1

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/

Hash: 9d7e34250477acf632c6c32fc2c50d3b

In the example, after decryption of the stage 2 this is the result: enter image description here enter image description here

When I repeat the same steps with Ghidra I get the following result: enter image description here enter image description here

I've been following the assembly trying to see if I could figure out what when wrong or what is going on with no results yet.

While searching, I came across these references: https://c9x.me/x86/html/file_module_x86_id_139.html https://en.wikipedia.org/wiki/HLT_(x86_instruction)

It would be appreciated if someone could point me in the right direction.

EDIT: After Paweł Łukasik pointed out my error, it works: enter image description here

2

Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original.

For example, at offset 0x58, there's supposed to be push edx so the byte should be 0x52, but you have push esp which is 0x54. Since the article mentions that this part is encrypted with a xor (with a single digit key), let's see how those values are off

In [7]: 0x52 ^ 0x54
Out[7]: 6

So this is exactly the key mentioned in the article. If we compare the rest of those off instruction we will notice that they are off by the same value.

Conclusion - this part of code shown in Ghidra was not decrypted and should be preprocessed before analysis.

1
  • ugh, thanks, I totally overlooked that. I even went back but it did not clue in to me that I had included the key until your response.
    – Elfwig
    Oct 4 '20 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.