DEV Community: Ali Aryani

First Steps into Darkness: My First Malware Analysis Experience

Ali Aryani — Tue, 07 Oct 2025 13:35:05 +0000

First step into the dark realm is the hardest to take, it starts with pure blindness, but slowly gives you sight.

I spent one day on learning Assembly basics, and another on C basics, as I knew these two form this reality. Then it was time to begin this new not-ever-seen-before journey! I needed a map, so I chose Practical Malware Analysis Book as my guide.
I read about 100 pages that day, I had to be ready. I also needed safety and security, so I chose Oracle VirtualBox to be the bridge between me and the dark realm. I personally use Linux, but for this purpose I had to use a Windows machine and I installed one on VirtualBox.
Such trip also needs tools, So I chose these:

Windows SysInternals: some of these might and will come in handy.
PE Bear: This one helps me see what's inside a malware, like a flashlight in darkness.
PEiD: Nice tool for understanding the locks that might show up on my way.
ResHacker: Shows the resources of the dark forces! Helps me see if there's any picture, binary, etc. inside a file.

Everything seems ready so far, doesn't it? Let's begin the journey!

First Lab: Pure Confusion!

As I started the first lab, I was so goddamn confused about it! I didn't know what to look for, or even where to look for things!

You can access the labs here

Strings

I opened PowerShell inside the lab folder, and used strings (which is a part of sysinternals) to extract any string found in the lab malware :

strings .\Lab01-01.exe

The result was a huge list of nonsense character combinations, except for some who actually made sense:

CloseHandle
UnmapViewOfFile
IsBadReadPtr
MapViewOfFile
CreateFileMappingA
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
CopyFileA
KERNEL32.dll
malloc
exit
MSVCRT.dll
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp
kerne132.dll
kernel32.dll
.exe
C:\*
C:\windows\system32\kerne132.dll
Kernel32.
Lab01-01.dll
C:\Windows\System32\Kernel32.dll
WARNING_THIS_WILL_DESTROY_YOUR_MACHINE

Feeling confused? So did I! But I was not afraid of these, I started searching for some of them on the internet, mostly in Microsoft Developers Network.

Is it packed?

Then I checked the file using PEiD to make sure it's not packed or anything, and it wasn't.
So I immediately took the next step.

Resources and Imports

I used ResHacker, only to see that it doesn't have any resources! So I used PE Bear to analyse it a bit. I checked the dependencies and imports, and also headers.

Connecting the Dots

I could understand that this malware does something, but I didn't know what. I looked more carefully, and I finally found something. There where to files mentioned in the strings result: a) a Kernel32.dll and b) a Kerne132.dll, and the latter was spelled with a one instead of an l. Considering this and imports, I guessed that this malware tries to create a file with a name similar to a system file, and hides it somewhere. It could be a backdoor.
There was also another file: lab01-01.dll, most interesting parts of which were the imports. It was obvious that this file would create a process and add maybe add it to the system startup.
It was definitely a backdoor-installing malware.

This was just a beginning, there were and there are many other labs to try! I'll write about them soon...

Create. Love. Improve.
--A. Aryani

Microsoft: An Open-Source Comedy

Ali Aryani — Sat, 20 Sep 2025 08:17:59 +0000

O' What may man within him hide, though angel on the outward side!

Since the beginning of opensource ideology, Microsoft has been one of those companies that no one ever expected to join the cause.
Weirdly enough, They did! By making PowerShell opensource, and more important than that: by introducing Visual Studio Code to the world of programming. Microsoft vscode is one the fastest text editors out there and, thanks to its massive list of extensions, one of the best most-used IDEs in the world!
Let's thanks Microsoft, eh? Not so fast! Read this article first, as it might (and will) change your mind.

A Wolf in Sheep's Clothing

One of the main ideas of opensource, is that when you can see the code, your can see if the program tries stealing your data. You might not see any telemetry code in vscode's source code, but Microsoft adds telemetry code to it before compiling it (as mentioned here).
That's not a good thing, is it? So there came a community-driven version of vscode, called vscodium. Vscodium is freely-licensed binary distribution of vscode that does not have the telemetry part (and things like copilot).
Many of us programmers moved to vscodium, and were living freely there, until recently, when Microsoft did some evil moves against us.

Writing C/C++? NO MORE!

If you're a C/C++ programmer like me, then you're gonna need Microsoft C/C++ Extension in order for vscode to debug and help you write your code.
Since the version 1.24.5, which was released April 3, 2025, this extension is blocked on non-Microsoft products, meaning it's no longer available/installable on vscodium (or any other fork of vscode). It's get more interesting if I tell you that people tried forking this extension (which is opensource) and removing the check, but they found out that this extensions consists of opensource TypeScript code, and a few proprietary closed-source files (Read more here)!

💡 If you've faced this problem as I did, you can install and use clangd extension which is much faster and better than Microsoft C/C++ extension.

