ida pro plugin labeless, sync IDA with OllyDbg by a1ext

[m4n0w4r]

Guys, some blog posts regarding labeless experience (written by Raman Ladutska) are published:

• Labeless Part 1: An Introduction (https://research.checkpoint.com/labeless-an-introduction/)
• Labeless Part 2: Installation (https://research.checkpoint.com/installing-labeless/)
• Labeless Part 3: How to Dump and Auto-Resolve WinAPI Calls in LockPos Point-of-Sale Malware (https://research.checkpoint.com/19558-2/)

Nice series, thanks so much!
Regards,

 

[samoray]

Many Thanks to you "a1ext" for developping such a great tool and many thanks to "Raman Ladutska", for taking time to write those valuable tutorials.

 

[a1ext]

Many Thanks to you "a1ext" for developping such a great tool and many thanks to "Raman Ladutska", for taking time to write those valuable tutorials.

Thanks

 

[greenpiece]

Hey guys, glad if posts in Check Point blog are useful for you!
If there are any concerns and/or suggestions on improvement of this info sharing, don't hesitate to tell us about them.

We're planning to show how Labeless scripting is used both in Olly2 and in x64dbg, starting with theory and following with script samples. And yes, these are not sandbox samples but real malware research cases.
If you have any preferences on future publications, feel free to share them.

In the meantime a1ex.t is actively developing Labeless and wants to add bunch of useful features. Probably when articles are published, Labeless will be far ahead of the described tool

 

[samoray]

@greenpiece:
Thank you for your time on making tutorials, please drop links in this forum whenever new "Labeless" tutorials are released.
I really like your step by step explanation.

 

[greenpiece]

@greenpiece:
Thank you for your time on making tutorials, please drop links in this forum whenever new "Labeless" tutorials are released.
I really like your step by step explanation.

He-he, it's a pleasure to hear that something you've made is helpful for people. Hopefully we will keep it up!
As soon as there are new articles on Labeless (and not only) - we will share updates on this forum.
Stay tuned and have fun

P. S. I do not suffer from megalomania and this mystical word "we" actually consists of a1ex.t and me Although articles are written by me - it wouldn't be possible without collaboration with Alex and thus I cannot help but use "we" here and there.

 

[m4n0w4r]

@a1ext:

Can you add the link to Part 3 at the end of Part 2 (https://research.checkpoint.com/installing-labeless/), cause i must visit forum to read your post and get the link

Update: Wow i found it ("So, let’s proceed to the next lesson <--"), but i think make it "bold" for other . And this link is different from your post:

https://www.research.checkpoint.com/19558-2 <-- Blog (can not view)

https://research.checkpoint.com/19558-2/ <-- Your post

Regards,

 

[a1ext]

@a1ext:

Can you add the link to Part 3 at the end of Part 2 (https://research.checkpoint.com/installing-labeless/), cause i must visit forum to read your post and get the link

Update: Wow i found it ("So, let’s proceed to the next lesson <--"), but i think make it "bold" for other . And this link is different from your post:

https://www.research.checkpoint.com/19558-2 <-- Blog (can not view)

https://research.checkpoint.com/19558-2/ <-- Your post

Regards,

Thanks, I'll tell somebody to improve that.
Regarding links, we will fix that soon, thanks

 

[a1ext]

Guys, new version released https://github.com/a1ext/labeless/releases/tag/v_1_1_2_85
Changelog:

[IDA] IDA 7 for Linux project fixed
[IDA] Python editors now have line numbers
[IDA] Toolbar added
[github] Issue template added
[fix] Fixed issue #41
[IDA] now we could navigate to an error line when click at the debugger's script error line
[IDA] log outputs of the debuggee were made read only
[IDA] added debug visualizer for Qt5 to the project
[labeless] logging function was adjusted to the plugins code which don't add extra line endings
[IDA] debuggee's stderr spaces displaying fixed
[README] Added PyPI badge
[README] donate badge was added
[README] Discord channel badge added
[README] gitter badge removed, rooms were removed
Remote memory allocation for scripting added ll.memory.RemoteAllocRWE/ll.memory.RemoteFree

 

[a1ext]

Guys, new blog posts are ready for you:

* Labeless Part 4: Scripting
* Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm
* Labeless Part 6: How to Resolve Obfuscated API Calls in the Ngioweb Proxy Malware

Credits:
* Raman Ladutska (part 4 and 5)
* Alexey Bukhteyev (part 6)

 

[Storm Shadow]

Thank you for your good work @a1ext

 

[samoray]

Guys, I took some time to convert the "research.checkpoint's" tutorials about Labeless on PDF for easy reading and permanent availability. check them here:
*All credits for their Original creators*

 

[a1ext]

Guys, I took some time to convert the "research.checkpoint's" tutorials about Labeless on PDF for easy reading and permanent availability. check them here:
*All credits for their Original creators*

Thanks a lot. I've took a look at some of them, the images are scaled and unreadable, are there some way to keep them, for example, as svg to preserve their quality?

 

[greenpiece]

Guys, I took some time to convert the "research.checkpoint's" tutorials about Labeless on PDF for easy reading and permanent availability. check them here:
*All credits for their Original creators*

@samoray, thanks for great idea! Haven't thought about it initially.
Now when you've provided PDFs and we're meditating on them, I'm thinking in this direction... Having all the original documents, I can convert all the images to vector graphics so that zoom issue will be resolved - as pointed by @a1ext - and then convert documents to PDFs with all the original formatiing.
If it sounds like a plan, I will share updated PDFs soon.

 

[m4n0w4r]

@samoray, thanks for great idea! Haven't thought about it initially.
Now when you've provided PDFs and we're meditating on them, I'm thinking in this direction... Having all the original documents, I can convert all the images to vector graphics so that zoom issue will be resolved - as pointed by @a1ext - and then convert documents to PDFs with all the original formatiing.
If it sounds like a plan, I will share updated PDFs soon.

Yup, it always great idea!!

We can view offline with a good quality pictures and also a must have plug-in for IDA!!

Regards,

 

[samoray]

@samoray, thanks for great idea! Haven't thought about it initially.
Now when you've provided PDFs and we're meditating on them, I'm thinking in this direction... Having all the original documents, I can convert all the images to vector graphics so that zoom issue will be resolved - as pointed by @a1ext - and then convert documents to PDFs with all the original formatiing.
If it sounds like a plan, I will share updated PDFs soon.

@greenpiece:
please do it, that would be very helpful

 

[greenpiece]

Here we go, guys, PDFs are attached to this message and are ready to be used right away.
Images there are usual PNGs, not SVGs, I've found it surprisingly difficult to convert colourful images from PNG\BMP format to SVG.
Hopefully it will not be an issue for you.

Feel free to share any feedback that comes to your minds!

 

[samoray]

@greenpiece:
Thank you for your efforts, waiting for more...
do you mind if I share this in other forums!

 

[a1ext]

@greenpiece:
Thank you for your efforts, waiting for more...
do you mind if I share this in other forums!

Yes, please ^__^

 

[greenpiece]

@greenpiece:
Thank you for your efforts, waiting for more...
do you mind if I share this in other forums!

Sure, please do! Spreading tutorials is an excellent idea Just keep the link to this forum and/or Check Point blog so that community stays aware of updates when they appear.