Jurriaan Bremer 9fb6003dd3 unicorn engine integration for shikata ga nai decoding ...

While working on proper interpretation of shellcode payloads from [1] we
found some shikata ga nai-encoded payloads. Using Unicorn Engine we
attempt to unpack this first layer to reach the actual shellcode. For
now this only works partially due to one or more suspected bugs in
Unicorn Engine's support for self-modifying code [2].

[1]: http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
[2]: https://github.com/unicorn-engine/unicorn/issues/820

2017-05-27 23:06:31 +02:00

379 B

Raw History

View Raw