 Jurriaan Bremer
|
9fb6003dd3
|
unicorn engine integration for shikata ga nai decoding
While working on proper interpretation of shellcode payloads from [1] we
found some shikata ga nai-encoded payloads. Using Unicorn Engine we
attempt to unpack this first layer to reach the actual shellcode. For
now this only works partially due to one or more suspected bugs in
Unicorn Engine's support for self-modifying code [2].
[1]: http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
[2]: https://github.com/unicorn-engine/unicorn/issues/820
|
2017-05-27 23:06:31 +02:00 |
|