This is a content that surely is not expected to go viral on YT, but is a treat to watch for people with some coding knowledge and curious minds, thanks for creating this!

@Mateus Mercer i think ppl just binge watch first part and very few feel intrigued enough to watch second

The first video has 300k+ views, this one have a lot less (about 70% less). It's funny to see how complex subject videos tends to have this pattern. With 3Blue1Brown playlists this happens a lot.

@stacksmashing welcome, eagerly waiting for next part(s)


With this guy's ability it wouldn't surprise me that part 3 ends with the malware creator tied to a chair and asking forgiveness. He's going serious with this. Absolutely awesome.


Just got the first part recommended. These two videos taught me a lot about how to use Ghidra so keep up the great work.
I also really like the flow diagrams you're drawing as they give a great overview.
You got a new subscriber and I hope you'll upload more regularly now.


plot twist: he created the virus and now he's just playing with us

@Mckeane Thomas Plot twist 9 the whole universe itself is a virus

@MALWARE KAT Plot twist 8, he was employed by a security company to analyze malware and now he's doing the video

Plot twist 7 the guy who made it is in prison

@Stein plot twist 6 stop playing with virus

@Aryan Sharma Plot twist 5: You all created the virus and now you're making me wanna cry with all these confusing comments <b>ba-dum-tss</b>

@Aryan Sharma Plot twist 5: You all created the virus and now you're making me wanna cry with all these confusing comments *ba-dum-tss*

@ayaan Plot twist 4: You both created the virus and now you're spamming here

@Asari Patlineto Plot twist 3: you created the virus, and you are playing with us

Plot twist 2: you created the virus, and you are playing with us


Awesome! I remember doing same with IdaPRO in terminal. But back in my time the viruses has much simpler code :)Thanks !

I dont see very much obfuscation on wannacry lol i remember a keygenme who was a lot more obfuscated and some techniques for frustrate reverse engineering analysis, im using ollydbg, remember some obfuscated strings with large algorithm on Statinko malware.


Love it! It's amazing how it's possible to turn compiled code back into regular uncompiled code.


Finally some good reverse engineering videos, I understood everything

Waiting for part 3 now


So glad you showed your research into this! Thank you for your time figuring out this puzzle. :)


Thank you for creating this series, very helpful in learning to RE and everything is explained clearly.


Hell yeah! Been waiting for this since part 1


I hope you  keep putting out content and that you ll find the time to do videos more frequently. Great Video!


Again: absolutely incredible work on your side.

How great would it be if Ghidra/Cutter/Hopper could have all those repeated tasks automated or at least suggested, either through a pattern matching or an AI which is feed by all the reverse engineers around the world. Candidates are: The OOAnalyzer, function renaming, multiple sequential char arrays, byte cleanup, no-return hinting, struct imports for pointer constructs in decompilation, etc. I would definitely fund such a project!

Fund it with your time - it's open source! ;)


Great video! Very insightful! Post more like this!


Can you recommend any good books you read personally on the subject? I know it's a vast topic and I have a hard time to go deeper than reversing some entry level crackmes and making patches.


You just gained a like, as sub, and a bell notification user. I'm amazed how much you can understand from so few words on each line. Really good work bro :D


After 2 rewind I'm still half-understood. But man this is really good for sleep when listening at night.


Imagine to be the creator of WannaCry and watching it

@Alessandro Celoria was an epic worm.. crippling the world.. until a teen wanted to play.. but outstanding job! But be careful taking credit..

Nah that would be totally impossible, what are the chances, not gonna happen, they're never gonna see it, full stop, forget about it, move on with your life, nothing to see here

Kind regards,
Totally not the creator of wannacry

Oh yeah there's a chance this guy eventually comes here and reads this and honestly looking at this convoluted shit show I could have just implemented everything in one monolithic executable nicely and without these weird contortions and then obfuscated the crap out of that.


This video is so interesting. I look forward to the next part. All the best


That's really nice and deep <br>Looking forward for more series of videos ..

That's really nice and deep
Looking forward for more series of videos ..


You have to admit, the inventor who made wannacry is an intelligent human being


Question:  So far in Part 1 and Part  2 I don't think we've actually seen any "exploit" right?  Just want to make sure I'm following along correctly.  It appears its so far just been a bootstrap / setup process so far using Win32 APIs.  All of which you'd need administrator privileges to run right?


Such a nice video. Liked+subscribed, pls continue doing videos


Long have we waited! Glad to have you back :)


Heyo, very new to reverse engineering here, though i saw that some things that for example bitcoin adresses are shown while reverse engineering thanks to your video, can any person that's reverse engineering this just change that and then relaunch it? Or do most "hackers" that still use wannacry just launch it without changing anything? But I'm guessing it's not really active anymore and can't be used thanks to the killswitch?

Ofcourse WannaCry still can be used, what’s cheaper, paying some hacker 350 usd in BTC or paying a company that charges you a couple of grand just to undo all the stuff, ofcourse they won’t tell you a killswitch is active


At last, I've been looking forward to this!


I don't know why this is in my recommendation and didn't understood a single word you said. But I'm sure you're doing a great job at whatever you're doing 👍🏻


finally, that's why i subscribed to your channel


3:24: installing Pharos for C++ analysis - by using "docker pull seipharos/pharos"

*One-Winged Angel* starts playing...

3:24: installing Pharos for C++ analysis - by using "docker pull seipharos/pharos"

**One-Winged Angel** starts playing...


@stacksmashing Before Half-Life 3. That's for sure )

Am I before or after Matrix 4 in that list? :D


0:39 isn't that check redundant since tasksche.exe was run with the /i argument?

