oalabs
patreon
Live Stream VOD: AresLoader Fun
🕑 Added 2023-04-11 00:22:24 +0000 UTCIn this Twitch stream we have some fun reverse engineering all the stages in AresLoader.
This VOD is a little wilder than our usual streams, I decided to leave in some more of the banter etc. You guys let me know if you want more of this or if you prefer the more edited cleaner streams?
Samples
7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb
Notes
AresLoader: Taking a Closer Look at This New Loader
Comments
OALABS
These questions are probably better to ask on the Discord since then everyone can benefit from the answer. So when you highlight a struct member and press Ctrl+Alt+x IDA will pop up a window listing all global cross references to the member. Rolf's trick is to then right click in the window and select "refresh" which causes IDA to run the decompiler across the binary again. Re-running the decompiler a is a quick hack to fix calling conventions and function arguments.
Ahmed Raof
I'm not sure what the "Ctrl+Alt+x" trick does. Could you explain it to me?
Karsten Hahn
Hey, I don't want to miss out on the banter! :D Did not watch it yet, but please leave it in. :D
gdpqq
I liked this approach with less editing!
