Japan Computer Emergency Response
Team Coordination Center

電子署名者 : Japan Computer Emergency
Response Team Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer
Emergency Response Team Coordination Center,
cn=Japan Computer Emergency Response Team
Coordination Center
日付 : 2015.09.09 15:54:44 +09'00'

Understanding
Malware2015/08/13 Security Camp 2015 10-D

JPCERT/CC Analysis Center
You NAKATSURU

Notice
These training materials are used for "Security Camp2015" in Japan— Security training program for students to discover &nurture young talent— https://www.ipa.go.jp/jinzai/camp/ (Japanese only)

The training course consists of the following 2 parts— Malware, Malware analysis basics, Static analysis basics
Learning basic knowledge for malware analysis— Malware analysis
Understanding details of malware samples using static
analysis method

The training mainly focuses on 32bit Windows malware
Some slides have display problems due to animation
Any questions and comments are welcome— Please contact us at aa-info@jpcert.or.jp

1

Copyright©2015 JPCERT/CC All rights reserved.

AgendaMalware Basics
Malware Analysis Basics
Static Analysis Basics

2

Copyright©2015 JPCERT/CC All rights reserved.

Objectives of This Session
Understanding malware• What malware is• What malware does
• Malware trends• Typical prevention/response methods
Understanding malware analysis• What malware analysis is• Malware analysis methods• Static analysis techniques
3

Copyright©2015 JPCERT/CC All rights reserved.

Malware Basics

Definition

Malicious Software
Broader in concept than a computer virus—Virus, Worm, Trojan Horse, Rootkit, Bot, DoS Tool,
Exploit kit, Spyware

5

Copyright©2015 JPCERT/CC All rights reserved.

Malware Purpose
Mischief• Crashing a system• DoS

For Profit• Havoc via DDoS
• Sending Spam• Visiting affiliate sites

Others• Stalking• Self-assertion
6

Copyright©2015 JPCERT/CC All rights reserved.

For Profit
Selling• Sensitive information• Malware, malware builder

Sending spam emails• Rental business

DDoS• Blackmail

Affiliate• Let user access to the site using malware
7

Copyright©2015 JPCERT/CC All rights reserved.

Growth of Malware

Mischief,
Concept code

Virus
8

Worm,
Trojan,Backdoor

Copyright©2015 JPCERT/CC All rights reserved.

Bot
For Profit(underground)Infection Method
Software• Attack software vulnerabilities• OS, Office, Browser• Make machines to execute malware

Human• Trick users to execute malware• provide a line about software
contents• camouflage an "icon"
9

Copyright©2015 JPCERT/CC All rights reserved.

Exploiting Software Vulnerability

AttackVulnerability• Buffer overflow,etc.
• Take control
and execute
arbitrary code10

Copyright©2015 JPCERT/CC All rights reserved.

Executearbitrarycode• Shellcode formalwareexecution• Malware

Malware Attack Vector
Vulnerability, Social engineering

Network

11

Copyright©2015 JPCERT/CC All rights reserved.

DownloadMalware Behavior
Can do anything on the infected machine—Within the limits of infected user's privilege

RegistryLAN
File

Process/Service

12

Copyright©2015 JPCERT/CC All rights reserved.

Internet

Malware Behavior: Installation
Create main module• download, creation

Copy / Delete itself• copy to the system folder

Run after reboot• registry entry related to Autorun• Startup folder• register as a service
13

Copyright©2015 JPCERT/CC All rights reserved.

Malware Behavior: Modifying System

Disable security features• Windows Firewall• Windows Update

Avoid security programs• Anti-Virus software• Analysis tool

Hide itself• modifying other processes
14

Copyright©2015 JPCERT/CC All rights reserved.

Malware Behavior: Main Behavior
Steal information• read registry entries / config files• key logging, packet capture

Bot• connect to C&C servers• execute commands

Spread• attack other machines
15

Copyright©2015 JPCERT/CC All rights reserved.

Important Points
Network activity is important• Attackers need to take out information for
profit• Able to recognize damage by analyzing packets

Do not trust infected machines• Possibility of data falsification• Such as anti-virus software results on infected
machines• Recommended to re-install Windows• Preventing malware infection is the mostimportant
16

Copyright©2015 JPCERT/CC All rights reserved.