No because it re-launches itself without the /i argument :)


WannaCry dude was not from this planet......... Totally a Legend....!!


Hey man can you tell me the part where actual encryption take place


Yesterday I got attacked by .ghas, from the djvu family and I was wondering if it can also be reverse engineered like that?


Bro this is the best analyses I saw , But please slow down the video little bit so we can follow xD


i hope you never be interested to write a virus
thanks a lot , keep going  i enjoy your videos more than netflix <3
i just wrote a printf("hello world"); C app
but  couldn't decompile it, cause there was lots of codes there XD


I want to make a reverse engineering tool like Ghidra or a tool to view the assembly code of a program can someone help?


When Ghidra doesn't work sometimes you should check if you don't have WannaCry installed... (ik bad joke..)


Maybe you can show how 2 de-compile some djy drone firmware as education purpose or other advanced stuff.It would be interesting to see... :)


Send this video to normal people to scare them 😁


This means that the leaked keys are all equals?


Nice, I had nothing to watch until this popped up. See you in part 1.


The maker of WannaCry should be wannacry now if they watch this


How ? How did you know I want to learn how to analysis malware ? Get off my PC!!


Go to the legit one 🖕 PM he's very good on this.


In your future videos, don't jump around as much please, and thank you.


what is the main language that Wannacry is written with?  is it C or C+ !?


I hope your next project is going to be nmcrypt.


From your explanation i feel you are the founder of wannacry ,,😂


"tasksche.exe" is short for TaskScheduler so "task A dot ex uh" just sounds wrong. :)

@Cristi Neagu Yeah. IOW, "task-aye dot ex uh"

He's not saying "task A dot ex uh". He's pronouncing "tasksche" in German, which more or less sounds like "taske".


What's in the deep web [dot]onion links from part 1?


Good to know reverse engineering only takes around a year.


What abt those .onion addresses u got in part 1 ??


Can anyone help me out with installation process of  OOAnalyzer please?

Thank you @'Ghidra Ninja' . i do have both. Can you post a blog with complete guide to build OOAnalyzer and import it to ghidra,  if you don't mind. Btw i am one of huge fan of your works. Thanks for replying❤

You will need the JDK and gradle to build it


simple have important data on pc ? get and external HDD ( they are cheap ) backup offline your data and just format pc if you get this crap !!


holy cats, i will need a life time to learn assembly, you will be my best friend if you teach me how to find games functions with IDA  😘💓


holy shit i want to learn it but you are highest level and i dont umderstand anything.


do you want to kill wannacry programmers in real life without any weapons ?? <br>just show them this series

do you want to kill wannacry programmers in real life without any weapons ??
just show them this series


Try increasing the video quality and view it on something other than a projector on a wall across the street.


Bruh makes a follow up video after 10 months and doesnt acknowledge the time gap lol


so yeah, part 2 of still not understanding anything <br>help

so yeah, part 2 of still not understanding anything
help


As far as for this convoluted shit show, it would have been better to code the entire thing cleanly into one monolithic executable and then worry about obfuscation. Kind of begs me to make a better wannacry. The only thing I would add is a message box right in the middle of the decryption process. It will read "This is what happens to people who don't back up. Deep down you and I know you deserve this, at least in part".


Im not into coding or something like this so i dont know why this is getting recommended to me but in the start he said that WannaCry try to connect to a URL and if it succeed it does nothing, so if a computer is connected to the internet, why is it unable to connect to this URL?

@SBAP Kat Thanks for the response, now it make sense to me.

The URL was not Registered, so if you tried to access it nothing would be returned. It acts as a kill switch because someone can register this URL and make it active to stop the spread


@nakul Were you ever able to get it? If not, now there is no actual ghidra tree in the pharos repo, it is now built into a new tool (sorta big combined tool) called Kaiju which has a bunch of Ghidra stuff including the OOanalyzer CERT tab on the menubar

@stacksmashing I have spent the whole morning installing that plugin using this repo here https://github.com/cmu-sei/pharos/tree/master/tools/ooanalyzer/ghidra/OOAnalyzerPlugin but nothing works :( Btw your videos are life changing. Please continue to make more ghidra reverse engineering videos. Cheers!!


You have a nice dialekt, where are u from?

@stacksmashing dachte ich es mir doch! Ich hab es rausgehört!🎉


let's hope this won't get used as a malware tutorial

@stacksmashing I trust you understand this better than me :)

There’s no information here that would really help you you, there are far better resources for doing malicious things.


Come on mate do it on the newest active malware nowdays

@Aidan Collins i was being sarcastic too .... but no problem maybe my comment was a bit rude but i/we would like to see a vid about a this year or the one before malware.

@m.nageh I was being sarcastic, why are you complaining about free content? Do you feel as if you are entitled to it? I'll turn your argument back on you, why not go with WannaCry? There is nothing wrong with examining "old" malware, in fact, it's probably even more beneficial for people just getting started, 2+ year old malware is not even old. Point is, Ghidra Ninja is providing free, informative, educational content with regards to reverse engineering, your comment is very rude.

@Aidan Collins yup sure he is ... wanna cry is quite old ... why not go with the new ones ? What would be the problem if he did so ?

I'm certain he's very sorry that you're not satisfied with this free educational content.


This guy uses mac. I wonder if operating system matters...

It absolutely doesn't! I've just been using Linux/UNIX based systems for over 10 years, that's why I use a Mac (and Linux in some of the other videos)