This is a content that surely is not expected to go viral on YT, but is a treat to watch for people with some coding knowledge and curious minds, thanks for creating this!
The first video has 300k+ views, this one have a lot less (about 70% less). It's funny to see how complex subject videos tends to have this pattern. With 3Blue1Brown playlists this happens a lot.
With this guy's ability it wouldn't surprise me that part 3 ends with the malware creator tied to a chair and asking forgiveness. He's going serious with this. Absolutely awesome.
Just got the first part recommended. These two videos taught me a lot about how to use Ghidra so keep up the great work. I also really like the flow diagrams you're drawing as they give a great overview. You got a new subscriber and I hope you'll upload more regularly now.
I dont see very much obfuscation on wannacry lol i remember a keygenme who was a lot more obfuscated and some techniques for frustrate reverse engineering analysis, im using ollydbg, remember some obfuscated strings with large algorithm on Statinko malware.
Rob N.2020-02-08 12:10:29 (edited 2020-02-08 12:23:29 )
Again: absolutely incredible work on your side.
How great would it be if Ghidra/Cutter/Hopper could have all those repeated tasks automated or at least suggested, either through a pattern matching or an AI which is feed by all the reverse engineers around the world. Candidates are: The OOAnalyzer, function renaming, multiple sequential char arrays, byte cleanup, no-return hinting, struct imports for pointer constructs in decompilation, etc. I would definitely fund such a project!
Can you recommend any good books you read personally on the subject? I know it's a vast topic and I have a hard time to go deeper than reversing some entry level crackmes and making patches.
You just gained a like, as sub, and a bell notification user. I'm amazed how much you can understand from so few words on each line. Really good work bro :D
Oh yeah there's a chance this guy eventually comes here and reads this and honestly looking at this convoluted shit show I could have just implemented everything in one monolithic executable nicely and without these weird contortions and then obfuscated the crap out of that.
Nah that would be totally impossible, what are the chances, not gonna happen, they're never gonna see it, full stop, forget about it, move on with your life, nothing to see here
Question: So far in Part 1 and Part 2 I don't think we've actually seen any "exploit" right? Just want to make sure I'm following along correctly. It appears its so far just been a bootstrap / setup process so far using Win32 APIs. All of which you'd need administrator privileges to run right?
Heyo, very new to reverse engineering here, though i saw that some things that for example bitcoin adresses are shown while reverse engineering thanks to your video, can any person that's reverse engineering this just change that and then relaunch it? Or do most "hackers" that still use wannacry just launch it without changing anything? But I'm guessing it's not really active anymore and can't be used thanks to the killswitch?
Ofcourse WannaCry still can be used, what’s cheaper, paying some hacker 350 usd in BTC or paying a company that charges you a couple of grand just to undo all the stuff, ofcourse they won’t tell you a killswitch is active
I don't know why this is in my recommendation and didn't understood a single word you said. But I'm sure you're doing a great job at whatever you're doing 👍🏻
i hope you never be interested to write a virus thanks a lot , keep going i enjoy your videos more than netflix <3 i just wrote a printf("hello world"); C app but couldn't decompile it, cause there was lots of codes there XD
Thank you @'Ghidra Ninja' . i do have both. Can you post a blog with complete guide to build OOAnalyzer and import it to ghidra, if you don't mind. Btw i am one of huge fan of your works. Thanks for replying❤
As far as for this convoluted shit show, it would have been better to code the entire thing cleanly into one monolithic executable and then worry about obfuscation. Kind of begs me to make a better wannacry. The only thing I would add is a message box right in the middle of the decryption process. It will read "This is what happens to people who don't back up. Deep down you and I know you deserve this, at least in part".
Im not into coding or something like this so i dont know why this is getting recommended to me but in the start he said that WannaCry try to connect to a URL and if it succeed it does nothing, so if a computer is connected to the internet, why is it unable to connect to this URL?