MALWARE EXAMPLE

17

Copyright©2015 JPCERT/CC All rights reserved.

Targeted Attack

Looks likenormalExcel fileFrom©○○
Subject: Personnel
reshuffle
There was a personnel
reshuffle.
See the attachment file

Exploits
vulnerability
in Excel

18

Copyright©2015 JPCERT/CC All rights reserved.

RAT
Remote Administration Tool/Trojan—Often used for targeted attack

19

Copyright©2015 JPCERT/CC All rights reserved.

Banking Trojan
Attempts to steal users credential of the Internet
banking—Inject additional input form on the web page

Internet
Banking

Controller
20

Copyright©2015 JPCERT/CC All rights reserved.

Web-based Attack
Attacking web browsers or add -ons

1. Inject malicious JavaScript
into web contents
2. Redirects to an attacksite in background

3. Attacks
vulnerabilities

4. Information theft
21

Copyright©2015 JPCERT/CC All rights reserved.

Ransomware"All your important files are encrypted!"
Encryption key,
URL to lead（Tor）

Intimidation
message

Delete after
encryption

22

Copyright©2015 JPCERT/CC All rights reserved.

Android Malware
Re-package popular legitimate apps
—Distributed through3rd party market
Android Market

Steal contact information
in background23

Copyright©2015 JPCERT/CC All rights reserved.

MALWARE TRENDS
IN JAPAN
24

Copyright©2015 JPCERT/CC All rights reserved.

Banking Trojan
ZeuS, Citadel, Gameover were overVawtrak

Dyre

Tsukuba

Tinba

DridexChthonic

KINS
25

Copyright©2015 JPCERT/CC All rights reserved.

Ransomware
Spread through Drive-by-Download attack
https://isc.sans.edu/forums/diary/Angler+exploit+kit+pushes+new+variant+of+ransomware/19681

26

Copyright©2015 JPCERT/CC All rights reserved.

Targeted Attack: Watering Hole Attack
A case of compromised site for a media player
updateIP address check
Update Server

PlayerAnothersite

Automatically install malware
27

Copyright©2015 JPCERT/CC All rights reserved.

CloudyOmega/Blue Termite
Attack infrastructure (affected sites, affected VPS servers)

Victim (government related organizations, private companies)

Targeted email
28

Copyright©2015 JPCERT/CC All rights reserved.

Mass email

ANTI-MALWARE

29

Copyright©2015 JPCERT/CC All rights reserved.

Typical Malware Prevention

Fix vulnerabilities• Update OS & software• Configure security options for OS &softwareUse anti-virus software• Possibly false results

Do not open a file without confirming• Beware of social engineering
30

Copyright©2015 JPCERT/CC All rights reserved.

Typical Response
Disconnect network connection first• To stop information leakage & attack
to outside

Re-install OS• Basically malware can do anything on
infected machines

Recurrence prevention• Identify & fix up the cause of infection
31

Copyright©2015 JPCERT/CC All rights reserved.

Worldwide Activity

Botnet takedown• Microsoft, FBI, anti-virus vendors, etc.
• Major activities• Rustock takedown• ZeroAccess takedown• Citadel takedown

Convention on Cybercrime• Drawn up by the Council of Europe• Convention for co-investigation of cybercriminals
32

Copyright©2015 JPCERT/CC All rights reserved.

Malware Analysis
BasicsWho Analyzes Malware?

CSIRTsSecurity product developers
Security service providers
Anti-malware researchers
Software developers
Law enforcement
34

Copyright©2015 JPCERT/CC All rights reserved.

Why Analyze Malware?

Incident response
Product development/improvement
Signature creation
Cutting-edge countermeasure
Vulnerability analysis
Criminal arrest
35

Copyright©2015 JPCERT/CC All rights reserved.

Malware Analysis Method

Environment Setup
Malware collection
Surface analysis
Runtime analysis
Static analysis
36

Copyright©2015 JPCERT/CC All rights reserved.

IMPORTANT POINT

37

Copyright©2015 JPCERT/CC All rights reserved.

Security is a Key for SuccessAnalyze malware with great care
• If you make a mistake, it may bring serious
consequences
Develop environment with great care
• Pay great attention to environment for malware
download and analysis

Publish results with great care
• Take great care in publishing details of malware• e.g. 0-day vulnerability
38

Copyright©2015 JPCERT/CC All rights reserved.

