.0" which is basically a tool that receive as input a file and try to identify the file-type based on file signatures or in other words, the "Magic numbers".

I didn't try to reinvent the wheel, since you can use the "file" *nix/linux command actually, but in this case I am adding a little bit more of information like the generated URL based on the file-extension that you can visit if you have any doubt about what the file is, what program you can use to open it, and so on.

Below some screen captures:

Screenshot #1: Results when scanning an EXE file

Here we have a second case in where I arbitrarily renamed a file from .gif to .zip, and the tool shows how the magic-number detection identify that the real file-type is in fact a GIF file.

Screenshot #2: Results when scanning a fake ZIP file (originally is a GIF file)

Features:

• Magic-number scanning based on a simple signature list.
• Automatically generates a URL with the identified extension pointing to the http://filext.com/ website. (e.g. http://filext.com/file-extension/EXE)

TODO:

• Generation of HTML report that shows more information about the file extension.

I had great time researching how to do such *things* in Ruby, I did it the same in the past and I really liked as well, but is always good how to do it using different languages.

I would recommend you to download the code and see what I did, try to replicate the same but with other purpose. Remember, the sky is the limit.

How to install:

From git, or you can download the .rb file from here, or the .exe version from here.

If you find any bugs, let me know. 

...and like Jason Hawes from TAPS/GhostHunters says: Onto the next. 

Thanks! ]¬)