The URL was not Registered, so if you tried to access it nothing would be returned. It acts as a kill switch because someone can register this URL and make it active to stop the spread
@nakul Were you ever able to get it? If not, now there is no actual ghidra tree in the pharos repo, it is now built into a new tool (sorta big combined tool) called Kaiju which has a bunch of Ghidra stuff including the OOanalyzer CERT tab on the menubar
@m.nageh I was being sarcastic, why are you complaining about free content? Do you feel as if you are entitled to it? I'll turn your argument back on you, why not go with WannaCry? There is nothing wrong with examining "old" malware, in fact, it's probably even more beneficial for people just getting started, 2+ year old malware is not even old. Point is, Ghidra Ninja is providing free, informative, educational content with regards to reverse engineering, your comment is very rude.
@Aidan Collins i was being sarcastic too .... but no problem maybe my comment was a bit rude but i/we would like to see a vid about a this year or the one before malware.
This is a content that surely is not expected to go viral on YT, but is a treat to watch for people with some coding knowledge and curious minds, thanks for creating this!
155 likesReplies (4)
Thanks a lot!
11 likes@stacksmashing welcome, eagerly waiting for next part(s)
2 likesThe first video has 300k+ views, this one have a lot less (about 70% less). It's funny to see how complex subject videos tends to have this pattern. With 3Blue1Brown playlists this happens a lot.
2 likes@Mateus Mercer i think ppl just binge watch first part and very few feel intrigued enough to watch second
2 likesWith this guy's ability it wouldn't surprise me that part 3 ends with the malware creator tied to a chair and asking forgiveness. He's going serious with this. Absolutely awesome.
15 likesJust got the first part recommended. These two videos taught me a lot about how to use Ghidra so keep up the great work.
22 likesI also really like the flow diagrams you're drawing as they give a great overview.
You got a new subscriber and I hope you'll upload more regularly now.
plot twist: he created the virus and now he's just playing with us
377 likesReplies (8)
Plot twist 2: you created the virus, and you are playing with us
11 likes@Asari Patlineto Plot twist 3: you created the virus, and you are playing with us
3 likes@ayaan Plot twist 4: You both created the virus and now you're spamming here
3 likes@Aryan Sharma Plot twist 5: You all created the virus and now you're making me wanna cry with all these confusing comments ba-dum-tss
1 like@Stein plot twist 6 stop playing with virus
1 likePlot twist 7 the guy who made it is in prison
0 likes@MALWARE KAT Plot twist 8, he was employed by a security company to analyze malware and now he's doing the video
0 likes@Mckeane Thomas Plot twist 9 the whole universe itself is a virus
0 likesAwesome! I remember doing same with IdaPRO in terminal. But back in my time the viruses has much simpler code :)Thanks !
19 likesReplies (1)
I dont see very much obfuscation on wannacry lol i remember a keygenme who was a lot more obfuscated and some techniques for frustrate reverse engineering analysis, im using ollydbg, remember some obfuscated strings with large algorithm on Statinko malware.
3 likesLove it! It's amazing how it's possible to turn compiled code back into regular uncompiled code.
1 likeFinally some good reverse engineering videos, I understood everything
3 likesWaiting for part 3 now
So glad you showed your research into this! Thank you for your time figuring out this puzzle. :)
4 likesThank you for creating this series, very helpful in learning to RE and everything is explained clearly.
3 likesPart 3 should be very interesting!
8 likesHell yeah! Been waiting for this since part 1
58 likesI hope you keep putting out content and that you ll find the time to do videos more frequently. Great Video!
1 likeLove your work.Please keep it going
1 likeAgain: absolutely incredible work on your side.
8 likesHow great would it be if Ghidra/Cutter/Hopper could have all those repeated tasks automated or at least suggested, either through a pattern matching or an AI which is feed by all the reverse engineers around the world. Candidates are: The OOAnalyzer, function renaming, multiple sequential char arrays, byte cleanup, no-return hinting, struct imports for pointer constructs in decompilation, etc. I would definitely fund such a project!
Replies (1)
Fund it with your time - it's open source! ;)
1 likeGreat video! Very insightful! Post more like this!