Access the Market? NEVER

Microsoft vscode's Marketplace is where you can find extensions, themes, etc. and basically it's what turns vscode from a simple text editor to a powerful IDE. A few weeks ago I noticed that marketplace has stopped working on vscodium, and as a result I can't install new extensions or update the ones I had already installed.
I did some research, and I realised it's not a bug, it's a new evil move from Microsoft. Marketplace is no longer accessible from non-Microsoft products like vscodium! And that was it! I moved to Neovim forever.

💡 You can still install extensions on vscodium using Open VSX Registry, which is an opensource project by Eclipse Foundation.

Final Words

Honesty is invaluable. If you want to create an opensource project, fine, but be real; If you want to create a proprietary project, still fine, but be real.
Open-Source is not a costume you wear when convenient, either wear it with honesty, or never wear it at all.
We will make a brighter future together, never doubt that.

Create. Love. Improve.

A. Aryani

Rust vs. C++ : An Unbiased Comparison

Ali Aryani — Fri, 19 Sep 2025 12:05:28 +0000

The old warrior stood, scarred but unbroken. The young challenger raised his sword, burning with ambition. Yet the elder’s eyes whispered a truth: strength forged over decades does not fall easily to youthful fire.

Since the beginning of time (i.e. creation of C), the world has introduced thousands of warriors to challenge, defeat, and replace C and his mighty son, C++. Yet no one really succeeded, except for who did not win, but at least, survived. The name is Rust, a language that tries to be safe by default, unlike C/C++.

Rustaceans (I personally call them rust-people), have taken this fight so seriously that things are getting a bit out of control!
But, regardless of all my love for C/C++ and the point that I'm not much of a Rust fan, I'm going to do an unbiased realistic comparison between the two greatest warriors of the lands of system-level programming.

Let's begin with an introduction of each.

What a System-Level Programming Language is

A system programming language (also called a low-level programming language) is, as the name suggests, a programming language used for system programming. I'm not going to explain it in detail here, just a brief introduction.
A system programming language gives you the ability to speak directly to hardware, allocate and free the memory as you need, talk to your graphic card and ask it to render a game in full resolution for you. C, C++, and Rust are considered low-level programming languages.
On the other side of the table, we have high-level programming languages. While using these, you don't have to worry about memory as you do not have access to hardware anymore. These languages use tools like garbage collectors (GC) to manage memory and prevent risks. Python, Ruby, etc. are examples for high-level languages.

Enough of this, let's talk about the Titans.

C/C++: The Beginning of Time

In 1970s, a successor to B programming language was created by Dennis Ritchie. This great successor was C programming language, a low-level language that is still widely used today for programming kernels, drivers, operating systems, other programming languages, and many more things. We can say that many programming languages we have today are, directly or indirectly, created by C.
In 1985, Bjarne Stroustrup introduced C++ as an extension of C, adding object-oriented (OOP) features to C. Unlike C (which is simple and has a few keywords), C++ is a very, very huge language with so many abilities and is getting bigger every year (beginners consider it a nightmare!). C++ is so powerful that you can do anything you want with it. let's take a little look at pros and cons.

Pros

C/C++ are mature old languages, with thousands (if not millions) of libraries and frameworks.
Amazing for designing GUI applications, thanks to Qt, Dear ImGui, and many more.
Strong and huge communities, solutions can be found easily.
Lots of learning resources.

Cons

Most important: Not being memory safe by default. Safety relies entirely on you.
C++ has a steep learning curve due to vastness.

Let's talk about Rust.

Rust: The New Warrior on the Field

In 2015, Mozilla Foundation introduced Rust, a programming language designed with performance and safety in mind.
When it comes to memory, there are basically two points of view: a) relying entirely on the programmer and/or b) using a garbage collector. Rust offers a third view: Ownership. By the help of ownership system, your code is memory safe without relying on you or using a GC, and that's amazing! Let's analyse it in more detail:

Pros

Rust implements best practices as it's default, so it's safe.

An example I can give you for this, is that a good way of keeping your program safe in C++ is by using constants instead of variable, unless you need to change the value:
const int number {12};
// instead of int number {12};
But Rust is different. In Rust every variable is immutable by default, and if you need to change the value later, you must explicitly declare that using mut keyword:
let number: u32 = 12; // immutable
let mut number2: u32 = 12; // mutable

Uses cargo package manager, and makes it much easier to manage dependencies
Thanks to the borrow-checker and ownership system, your code is almost always safe (I'll tell you how it can be unsafe in the next section)

Cons

Rust is still young, and therefore it doesn't have a huge community like C/C++ (though the community is growing bigger day by day).
Still not good for GUI applications due to the small community and lack of native libraries.
Does not have as much libraries and frameworks as C/C++ have.
Steep learning curve due to complications caused by ownership system and borrow-checker.
Slower compile time due to compiler's borrow-checking and making sure of safety.
Coding in Rust can take longer as you need to write more code due to ownership rules.
By default, no direct access to hardware is given, but access can be achieved using unsafe.
Can become unsafe by the developer. See the next section.