Sample Analysis Environment
Download Environment

Linux

Change file extension

Real time filtering
Dedicated network

Writeprotected

39

Copyright©2015 JPCERT/CC All rights reserved.

Analysis Environment
Be able torestore toa cleansystemSURFACE ANALYSIS

40

Copyright©2015 JPCERT/CC All rights reserved.

Surface Analysis
Retrieve surface information from targets without
execution

TargetHash value

VirusTotal

41

File type

Analyst's
blog

Copyright©2015 JPCERT/CC All rights reserved.

Strings

Anti-virus
softwareresults

Tool
information

Vender's
databaseRuntime Analysis
Execute malware and monitor its behavior—Difficult to reveal "all" of malware’s behavior

Manual Analysis• Use monitoring tools on analysis
environment• Sysinternals suite, etc.
Automation• Use sandbox system• Free / Commercial products• Can reduce analysis time
42

Copyright©2015 JPCERT/CC All rights reserved.

Runtime Analysis Environment
Dedicated and isolated network/system—Native or Virtual (VMware, etc.)

The Internet

DNS
HTTP
HTTPS
FTP
IRC
SMTP
POP3
Fake server etc.
netcatInternal
Network
Analysis Machine
43

Copyright©2015 JPCERT/CC All rights reserved.

Fake LAN

What Static Analysis is
Reading code in binary file and understanding its
functionality—Takes a long time
—Requires deep and broad knowledge

44

Copyright©2015 JPCERT/CC All rights reserved.

ANALYSIS PROCESS

45

Copyright©2015 JPCERT/CC All rights reserved.

Analysis Process Comparison
Surfaceanalysis

Staticanalysis

Retrieve surface
information from
Overview targets without
execution

Executesamples andmonitor its
behavior

Read codes inbinary files andunderstand its
functionality-

Activity of- File system- Registry- Process- Network

Malware’sfunctionalitye.g.
- Bot commands- Encode/decode
methods

Output46

Runtimeanalysis

Hash values
Strings
File attributes
Packer info
Anti-virus
detection info

Security
risk

Low

High

Moderate

Analysiscoverage

Low

ModerateHigh

Copyright©2015 JPCERT/CC All rights reserved.

Malware Analysis Flow
Start

Surfaceanalysis

RuntimeanalysisNoNoenough?
Yesenough?

Staticanalysis

Yes

Summarize
ResultEnd
47

Copyright©2015 JPCERT/CC All rights reserved.

Static Analysis
BasicsImportant Points
No need to know all of malware• You need much time for static analysis
Need much knowledge/experiences• Need• OS knowledge• Assembly basics• Efficient reading techniques• Anti-analysis techniques• We have to continue studying

49

Copyright©2015 JPCERT/CC All rights reserved.

Disassemble & Decompile
Binary -> source code

Disassemble

Decompile

50

Copyright©2015 JPCERT/CC All rights reserved.

Debugging
Read assembly code while executing step by step51

Copyright©2015 JPCERT/CC All rights reserved.

Static Analysis Flow
Analyze unpacked target

Start

1. ManualUnpacking
Packed?

Can
decompile?

Yes

Yes

3.
Disassemble,
Debugging

2. Decompile

ResultEnd
52

Copyright©2015 JPCERT/CC All rights reserved.

Static Analysis Tools
Category

Name

Disassembler

IDA

Decompiler

Hex-rays
Decompiler
VB
Decompiler.NET
Reflector
OllyDbg

Debugger53

Immunity
Debugger

Copyright©2015 JPCERT/CC All rights reserved.

Description

Disassembles more than
50 architectures
x86/ARM binary to C
source code
Visual Basic binary to
Visual Basic source code
.NET binary to .NET
source code
World famous x86
debugger
Python familiar x86
debuggerStatic Analysis Basics
Analyze unpacked target

Start

1. Manual
unpacking
Packed?

Yes

Focused on
Yes
Can"Dissassemble"
decompile?
only
3.
Disassemble,
Debugging

2. Decompile

ResultEnd
54

Copyright©2015 JPCERT/CC All rights reserved.