1 likeCan you recommend any good books you read personally on the subject? I know it's a vast topic and I have a hard time to go deeper than reversing some entry level crackmes and making patches.
1 likeYou just gained a like, as sub, and a bell notification user. I'm amazed how much you can understand from so few words on each line. Really good work bro :D
0 likesAfter 2 rewind I'm still half-understood. But man this is really good for sleep when listening at night.
19 likesReplies (1)
😂😂😂🤣🤣😂🤣
0 likesCan't wait for part 3 :)
1 likeImagine to be the creator of WannaCry and watching it
180 likesReplies (18)
maybe it's you
11 likesAlex Rémy maybe it’s you
3 likes@QuickScope1597 maybe it's you
2 likes@Phillip and Alex Maybe it's you
2 likesWould it make him WannaCry?
10 likesMaybe it’s you
0 likes@inc0gnit0 maybe it's you
0 likesI created it
1 likeOh yeah there's a chance this guy eventually comes here and reads this and honestly looking at this convoluted shit show I could have just implemented everything in one monolithic executable nicely and without these weird contortions and then obfuscated the crap out of that.
1 likeNah that would be totally impossible, what are the chances, not gonna happen, they're never gonna see it, full stop, forget about it, move on with your life, nothing to see here
0 likesKind regards,
Totally not the creator of wannacry
you are the impostor!
1 like@Houyhnhnm outstanding!
0 likes@Alessandro Celoria was an epic worm.. crippling the world.. until a teen wanted to play.. but outstanding job! But be careful taking credit..
0 likes@Windows 10 maybe it's you
0 likes@Windows 10 maybe it's you
0 likes@walidhook maybe it's you
0 likes@Adam Gliński maybe it's you
0 likes2021, we still did not know
0 likesThis video is so interesting. I look forward to the next part. All the best
3 likeslooking forward to part III
1 likeYou are insane, keep them coming
2 likesThat's really nice and deep
2 likesLooking forward for more series of videos ..
Can't wait for open source malware!
0 likesWaiting for part 3!
0 likesYou have to admit, the inventor who made wannacry is an intelligent human being
0 likesQuestion: So far in Part 1 and Part 2 I don't think we've actually seen any "exploit" right? Just want to make sure I'm following along correctly. It appears its so far just been a bootstrap / setup process so far using Win32 APIs. All of which you'd need administrator privileges to run right?
0 likesGreat video! Thanks sharing this!
1 likeSuch a nice video. Liked+subscribed, pls continue doing videos
1 likeWaiting for part 3 next week or so
0 likesthank god part 2 came out!!
1 likeLong have we waited! Glad to have you back :)
2 likesGood videos bruh, i hope you keep it up
1 likeVery imformative!! Keep it up!!
0 likesHeyo, very new to reverse engineering here, though i saw that some things that for example bitcoin adresses are shown while reverse engineering thanks to your video, can any person that's reverse engineering this just change that and then relaunch it? Or do most "hackers" that still use wannacry just launch it without changing anything? But I'm guessing it's not really active anymore and can't be used thanks to the killswitch?
0 likesReplies (1)
Ofcourse WannaCry still can be used, what’s cheaper, paying some hacker 350 usd in BTC or paying a company that charges you a couple of grand just to undo all the stuff, ofcourse they won’t tell you a killswitch is active
0 likesAt last, I've been looking forward to this!
1 likeI don't know why this is in my recommendation and didn't understood a single word you said. But I'm sure you're doing a great job at whatever you're doing 👍🏻
5 likesNice work and video!
0 likesBrilliant stuff!
3 likesfinally, that's why i subscribed to your channel
13 likesThanks for these videos
2 likes3:24: installing Pharos for C++ analysis - by using "docker pull seipharos/pharos"
0 likes*One-Winged Angel* starts playing...
top 10 unexpected sequels
196 likesReplies (2)
Am I before or after Matrix 4 in that list? :D
20 likes@stacksmashing Before Half-Life 3. That's for sure )
7 likes0:39 isn't that check redundant since tasksche.exe was run with the /i argument?
