oalabs
patreon
Live Stream VOD: Rhadamanthys Part 1 - Stage 1 Shellcode and Shifted Pointers
🕑 Added 2023-01-26 19:25:16 +0000 UTCIn this twitch stream we take a look at Rhadamanthys, a stealer malware that uses multiples stages of shell code to protect its payload.
We start out unpacking the first stage but end up spending a lot of time trying to make a simple PEB walk look nice in IDA using Shifted Pointers. This is one tip that we shouldn't soon forget!
Sample
dca16a0e7bdc4968f1988c2d38db133a0e742edf702c923b4f4a3c2f3bdaacf5
Notes
PEB Walk _LDR_DATA_TABLE_ENTRY and Shifted Pointers in IDA
Comments
Karsten Hahn
<3<3<3
