[hanan]

Hi,

I would like to know if reversing a malware that has been written with delphi is requiring a different skill set than knowing how to reverse a malware that has been written using C or the like.

I found that to be different, but i would like to know how much different is it? am i need to know how the program in delphi ( i mean knowing paradigms that delphi programmers are using in their programs) ?

[EP_X0FF]

No big difference. Load proper FLIRT signature to IDA and thats all. Even if it compiled by Delphi, most Delphi malware not written on OOP. They use KOL to remove most object oriented code for output file size reduction and better morphing.

[hanan]

One thing though i learned today is that most delphi programs use TLS for internal reasons probably not for malicious purposes, so one probably shouldn't waste time on the TLS of a delphi malware.

[Apocalypse]

http://kpnc.org/idr32/en/index.htm