Interactive DisAssembler
http://www.hex-rays.com/idapro/—3 versions are available

VersionCost

Features

55

Free

Starter

Pro

Ver. 5.0
Ver. 6.8 demo

Ver. 6.8

Ver. 6.8

Free• 589USD/User• 1129USD/User• 879USD/Comp • 1689USD/Comp
uter
uter

• Old or limited• Supports up to
50 processes• Supports up to• Can analyse
20 processes
files for 64 bit
platforms

Copyright©2015 JPCERT/CC All rights reserved.

ASSEMBLY BASICS

56

Copyright©2015 JPCERT/CC All rights reserved.

Components of Computer System
CPU
Control
Unit

I/O

Arithmetic
Logic Unit

Input
Device(Keyboard...)OutputDevice(Display...)57

Copyright©2015 JPCERT/CC All rights reserved.

Memory Unit
Main
Memory(DRAM...)

Storage(HDD...)

CPU Operation
Fetch & Decode
CPU

Memory0x00000000

read CPU instruction from
Memory

・・・・
90
90
55
8B EC

Control
Unit

81 EC 14 01 01 00 00
FF 15 28 70 40 00
68 05 01 00 00

ALU

6A 00
68 88 B7 40 00

Registers

E8 29 0B 00 00

Accumulator

Counter Execute

Stack PointerFlags

83 C4 0C

execute CPU instruction
using Registers

Program Counter0xFFFFFFFF
Copyright©2015 JPCERT/CC All rights reserved.

6A 00
8D 85 F0 FE FF FF
50

next instruction address

58

68 05 01 00 00

E8 13 0B 00 00
83 C4 0C
・・・・

Compiling Source Codeint main(){
int a,b,c;
a = 1;
b = 2;
c = a + b;

Binary file includes
CPU instructions(Machine Code)printf("Answer is %d¥n", c);}return 0;

Execute CPU
instructions
59

Copyright©2015 JPCERT/CC All rights reserved.

Executable fileDisassemble
Machine code to assembly code (human readable)

60

Copyright©2015 JPCERT/CC All rights reserved.

Format of Assembly Code

OpCode

61

push
mov
sub
mov
mov
mov
add
mov
mov
push
push
call
add
xor
mov
pop
retn

Copyright©2015 JPCERT/CC All rights reserved.

ebp
ebp, esp
esp, 0Ch[ebp-4], 1[ebp-8], 2Operandeax, [ebp-4]
eax, [ebp-8](arguments)[ebp-0Ch], eax
ecx, [ebp-0Ch]
ecx
0040C000h
00401034h
esp, 8eax, eax
esp, ebp
ebp

Register
Memory inside CPU—Can use them as variables for calculations—Address that indicates next instruction (Program
Counter)—Pointers related stack

62

Register name

Description

EAX, EBX, EDX

General purpose register

ECX

General purpose register especially used
for counter

ESI, EDI

General purpose register especially used
for "source" and "destination"

EIP (Instruction Pointer)

Address that indicates next instruction

ESP (Stack Pointer)

Current stack address

EBP (Base Pointer)

Bottom of stack for current function

Copyright©2015 JPCERT/CC All rights reserved.

Register Size
Several registers' names are changed according
to the data size
—EAX, EBX, ECX…

EAX (32bit)
AX (lower16bit)
AH (higher 8bit) AL (lower 8bit)“mov eax, 0” ≠ “mov ax, 0”63

Copyright©2015 JPCERT/CC All rights reserved.

Major Instructions
Assignment

Calculation

Jump

64

mov

Copy value

lea

Load address

add & sub+/-and & or & xor & not

Logical operation

inc & dec++1 / --1

jmp

Jump to specified address

jz, jnz, ja, …

For branch on condition

call

Call subroutine (function)

Copyright©2015 JPCERT/CC All rights reserved.

StackStore temporary values to "stack" on memory—Due to the limits of registers

Stack management—Use PUSH/POP—Stack related addresses are stored in EBP & ESP
00000000

ESP

PUSH
PUSH
POP
PUSH
POP
PUSH
POP
POP

1
2
EAX
3
EBX
4
ECX
EDX

ESP
ESP
ESP
ESP
EBP

00000004
00000003
00000002
00000001

FFFFFFFF
65

Copyright©2015 JPCERT/CC All rights reserved.

