mirror of
https://github.com/cuckoosandbox/cuckoo.git
synced 2026-10-12 02:12:40 +00:00
Jurriaan Bremer
9fb6003dd3
While working on proper interpretation of shellcode payloads from [1] we found some shikata ga nai-encoded payloads. Using Unicorn Engine we attempt to unpack this first layer to reach the actual shellcode. For now this only works partially due to one or more suspected bugs in Unicorn Engine's support for self-modifying code [2]. [1]: http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ [2]: https://github.com/unicorn-engine/unicorn/issues/820
37 lines
1.1 KiB
Python
37 lines
1.1 KiB
Python
# Copyright (C) 2017 Cuckoo Foundation.
|
|
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
|
|
# See the file 'docs/LICENSE' for copying permission.
|
|
|
|
import pytest
|
|
|
|
from cuckoo.common.shellcode import Shellcode, shikata
|
|
|
|
class TestShikata(object):
|
|
def setup(self):
|
|
self.sc = Shellcode()
|
|
|
|
def shikata(self, filename):
|
|
return shikata(
|
|
open("tests/files/shellcode/shikata/%s" % filename, "rb").read()
|
|
)
|
|
|
|
def test_unicorn100_good(self):
|
|
assert self.shikata("1.bin").startswith("\xfc\xe8\x82")
|
|
assert self.shikata("3.bin").startswith("\xfc\xe8\x82")
|
|
assert self.shikata("4.bin").startswith("\xfc\xe8\x82")
|
|
|
|
@pytest.mark.xfail
|
|
def test_unicorn100_bad1(self):
|
|
assert self.shikata("2.bin").startswith("\xfc\xe8\x82")
|
|
|
|
@pytest.mark.xfail
|
|
def test_unicorn100_bad2(self):
|
|
assert self.shikata("5.bin").startswith("\xfc\xe8\x82")
|
|
|
|
@pytest.mark.xfail
|
|
def test_unicorn100_bad3(self):
|
|
assert self.shikata("6.bin").startswith("\xfc\xe8\x82")
|
|
|
|
def test_infinite_loop(self):
|
|
assert shikata("\xeb\xfe") == "\xeb\xfe"
|