oalabs patreon

Live Stream VOD: Building a Config Extractor for ISFB

🕑 Added 2022-10-16 22:54:41 +0000 UTC

Comments

Al

Thanks a lot for you reply! Yes, your code works properly! It was just a clarification because it's the first time that I tried to create some automation and I wanted to be sure about what I'm doing! Still thanks!

OALABS

You are correct! We are missing the File Header in the calculations, https://i.imgur.com/lFlVBJ3.png DOS header size = pe.DOS_HEADER.e_lfanew PE signature = 4 bytes File Header size = (missing) Optional Header size = pe.NT_HEADERS.FILE_HEADER.SizeOfOptionalHeader Section table size = number of sections * section size The File Header size should be static so we can just add the size as you suggested and it will fix the offset for us... for this config extractor it doesn't matter (which is why it works) because we just need to roughly get into the area to find the config signature, but this could really mess things up in other cases where we actually need the end of the header.

Al

Hi, I was trying to understand your code and what really drove me crazy are the parameters used in “get_section_table_end” because I think that something is missing. I tried to understand the +4 parameter in x32 configuration and I figured out that it was a reference to the PE header signature that is 4 bytes. Am I correct? However, I think you should also take into account the additional 20 bytes that go from Machines to Characteristics fields that are still related to the PE file. If you do so, your pointer should correctly points to the “dead zone” between the section table and the code. If I am wrong, would you please help to understand it better? BTW, thanks a lot for all your contents!

OALABS

The references in the note are much more comprehensive, this one specifically https://research.nccgroup.com/2021/05/04/rm3-curiosities-of-the-wildest-banking-malware/