about writing malware and how to start

-------------------------------------------------------------------------------------------------------------------------------

0x01
my story

-------------------------------------------------------------------------------------------------------------------------------

sometime in the early 2010's, i was a big fan of videogames. I played a game called CSGO. In that game, almost everywhere you'd find someone cheating
by DDoSing. When i first saw this i was pretty fucking amazed. I didn't really think this was possible at the time, that someone could abuse computers
for profit/self gain. So soon after that, I started doing some maldev. But being around 12-13 at that time - it didnt really help very much. At first i had
no idea what i was doing. At this period of time, StackOverflow and YouTube didn't exist, so i pretty much completely relied on weird, obscure forums and IRC
to actually learn, or figure anything out. Eventually i got on EFNET and got my first solid advice, and that advice was to learn to code. I ended up getting the
book C Primer Plus (a great book) and reading it cover to cover. But after reading, was i good at coding? No. Did i understand how to write malware? again, no.
I learned the basics of C programming but, my understanding of the language was not good enough to write actual malware. People ended up telling me that i needed
to have complete some programming projects before i could actually learn maldev. My first C programs were very boring, calculating math problems, and auatomating
some stuff. I eventually tried to connect to Dictionary.com and get definitions on words with C. I did many projects, failed like shit, alot. And it took me a while 
to actually fully understand C at a suficient level for about a year. I ended up spending most of my time being distracted by school, girls and games. I was a teen, so 
what would you expect. I was not focused. Maldev and programming need you to be focused, but at that time, i wasn't. People normally don't tell you that programming at
first is not fun at all, it's shit. But once you start to get a hand on things you can code for hours and not even notice time has gone by.

Well, lets go a few years into the future, and im in university for electrical and computer engineering. and it turns out i can write malware and code.

-------------------------------------------------------------------------------------------------------------------------------

0x02
don't be retarded, expect failure.

-------------------------------------------------------------------------------------------------------------------------------

Who wouldv'e thought that programming is a requirment for malware dev. I've seen people asking if programming is required, and they're retarded
it is literally fucking called malware and what the FUCK do you think malware stands for? it's FUCKING MALICOUS SOFTWARE.

If your goal is to write malware, but you don't know how to code, don't become a paster, either kill yourself or learn programming.
don't waste your time looking at the thousand different programs to learn programming, just look on reddit for a good book on the language you want
to learn. i mean you could also just pick one and jump into it, they can't be that different. I've seen alot of people asking "where can i learn the best?"
this shouldnt even be a real question. literally find a book on the programming language you want to learn, get it and read it cover to cover and start coding.
There is no shortcut, there is no quick or easy path, it's a requirment. MalDev as it becomes more and more advanced is literally just software engineering. 
Bigger "Large Scale Threat Actors" will have sprints, known issues and engineering challenges and other writing may encounter, so learn to fucking code.
some people say they know to code but in reality they dont, and they end up asking shit like "hello saar saar hello???? malware teknikes plsss saar"
anyone that actully understands low level programming will end up knowing fundamental maldev ideas - the same way a talented low level programmer will 
understand the fundamentals of exploit development. This doesen't mean they have great knowlage of the internals, the niches, and etc; but they do have 
a good idea and introduction of it.

Why do i say actual talented programmers understand the fundamentals of MalDev? I say this because, malware in its simplist form, is abusing API's 
for malicous purposes. for example, on the shittiest OS windows, theres a function called "GetAsyncKeyState". GetAsyncKeyState determines whether a key (on a keyboard)
is up or down at the time the function is called., and whether the key was pressed after a previous call of GetAsyncKeyState. this function has been used by keyloggers.
it has been used by keyloggers for a fucking long time.  This function allows an induvidual to determine when a key on the keyboard has been pressed. you may ask "why
does this function exist if it can be used for keyloggers?" The anwser is simple, it can be used for legit reasons. apps exist that choose to monitor specific 
shortcut keys ex. CTRL+C and CTRL+V (copy-paste), or the app could maybe make an app only shortcut (such as Chrome web browser CTRL+T, to make a new tab).
One method to determine if the key combination has been used is using this API call (GetAsyncKeyState).

