Thanks a lot!

@@stacksmashing welcome, eagerly waiting for next part(s)

The first video has 300k+ views, this one have a lot less (about 70% less). It's funny to see how complex subject videos tends to have this pattern. With 3Blue1Brown playlists this happens a lot.

@@mateusmercer2280 i think ppl just binge watch first part and very few feel intrigued enough to watch second

@@navjot7397 Shame, though. This part has the candy.

Am I before or after Matrix 4 in that list? :D

@@stacksmashing Before Half-Life 3. That's for sure )

Plot twist 2: you created the virus, and you are playing with us

@@asaripatlineto7295 Plot twist 3: you created the virus, and you are playing with us

@@ayaan5015 Plot twist 4: You both created the virus and now you're spamming here

@@Aryan-ji2nk Plot twist 5: You all created the virus and now you're making me wanna cry with all these confusing comments *ba-dum-tss*

Plot twist 7 the guy who made it is in prison

maybe it's you

Alex Rémy maybe it’s you

@@QS1597 maybe it's you

@@phizlip Maybe it's you

Would it make him WannaCry?

Fund it with your time - it's open source! ;)

I dont see very much obfuscation on wannacry lol i remember a keygenme who was a lot more obfuscated and some techniques for frustrate reverse engineering analysis, im using ollydbg, remember some obfuscated strings with large algorithm on Statinko malware.

😂😂😂🤣🤣😂🤣

Agree this puts you to sleep if you have no programming knowledge

This kind of malware is the work of a team, not a single person.

@@AdeeJa Inadvertently a intelligent group of people

I'm a bit late in answering this but it might be helpful to someone else wondering the same thing Yes, this isn't the exploit code, and you do need admin privileges for the code in parts 1 and 2 to work. This is because wannacry is typically invoked by the exploit, rather than by a user interaction. The actual exploit itself is probably mentioned in part 3, as it talks about how the malware spreads, but a short version is it's a zero-day in windows found by the NSA, which was leaked to the public by a group known as the "Shadow Brokers". As far as I remember windows patched the vulnerability before wannacry was created, but many machines which were not updated were still vulnerable.

I believe at the time I used the docker image!

@@stacksmashing Thank you for your reply. Does using the docker image automatically make the "CERT" option appear?

Ah for Ghidra you need the plug-in :)

@@stacksmashing Thank you so much! It worked like a charm.

Ofcourse WannaCry still can be used, what’s cheaper, paying some hacker 350 usd in BTC or paying a company that charges you a couple of grand just to undo all the stuff, ofcourse they won’t tell you a killswitch is active

No because it re-launches itself without the /i argument :)

He'd be sued in no time

The URL was not Registered, so if you tried to access it nothing would be returned. It acts as a kill switch because someone can register this URL and make it active to stop the spread

@@sbapkat8691 Thanks for the response, now it make sense to me.

probably, but it would take a long time

it’s part of the OOAnalayzer plugin

@@stacksmashing I have spent the whole morning installing that plugin using this repo here github.com/cmu-sei/pharos/tree/master/tools/ooanalyzer/ghidra/OOAnalyzerPlugin but nothing works :( Btw your videos are life changing. Please continue to make more ghidra reverse engineering videos. Cheers!!

@@nakul2569 Were you ever able to get it? If not, now there is no actual ghidra tree in the pharos repo, it is now built into a new tool (sorta big combined tool) called Kaiju which has a bunch of Ghidra stuff including the OOanalyzer CERT tab on the menubar