oalabs
patreon
Live Stream VOD: Guloader ( Part 4 ) Deobfuscation
🕑 Added 2023-01-13 19:29:16 +0000 UTCIn this twitch stream we take a fourth look at Guloader and finally fully deobfuscate the control flow (VEH redirect) and write a simple string decryptor.
This stream is sort of a wrap up of all the previous streams, we fully fix the control flow obfuscation and use an IDA plugin to removed the VEH redirection. We also write a simple Unicorn emulator script to handle the constant-unfolded-data used to build the encrypted strings.
Sample
E3A8356689B97653261EA6B75CA911BC65F523025F15649E87B1AEF0071AE107
Notes
Guloader - VEH Program Flow Redirection