-------------------------------------------------------------------------------------------------------------------------------

0x03
do stuff, write warez

-------------------------------------------------------------------------------------------------------------------------------

Anyone reading this is probably looking for a solid path to maldev. The reality of this is everyone will learn different things, and learn it differently than others.
And i encourage you to explore shit, like for example, if you like Python, learn how it works down to the PVM. If you like C programming on Windows, explore the WINAPI
and try doing basic tasks. You need to explore, wou will learn, and you'll fail ALOT. If you're stuck, or don't know where to begin, EXPLORE MORE.
Read malware reseach papers, read the news on malware, read on APTs or ransomware groups. Look at malware source code.

Resources i like for windows malware 

1. vx-underground - https://vx-underground.org/Papers/Windows - great paper collection, you can learn alot from here
2. BleepingComputer - https://www.bleepingcomputer.com/ - Stay up to date on news.
3. Mitre Attack for Windows - https://attack.mitre.org/matrices/enterprise/windows/ - Comprehensive list of attack methods. Good for exploring.
4. Vergilius Project - https://www.vergiliusproject.com/ - Good documentation on changes to Windows Internals
5. ReactOS - https://reactos.org/ - Excellent for understanding how Windows internals works
6. The Old New Thing - https://devblogs.microsoft.com/oldnewthing/author/oldnewthing - Unusual Windows Internals, notes, and documentation
7. Windows API Index - https://learn.microsoft.com/en-us/windows/win32/apiindex/windows-api-list - Explore what Windows lets you do.
8. Malpedia - https://malpedia.caad.fkie.fraunhofer.de/ - Resource for identifying malware
9. vx-underground Malware Source Code collection - https://github.com/vxunderground/MalwareSourceCode - Review other peoples malware code
10. UnknownCheats - https://www.unknowncheats.me - Video game cheater forum, excellent and unusual Windows Internals discussions
11. Geoff Chappell - https://www.geoffchappell.com/index.htm - Excellent source of Windows internal explanation

also, heres some questions i thought i could anwser.

Q - "Should I read Windows Internals Volume 1 and 2?". 
A - No, don't hurt yourself. Windows Internals is an great book, but it is incredibly technical and difficult to sit down and read. Windows Internals
    should be read in small peices, or used as a reference guide. For example, if you've ever wondered how the registry works on Windows, reference
    Windows Internals. But, if you're skilled in C and the C WINAPI, good portions of Windows Internals can be skipped. If you want to read Windows
    Internals it is recommended you become semi-familiar with the Windows API. Otherwise, reading Windows Internals will be very boring and
    painful.
	
Q - "Is Malapi.io a good reference?"
A - No, it is not. the site is interesting, the problem is that any function on Windows can be used for malicious behavior, and likewise,
    most "seemingly malicious" functions can have legitimate usages. MalAPI might as well list every function in the Windows API, because the entire fucking
    point of malware is abusing valid functionality. This could be compared to someone making a list of items dangerous to people - what could
    hurt a person? Literally anything if given enough time, effort, or force. You could be stabbed with a spoon, suffocated with a teddy bear, you can
    be force fed toilet paper and choke and die.
	
-------------------------------------------------------------------------------------------------------------------------------

0x04
skills

-------------------------------------------------------------------------------------------------------------------------------

BEGINNERS - 		They can code, but they're also retarded, this group makes up most of the malware devs.
		
SEMI-SKILLED - 		These people can code, and can probably code well. 
			
SKILLED - 		This is a person is good with intrnals.
			
TOP 5% -		people who rarely leave their room
			
-------------------------------------------------------------------------------------------------------------------------------

0x05
summary

-------------------------------------------------------------------------------------------------------------------------------

learn to code, use google, read a shitload of stuff.
-ddt 2024