4 ms·
How would this work if you were to run it under QEMU and just dump the code segment after decryption?
by alfiedotwtf 9y ago
How would this work if you were to run it under QEMU and just dump the code segment after decryption?
- PeterisP 9y agoThe point is that there is no "after decryption", at any given moment in time only a small portion of the code is decrypted.
- akrasuski1 9y agoThere has been some malware that did just that - it was still possible to record the trace of instructions being executed along with the current instruction pointer to be able to reconstruct the binary quite well.