The Black Magicks of Malware: Function Call Obfuscation

Cthulhu fhtagn, current and future cultists!

In this video, we explore the "function call obfuscation" technique for hiding your Win32 API calls from antivirus and endpoint protection.

If you're interested in more like this, make sure to give my Twitch stream a look because I do a lot more content on there streaming 3 times per week!

[businkabasima]

Hey All, just wanted to drop by and say thank you for everything you do! I've been watching your streams, VODs, and videos for the past year, soaking in your advice and recommendations. As a result, I landed my first job offer and joined a great company! Wishing you all the best, and once again, thank you!

[b.h.]

🎉🎉🎉 behold, he is back on yt!! Glad to see you again!

[nuxar]

I’ve only tested it for kernel mode imports but it should be possible either way. The only hard thing is finding the base address of the DLL you’re looking for (because of ASLR). Most should be automatically loaded so you should be able to get it by iterating the loaded modules list from the PEB. (gs:60 iirc)

[DarkDonnieMarco]

Awesome to see you back bud. Currently working through OSEP, so this is well timed.

[theo]

spectacular! I'm a little thin on coding experience so I appreciate the boilerplate code. Thank you Al!

[peterclark]

Doing WinAPI function calls in my reverse engineering class right now, this was super helpful!

[xyen]

Awesome explanation I will definitely need to play around with this and see if I can find anything. Thanks for the content!

[lumikarhu]

no, throwing a meterpreter instead of calc will not work as well, especially with C# and an EDR on board. it will probably get flagged before you get to launch it