Function Call using Stackcall = push + jmp
retn = pop + jmp
main
:
push
push
call
mov
:
foo
push
mov
xor
:
mov
pop
retn

00000000

foo func's
variables
440100h ;arg1
440000h ;arg2
foo[ebp+result],eax

Old EBP
Return Addr
00440000

ebp
ebp, esp
eax, eax
esp, ebp
ebp
10h

ESP

00440100main func's
variables

EBP
FFFFFFFF

66

Copyright©2015 JPCERT/CC All rights reserved.

Local Variables
Local variables are allocated on stack—Normally referred using offset from ebp
void func(){char Name[] = “abcdefg”;
int i;
:
}
i
4Byte
Name
8Byte
EBP
67

Copyright©2015 JPCERT/CC All rights reserved.

ebp - ochebp - 8Branch on Conditions
Basic flow
Comparison operation

Jump on condition

1. Comparison operation—cmp a b"sub a b" and discard result—test a b"and a b" and discard result test

2. Jump on condition
—jz
—jnb
—ja
—etc.
68

Char

Description

n

not

z/e

zero/equal

Previous result is 0 (Both values are same)

a

above

Operand 1 is higher than operand 2

b

below

Operand 1 is smaller than operand 2

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 1. Static Analysis Basici.

69

Analyze the following function and explain what
it does

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 1. Answer
i.

Analyze the following function and explain what
it doesarg_0 + arg_4

70

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 1. Static Analysis Basicii. Find “branch on condition” and explain eachcondition and corresponding result

sub_401000 is"add_value" function

71

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 1. Answer
ii. Find “branch on condition” and explain eachcondition and corresponding result

stored result of"add_value" func

result is 0 or not?

72

Copyright©2015 JPCERT/CC All rights reserved.

Deep Understanding x86
IA-32 Architectures Software Developer Manuals— http://www.intel.com/content/www/us/en/processors/architect
ures-software-developer-manuals.html

73

Copyright©2015 JPCERT/CC All rights reserved.

EFFICIENT CODEANALYSIS
74

Copyright©2015 JPCERT/CC All rights reserved.

Understanding Source CodeIn which order should be read the following
source code?
int send_data(){
HANDLE hInternet, hConnect, hRequest;
hInternet = InternetOpen(NULL, INTERNET_OPEN_TYPE_PRECONFIG,
NULL, NULL, 0);if(hInternet == NULL)
return 1;
hConnect = InternetConnect(hInternet, SERVER_NAME,
INTERNET_DEFAULT_HTTP_PORT,…
if(hConnect == NULL){InternetCloseHandle(hInternet);
return 2;}
hRequest = HttpOpenRequest(hConnect, __T("GET"), NULL, NULL, …

75

Copyright©2015 JPCERT/CC All rights reserved.

Reading Steps
1. Check Windows API
2. Check arguments
3. Check brunch on condition76

Copyright©2015 JPCERT/CC All rights reserved.

Learning Windows API
Use MSDN Library— http://msdn.microsoft.com/library

Cost

OnlineOfflineFree

MSDN Subscription
needed to download• Always up to date
• Need Internet
connection• Can download
Featuresnecessary sections foroffline use• Depends onconnection speed
77

Copyright©2015 JPCERT/CC All rights reserved.

• Can be used in offline
environment• FastReading Arguments
Assembly code
push
mov
push
mov
push
call

0
;bFailIfExists
eax,[ebp+C]
eax;lpNewFileName
ecx,[ebp+8]
ecx;lpExistingFileName
ds:CopyFileA

C++ syntax from MSDN Library
BOOL CopyFile(
LPCTSTR lpExistingFileName,
LPCTSTR lpNewFileName,
BOOL bFailIfExists);

Return value is stored in EAX
78

Copyright©2015 JPCERT/CC All rights reserved.

Reverseorder

Exercise 2. Efficient Code Analysis
Read the following function efficiently and guess
what it does

ersion¥¥Run

79

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 2. Answer
Read the following function efficiently and guess
what it does
Target entry is "Run" keyersion¥¥Run

Register itself to be executed
automatically after rebooting
Write value inregistry entry

80

Copyright©2015 JPCERT/CC All rights reserved.

