rustam Shirinov
  • Member for 4 years, 6 months
  • Last seen more than a month ago
  • Trondheim, Norway
I'm would like to view this malicious payload, but am having trouble decoding it
4 votes

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

View answer
Defining all undefined functions
2 votes

In ida you can make use of a idapython function called MakeFunction. You can basically iterate through the code and define undefined functions. ExampleScipts: IDA MakeFunction However If you ask this ...

View answer
Reversing Self-Modifying Malware
Accepted answer
2 votes

Thanks everyone who responded. The IAT was the problem. The OEP I found was the real OEP pointing to the unpacked code. But the dumped executable was not runnable because IAT was corrupt. After Fixing ...

View answer
Figuring out encryption technique of network connection
1 votes

For static analysis, you can use VMAttack plugin for IDA pro. Or if you wanna find how the buffer is built before it's sent you can try ScyllaHide plugin for x64dbg to debug the VmProtected executable....

View answer
Test malware files in host machine?
1 votes

Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.

View answer
Hooking functions in a VMProtect'ed executable
1 votes

StrongOD can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use ScyllaHide plugin with the VMProtect profile on, ignore Invalid or privileged instruction ...

View answer
Hex-Rays not properly showing strings
0 votes

Try unchecking Edit-> Plugins -> Hex-Rays Decompiler -> Print Only constant string literals

View answer
PE32+ executable : .text segment encryption
0 votes

You don't need the assembly language to add a decoder stub for the .text section. You can just write the code in C/C++ compile it as a Position independent executable & extract the ONLY .text ...

View answer
C++ hide string parameter for string viewer
-1 votes

One way to kind of easily "obfuscate" strings is to store them on the stack. Example: instead of declaring strings like char string[9] = "MyString" you can store them on the stack ...

View answer