0 likesReplies (1)
No because it re-launches itself without the /i argument :)
0 likesfinally , I've been waiting for this.
4 likesPART 3 PLS
0 likesWannaCry dude was not from this planet......... Totally a Legend....!!
0 likesHey man can you tell me the part where actual encryption take place
0 likesYesterday I got attacked by .ghas, from the djvu family and I was wondering if it can also be reverse engineered like that?
0 likesBro this is the best analyses I saw , But please slow down the video little bit so we can follow xD
0 likesi hope you never be interested to write a virus
1 likethanks a lot , keep going i enjoy your videos more than netflix <3
i just wrote a printf("hello world"); C app
but couldn't decompile it, cause there was lots of codes there XD
almost forgot about this series
0 likesGlad you're back!
6 likeswas waiting for this video!!
1 likeWannacry 2.0 is on the way :D
0 likesWhen will be the part.3 !!!
0 likesI want to make a reverse engineering tool like Ghidra or a tool to view the assembly code of a program can someone help?
0 likescool. thanks 👍👍
0 likesWhen Ghidra doesn't work sometimes you should check if you don't have WannaCry installed... (ik bad joke..)
0 likesdude you are so fucking good at this
0 likescontinue please~1
0 likesMaybe you can show how 2 de-compile some djy drone firmware as education purpose or other advanced stuff.It would be interesting to see... :)
0 likesReplies (1)
He'd be sued in no time
1 likeSend this video to normal people to scare them 😁
0 likesvery good！
1 likeThis means that the leaked keys are all equals?
0 likesNice, I had nothing to watch until this popped up. See you in part 1.
0 likesdecompile windows for next project
1 likeThe maker of WannaCry should be wannacry now if they watch this
0 likesMan comeon.... Part threeeeeeeeeeee😢
0 likesHow ? How did you know I want to learn how to analysis malware ? Get off my PC!!
1 likeman this is insane
0 likesGo to the legit one 🖕 PM he's very good on this.
0 likesDude finally!!
16 likes:) This is cool
0 likesIn your future videos, don't jump around as much please, and thank you.
0 likesNSA joined the chat
18 likesFinally!!!
1 likewhat is the main language that Wannacry is written with? is it C or C+ !?
0 likesI hope your next project is going to be nmcrypt.
0 likesFrom your explanation i feel you are the founder of wannacry ,,😂
1 like"tasksche.exe" is short for TaskScheduler so "task A dot ex uh" just sounds wrong. :)
0 likesReplies (2)
He's not saying "task A dot ex uh". He's pronouncing "tasksche" in German, which more or less sounds like "taske".
0 likes@Cristi Neagu Yeah. IOW, "task-aye dot ex uh"
0 likes<3 enjoyed
0 likesWhy we don't create "wannalaugh.exe"?
0 likeshallelujah part 2 finaly
1 likeWhat's in the deep web [dot]onion links from part 1?
0 likesReplies (2)
Will be part of future videos :)
2 likes@stacksmashing Ahhh great!
0 likesGood to know reverse engineering only takes around a year.
0 likesWhat abt those .onion addresses u got in part 1 ??
0 likesCan anyone help me out with installation process of OOAnalyzer please?
0 likesReplies (2)
You will need the JDK and gradle to build it
1 likeThank you @'Ghidra Ninja' . i do have both. Can you post a blog with complete guide to build OOAnalyzer and import it to ghidra, if you don't mind. Btw i am one of huge fan of your works. Thanks for replying❤
0 likesSuper cool
1 likebrain.exe has stopped working
0 likesRenaming simulator 2021
0 likessimple have important data on pc ? get and external HDD ( they are cheap ) backup offline your data and just format pc if you get this crap !!
0 likesFINALLY
1 likeholy cats, i will need a life time to learn assembly, you will be my best friend if you teach me how to find games functions with IDA 😘💓
0 likesholy shit i want to learn it but you are highest level and i dont umderstand anything.
0 likesMac OS X ! Yay !
