oalabs
patreon
Live Stream VOD: Rhadamanthys Part 2 - Emulating Shellcode
🕑 Added 2023-01-30 19:47:42 +0000 UTCIn this twitch stream we take a look at Stage 2 of Rhadamanthys and use Dumpulator to create a simple unpacker.
We spend the first hour marking up the Stage 2 shell code, the emulation work starts at the 1h 13min mark.
Samples
Packed Parent
dca16a0e7bdc4968f1988c2d38db133a0e742edf702c923b4f4a3c2f3bdaacf5
Dumped Stage 2
d4f37699c4b283418d1c73416436826e95858cf07f3c29e6af76e91db98e0fc0
Notes
Rhadamanthys Emulation Attempt
Comments
m4n0w4r
Hell .. very nice pseudo-code of sc stage2. Thanks Mishap!!
justin thattil
Plugin worked on IDA for OSX as expected :)
OALABS
Yes it should be cross platform as it's a python plugin, log any bugs if you find them!
justin thattil
Thanks for the awesome walkthrough.. A qq...Can HashDB plugin be used on IDA for OSX? Versions:OSX 12/IDA 7.6
