So guys, in this video, we'll be talking about the app hacking technique.
So this technique is used to make static analysis, static malware analysis a little bit difficult because
a model can handle the static analysis like opening in the accelerator or running the strings on that
XY.
And find that this exec is using the message box or any other function so he can deduce that if the
malware is connecting to the Internet or it is using any encryption functions to encrypt the or of the
contents of the disk.
So these strings are very useful for the malware analysts to identify what the malware is doing.
So in this API hacking technique, we are going to convert this API function into this string.
So this is a simple amplifier algorithm.
You can I have used this hash ripping python to generate the hexadecimal hash.
So this is the message box here.
And also
we are also using this MD5 function, this disturbance I have copied from StackOverflow.
It's just taking the string and computing the hash.
So this will be the result of this hash.
So let's.
See.
Get me five of.
Message box here.
And let's go and print this one.
We should get the same result.
And we can see the same result.
But in that case.
Now, let's, uh, remove this and paste the hash here.
You can remove this comment as well.
Now, what we're going to do is we are going to load this data, that is user data to a dealer.
You can also load any data.
So after loading the data, we need to enumerate all of the exported functions of the data.
So after enumerating each of this function, so let's say the first one acquired as W excuse you, we
need to get the MD5 hash for this function name and check that hash with this original hash when it
matches.
So that means we need to use that function and we can use the get proc address to get the address of
this function.
And in a similar way, we need to enumerate all of these export functions and apply this MD5 hash function
on that name to get them the hash and check that hash with this, our function hash.
If that matches, then that means we are going to use that function.
So.
Okay, so let's, uh, I have already created this function get, get function from hash.
So get function from hash.
And first one is we need to pass the data in user 32 dot.
And second one is cash.
So it will load this user that you draw and it will enumerate all of the X Factor functions and hash
those function names and see whether that hash matches this hash given in this parameter.
And if it matches, then that is the right function we need to use in our code.
So we got the dealer name and the original has Now let's go and get.
Marjorie handed off.
Be real name.
So we will get the dealer base address.
So database address means this starting one.
Starting that MJ bites.
Okay, From here onwards, we need to pass the each and every P header, or you can directly go and
skip to this offset.
You can see the option header.
That exploded three offset 170.
But it's good to pass this be fine.
So let's pass this one Marcia dot pointer to structure and the database.
And type of image does.
So does header.
We can print those that are not magic.
So let's run this and we can see.
If you see Amjad, we are good to go.
Now let's remove this.
Now we need to pass that signature.
Signature is equals to signature takes four bytes and Marshall that read.
Then a copy.
From the source that is database press.
Does header dot E revenue.
So this gives you the offset to the starting address of that anti header that is p header.
So starting index zero and destination signature.
And the rent is four.
The this one.
Signature.
Now the signature by Derek countries of this signature.
Now we need to create a header.
How into our dot signature is equals two.
And this beta, we need to convert this into integer.
Now.
Next year, we need to pass this fire marshal.
Pointer to structure, database plus.
Last year.
Revenue +44 is the signature size and then type of.
Image file header.
So we are studying this scene and they are not.
Fire header.
And the next one we need to pass is the optional head of Z course to master the pointer to structure
the base plus.
Or DART.
When you press for that signature and press 20, that is a size of fire header and type of.
They have optional had a.
So copy this.
And to you.
So we have copied.
We have.
Marshall everything we need.
So we need to go to this offset export directory.
So if you add the base address, plus this address, you will be landed here.
And we can convert this to image export directory.
Bill Bass Press.
And B header Optional Header Dot Export Table dot Virtual Address.
And this type of.
Export directory.
Copy.
We can say export.
So we are good to go.
Now we have the export and we can print the number of sections.
Export not number of sections.
For a number of functions and export.
Number of names.
Okay, so.
Now, before we are going to enumerate these names, we need to get the pointers for these one at the
functions.
This is called eat expert at this table and this is the ENT expert name table and this is the E export
ordinal table.
So let's get these pointers.
Are best press export.
Are this off functions?
And so this is a pivot point.
So.
Let's call this as it pointer export or the stable.
So copy this and paste you two times and change this to E and T pointer and this one to E word pointer.
And also change this to address of names.
Name.
Cardinals.
So now we have three pointers pointing to this area and this area and this area.
So let's go and enumerate these names.
For I inter is equal to zero.
I then export that number of names.
So I export number of names.
So if you go to this address of names and you can see if you read four bites nine to see five, seven.
So if you go to this nine to see five, seven, that is the first function.
So martial art pointer to string and see.
And E.A. Pointer.
Press.
Are you in for?
Or we can.
Let's read first function.
So this is the function name.
And at Rush, we are going to increment this entry point by four.
And we can print the function name.
Sorry.
Dealer Base Press 70 point.
So let's change this to an offset.
Oh, sorry.
We need to read those bytes.
So.
Forgot that step.
Marcia Dot read.
Into the 32.
Of E.A. Tea.
Now this is the offset.
So.
You need to offset, let's say, name offset.
Now point to string and see.
And bigger bass plus a name offset.
Our string function.
Now we should get the are the function names and we can see we got all the function names.
Now we are going to apply that MD5 function to get them.
Define hash for this function name.
So if I get MD5 off function name not to lawyer.
Is equal recourse to the hash.
What did you not hear?
Then we are going to print out this function.
So function found for the.
Hash.
So the first one is original hash.
And this function.
So let's run this.
And we should get message box set.
So here we can see function found for the hash message box.
Now we can simply say get proc address.
The best common function name.
We can actually return this phone directory.
So we are.
Getting the address of this function and returning here.
So this will be saved in the this func variable.
Now, I have already declared the delegate that is exact matching of the signatories.
Exact matching of the message box.
Now we need to get the delegate master to get delegate for a function pointer.
So here we need to pass the function that is func which we have got from this function and that type
of message.
So message is the name of the delegate.
I have declared and I can say message or music calls to message.
Now we can call this one and point zero.
Testing.
One, two, three.
Uh, has the API.
For a normal message box.
So let's do this and we can run this one and we can see we got we executed the message box here without
actually calling the message box here.
So with this hash, we have found the actual function.
You can also use directory the.
Our index of this one.
So if you found at this index, you can go to this one at the so name, address and read two bytes from
there.
And at that index of this address of functions, you will find that address.
So you can do that as well.
But just for demonstration purpose.
I have shown that that proper dress.
So this works for any other function you can hash.
So you can just change this, the URL and the hash and you can get that function across.