1 likedo you want to kill wannacry programmers in real life without any weapons ??
1 likejust show them this series
Please increase your bitrates
0 likesReplies (1)
Try increasing the video quality and view it on something other than a projector on a wall across the street.
0 likesBruh makes a follow up video after 10 months and doesnt acknowledge the time gap lol
0 likesReplies (1)
Gotta just roll with it!
0 likesso yeah, part 2 of still not understanding anything
0 likeshelp
you r grt
1 likeAs far as for this convoluted shit show, it would have been better to code the entire thing cleanly into one monolithic executable and then worry about obfuscation. Kind of begs me to make a better wannacry. The only thing I would add is a message box right in the middle of the decryption process. It will read "This is what happens to people who don't back up. Deep down you and I know you deserve this, at least in part".
0 likesYES!
0 likesIm not into coding or something like this so i dont know why this is getting recommended to me but in the start he said that WannaCry try to connect to a URL and if it succeed it does nothing, so if a computer is connected to the internet, why is it unable to connect to this URL?
0 likesReplies (2)
The URL was not Registered, so if you tried to access it nothing would be returned. It acts as a kill switch because someone can register this URL and make it active to stop the spread
0 likes@SBAP Kat Thanks for the response, now it make sense to me.
0 likesWelcome back! :P
0 likesThis vid has 666 likes 0_o
0 likesfuck you have great content
0 likesHow to get that CERT menubar in ghidra?
0 likesReplies (3)
it’s part of the OOAnalayzer plugin
0 likes@stacksmashing I have spent the whole morning installing that plugin using this repo here https://github.com/cmu-sei/pharos/tree/master/tools/ooanalyzer/ghidra/OOAnalyzerPlugin but nothing works :( Btw your videos are life changing. Please continue to make more ghidra reverse engineering videos. Cheers!!
0 likes@nakul Were you ever able to get it? If not, now there is no actual ghidra tree in the pharos repo, it is now built into a new tool (sorta big combined tool) called Kaiju which has a bunch of Ghidra stuff including the OOanalyzer CERT tab on the menubar
0 likesyeaaaa finally
1 likenerding over 9001
0 likesSoup scoop
0 likeswhat's next????
0 likesYou have a nice dialekt, where are u from?
0 likesReplies (2)
Germany!
0 likes@stacksmashing dachte ich es mir doch! Ich hab es rausgehört!🎉
0 likesnever play Dota 2 please!!
1 like10 months LATER
0 likesIt takes almost 1 year!?? damn.
0 likesWhy did it take so long for part 2..
0 likesJust FYI. Ghidra was developed by NSA
0 likesYeah...
0 likesEw you use apple products
0 likeslet's hope this won't get used as a malware tutorial
0 likesReplies (2)
There’s no information here that would really help you you, there are far better resources for doing malicious things.
0 likes@stacksmashing I trust you understand this better than me :)
0 likesCome on mate do it on the newest active malware nowdays
0 likesReplies (5)
I'm certain he's very sorry that you're not satisfied with this free educational content.
2 likes@Aidan Collins yup sure he is ... wanna cry is quite old ... why not go with the new ones ? What would be the problem if he did so ?
0 likes@m.nageh I was being sarcastic, why are you complaining about free content? Do you feel as if you are entitled to it? I'll turn your argument back on you, why not go with WannaCry? There is nothing wrong with examining "old" malware, in fact, it's probably even more beneficial for people just getting started, 2+ year old malware is not even old. Point is, Ghidra Ninja is providing free, informative, educational content with regards to reverse engineering, your comment is very rude.
0 likes@Aidan Collins i was being sarcastic too .... but no problem maybe my comment was a bit rude but i/we would like to see a vid about a this year or the one before malware.
0 likesnothing really changed in new malware
0 likesThis guy uses mac. I wonder if operating system matters...
0 likesReplies (1)
It absolutely doesn't! I've just been using Linux/UNIX based systems for over 10 years, that's why I use a Mac (and Linux in some of the other videos)
1 like