+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: [Tutorial] View Binary Data of Simple Programs - Get Free Stuff [Tutorial] (/showthread.php?tid=2210001)
[Tutorial] View Binary Data of Simple Programs - Get Free Stuff [Tutorial] - Example - Feb 13, 2012
I didn't see a thread in this section regarding the viewing of binary data of simple programs that try to take your information. This includes keyloggers, SMTP mailers, and others.
I am not responsible if you use this for bad boy things.
This tutorial will simply explain how you can easily just right-click a simple logging/stealing program - and potentially obtain the creator's identity and stealer/logger info.
NOTE: This is for the most simplest of programs that are not crypted.
NOTE2: Always be safe when downloading infected programs. Run in a virtual environment for maximum safety.
NOTE3: You will also need some type of program to view the construct of programs. Like HEX Workshop or something.
-------------------------------------
STEP 1:
Find a nice fake program. I hypothetically personally prefer the "Free Microsoft Point Generator" programs.
You can find a huge amount of fake software on Youtube.
Most of the time, the video will have the download to the program in the video description.
Spoiler (Click to View)
STEP 2:
Download the program.
Spoiler (Click to View)
STEP 3:
Open up said fake program with your binary data viewer/hex editor.
STEP 4:
Scroll through data until you find something juicy. Good data will be in the middle or bottom- sometimes.
Here we find that the original creator of this was on a user account named, "Jamie."
Spoiler (Click to View)
You can also find the telltale signs of the compiler they used and such.
Oh look! That info that I typed in is being sent to his email! Oh look! There's his email and password!
Spoiler (Click to View)
Find a nice fake program. I hypothetically personally prefer the "Free Microsoft Point Generator" programs.
You can find a huge amount of fake software on Youtube.
Most of the time, the video will have the download to the program in the video description.
Spoiler (Click to View)
STEP 2:
Download the program.
Spoiler (Click to View)
STEP 3:
Open up said fake program with your binary data viewer/hex editor.
STEP 4:
Scroll through data until you find something juicy. Good data will be in the middle or bottom- sometimes.
Here we find that the original creator of this was on a user account named, "Jamie."
Spoiler (Click to View)
You can also find the telltale signs of the compiler they used and such.
Oh look! That info that I typed in is being sent to his email! Oh look! There's his email and password!
Spoiler (Click to View)
* - Furious` - Feb 13, 2012
About "Jamie" that you found, this only happens when you compile your application as Debug.
Most of the people don't know that, it's called debug directory. If you compiled your application as Release this Directory won't exist.
* - Sanst - Feb 13, 2012
Going to get into this stuff, I guess this helped but it wasn't very descriptive lol,
Thanks though.
Edit: Found a gmail with this, but either he changed his pass or somebody else got to it first :(
* - subzer00 - Feb 15, 2012
Although the pictures didn't work for me (Not sure why).
This feels like a whaling tutorial when you use bintext (I think that's the program) to look at the program.
@sanst You gotta look for videos that were recently created, last week or so and you can most likely get to it.
* - theisnopie - Feb 16, 2012
Interesting tutorial. I heard about this reengineering viruses sort of but did not know it was this simple sounding at least.
* - Infinity. - Feb 17, 2012
All seemed so shitty while opening some program in hex workshop but never thought of getting this kind of info
Thanks mate!
* - domondon1 - Feb 19, 2012
Wow!!! i try this men later..hahaha..thank you
* - Orphan Crippler - Aug 13, 2015
man this tut helped a lot thank you!!
* - sneezing panda - Aug 14, 2015
Holy shit.. a 3 1/2 year gravedig.. why would you do this....