Direct Hardware Access

When it comes to low-level programming languages, direct hardware access is essential, otherwise low-level programming will be meaningless.
C/C++ provide this access, but Rust doesn't. Rust does not trust you with memory and hardware as you might cause huge problems with such power!
Still, Rust knows the need for hardware access, so it provides you with unsafe. In Rust, you can declare an unsafe code block in with you can access memory without any limits, this way your program has only one dangerous part which is only implemented if direct access is necessary (most of the times it isn't).

So far you can see that Rust is much safer to use than C/C++, so why earlier on this article I said I don't like it? Let's find out!

The Rustacean War: A Rewrite Massacre

Since the creation of Rust, the idea of moving from C/C++ to Rust for better safety has become popular and more people are doing so. An example is implementation of Rust code in Linux Kernel (which is entirely written in C).
I don't believe this is a bad thing. Actually I sometimes support this idea as it tries to make the world of code safer. The biggest problem here is that some Rustaceans are so focused on proving that Rust is better than C/C++ that all they do is rewriting every already-existing safe-coded useful programs (regardless of the language their written in) with Rust! Projects like sudo-rs as a replacement of the good old sudo (that has been around for years and has never had a memory problem!) are a good example of this.
Rust can be used for amazing projects, kitty terminal, mdbook, zed IDE, etc. are examples of creative Rust code.

This is why some people (I myself included) cannot accept Rust. Because programming is about creativity, not trying to prove others that your language is better.

Create, don't re-invent the wheel!

Real Safety and Security

Matters of safety and security, though seem alike, are quite different (I'll write about them in detail in another article). Language is a tool like a surgery knife, it can take your life or it can give it to you. The most important element, the key element of a safe and secure program is you, the programmer.
Rust tries to be safe by default, but you can turn it into a mess. C/C++ is unsafe by default, yet you can write it safe. If you want safety of your program, read and learn. Remember, you're all that matters, safety and security depend on you.

Final Words

Code with the language you like, do not ever listen to others telling you that it's not a good language. If you master it, then it's a good language in your hands.
Be creative, don't just rewrite other tools!
And enjoy coding.

Create. Love. Improve.

A. Aryani

Semicolon-First: A Psychotic Yet Interesting Way of Writing Code!

Ali Aryani — Tue, 16 Sep 2025 13:52:41 +0000

How the Idea Came to Me

When I was 9, I was dreaming of a programming language in which every line starts with a semicolon. Weird huh? It gets more weird when you realise back then I did not know anything about programming languages!

Three years ago when I was learning a little bit of JavaScript, I read a note about comma-first writing style. If you don't know what it is, look at the following example:

normal_way = [
   'item1',
   'item2',
   'item3'
]
# now let's write it with comma-first
comma_first_way = [
    'item1'
    , 'item2'
    , 'item3'
]

As you see in the example above, in comma-first, instead of ending a line with a comma, we start the next line with a comma!
There's nothing wrong with this way of coding, it's your personal choice if you want to use comma-first.

Anyways, What is semicolon-first and what does it have to do with what I've said so far?

Semicolon-First

It's creative, it's lovely, it's a mess!

A month ago I thought to myself: "Let's put this childhood dream into practice, the compiler won't care!".
Writing code in this new way seemed easy at first, but it was a bit tricky to implement.
To start, look at the following C++ example, which is normal:

#include <iostream>
#include <string>
using namespace std;

int main() {
    string name;
    cout << "What's your name? => ";
    cin >> name;
    cout << "Hello " << name << "!" << endl;

    return 0;
}

After trying different ways, I finally invented the semicolon-first style:

#include <iostream>
#include <string>
using namespace std

; int main() {
    string name
    ; cout << "What's your name? => "
    ; cin >> name
    ; cout << "Hello " << name << "!" << endl

    ; return 0 ;
}

except the first line of each block, every other line starts with a semicolon
the last line starts and ends with a semicolon ( spaces should be there to keep the balance )

__Question is, should I use it? Is it better than the traditional way? Is it the future? Let's see.

Semicolon-First Pros and Cons

Why is it good ?

By using semicolon first you will never forget to put a semicolon at the end of a statement, because it comes first!
Commenting in this style is somehow easier. You can break a statement into small chunks and write a comment about each one. look at the following example:

#include <iostream>
using namespace std

; int main() {
    int age 
    ; cout << "How old are you? " // just asking
       << endl // adding new line character
    ; cin >> age // get the age 
    ; cout << "So you're " << age // fore-telling the obvious!
        << endl << "Hmm..." // thinking
        << endl << "interesting!" << endl
    ; return 0 ;
}

I shall mention that you can do this in the traditional way, too. So it's not a big deal.

Why is it bad?

World of programming does not like a rule breaker like this!
There is a chance of getting roasted for using this style!
Other programmers might see your code as confusing.
Code formatting tools might change to the traditional way anyways!
Others will have problems contributing in your projects

Conclusion

Writing this way is a personal choice, no one can force you to do what you don't like. If you think this style is better, use it.
I personally do not use this style anymore, since I can't risk my code being unclean. But if the world decides to use semicolon first, so will I!
I will be happy to hear you comments and ideas on this.

Create. Love. Improve.

A. Aryani