USING IDA

81

Copyright©2015 JPCERT/CC All rights reserved.

(recap) Interactive DisAssembler
http://www.hex-rays.com/idapro/—3 versions are available

VersionCost

Features

82

Free

Starter

Pro

Ver. 5.0
Ver. 6.5 demo

Ver. 6.5

Ver. 6.5

Free• 539USD/User• 1059USD/User• 819USD/Comp • 1589USD/Comp
uter
uter

• Old or limited• Supports up to
50 processes• Supports up to• Can analyze
20 processes
files for 64 bit
platforms

Copyright©2015 JPCERT/CC All rights reserved.

You Have to Talk with

Madame deMaintenon(see Wikipedia)
83

Copyright©2015 JPCERT/CC All rights reserved.

Important Points for IDA
1. Make it right• Instruction or data?
• Malicious function or library function?

2. Use as a high functionality notepad• Name analyzed function / variables• Write your comments• Put function type-declaration• Change display format for easier reading• Hex / binary / ASCII / offset
84

Copyright©2015 JPCERT/CC All rights reserved.

Main Windows (IDA view)
Graph view / Text view

85

Copyright©2015 JPCERT/CC All rights reserved.

Main Windows (IDA view)
Reading Code
Name
XREF

Calling API

Comments

86

Copyright©2015 JPCERT/CC All rights reserved.

Strings Window
Like BinText

87

Copyright©2015 JPCERT/CC All rights reserved.

Functions Window
A list of functions

88

Copyright©2015 JPCERT/CC All rights reserved.

Imports Windows
A list of APIs required by the target

89

Copyright©2015 JPCERT/CC All rights reserved.

Hex View Window
Imports (list of APIs required by the target)

90

Copyright©2015 JPCERT/CC All rights reserved.

Recommended Configuration
IDA config files you can edit
—C:¥Program Files (x86)¥IDA Free¥cfg¥

You can create user settings file—idauser.cfg, idauserg.cfg
Config Fileida.cfg /idauser.cfg

idagui.cfg /idauserg.cfg
91

Recommended Value

Name

Meaning

OPCODE_BYTES

Display binary data

8

SHOW_SP

Display stack pointerYES

SHOW_XREFS

Display cross references

8

DISPLAY_PATCH_SUBMENU

Display patch submenu

YES

Copyright©2015 JPCERT/CC All rights reserved.

Basic Instruction
Move
Key assign

Description

G

Jump to address

Esc

Back

Changing data type
U
C
D
P
A
*
92

Change selection to "Unknown"
Change selection to "Code"Change selection to "Data"• Byte, Word, Double Word
Change selection to "Function"
Change selection to "ASCII string"
Change selection to "Array"

Copyright©2015 JPCERT/CC All rights reserved.

Basic Instruction
Note
Key assign

Description

N

Name function/variables/etc.

:

Insert comment;

Insert repeatable commentY

Put type-declaration•

void __cdecl Func(int num1, int num2);

Display format
H

Decimal <-> Hexadecimal

R

ASCII <-> Hexadecimal

Right-click->
Symbolic
constant
93

Symbolic constant <-> Hexadecimal•••

ERROR_ALREADY_EXISTSACCESS_ALL
KEY_WRITE

Copyright©2015 JPCERT/CC All rights reserved.

Basic Analysis Process in IDA

Understandmeaning
Rename &Comment
Read
instructions

94

Copyright©2015 JPCERT/CC All rights reserved.

• Variables• Functions• Data• etc.

Example of Renaming
Exercise 1

95

Copyright©2015 JPCERT/CC All rights reserved.

Example of Analysis
Analyzed IDB sample

96

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 3. Using IDAi.

Analyze the following functions in"static_sample3.idb" and rename
functions/variables or insert your comments—sub_4012DD—sub_401303—sub_401357

97

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 3. Answer
i.

Analyze the following functions in"static_sample3.idb" and rename
functions/variables or insert your comments—sub_4012DD—sub_401303—sub_401357—See static_sample3_ans.idb

98

Copyright©2015 JPCERT/CC All rights reserved.

FYI: IDC Scripting
If you want to change background color on "jmp"& "call" instructions

Light blue99

Copyright©2015 JPCERT/CC All rights reserved.

Questions?