4 ms·
Simple Shellcode Dissection
- _8j50 4y agoShoutout to @xme, great sans instructor, had him for a day. Keep in mind scdbg is an emulator, if you want to debug it and see what it does the best way I know is to use jmp2it and attach your favorite debugger.
- spydum 4y agoLove the analysis steps, it's wild how many utilities out there exist for this work, it can be maddening to keep track.
- yardshop 4y agoIn another article there by Didier Stephens [0], he posts a link to his GitHub [1] where he provides numerous such tools. Very interesting stuff! [0] String Obfuscation: Character Pair Reversal https://isc.sans.edu/diary/String%20Obfuscation%3A%20Character%20Pair%20Reversal/29654 [1] https://github.com/DidierStevens/DidierStevensSuite