oalabs
patreon
Live Stream VOD: Dumpulator vs. Guloader VEH Obfuscation
🕑 Added 2023-01-26 19:17:48 +0000 UTCIn this twitch stream we take another look at Guloader's VEH obfuscation using Dumpulator. With Dumpulator we are able to bypass the obfuscation to extract the encrypted strings, as well as create a simple instruction color trace in IDA to identify the program flow.
Sample
E3A8356689B97653261EA6B75CA911BC65F523025F15649E87B1AEF0071AE107
Notes
Comments
m4n0w4r
Note here, the latest Guloader shellcode has added a new exception: EXCEPTION_PRIV_INSTRUCTION (Ref: https://jeffpar.github.io/kbarchive/kb/114/Q114473/).
m4n0w4r
I saw c3rb3ru5d3d53c analyzing the recent version of GuLoader. The VEH in this new version has added two more exceptions, EXCEPTION_ACCESS_VIOLATION and EXCEPTION_SINGLE_STEP, to patch the shellcode's control flow. I hope you have time to stream about this new version, as well as add more code to Unit42's IDA plugin to patch the shellcode's control flow! <3
m4n0w4r
Oh, quick reply :D Thanks for your info! I tried 0.2.4 but still fail with the script in your stream, so I tried 0.2.2 and my face look like you on stream!! Wtf ..Hell yeah.. I got the same results lolz :)) Anyway.. thanks so much!!
OALABS
No I am staying away from the latest release it is broken as you mention and needs a little refactor. Currently I am pinned on 0.2.4 which doesn't have the bug but does have some other important fixes.
m4n0w4r
A nice and fun stream, but note here: The latest version of dumpulator (0.2.5) should not work, I dont know why (need dirty hand from Duncan for checking) or @herrcore : Can you take time to test your script with the latest version! For someone want to try, install the version 0.2.2 (pip install dumpulator==0.2.2).
