Live Stream VOD: Rhadamanthys Part 2 - Emulating Shellcode
Added 2023-01-30 19:47:42 +0000 UTCIn this twitch stream we take a look at Stage 2 of Rhadamanthys and use Dumpulator to create a simple unpacker.
We spend the first hour marking up the Stage 2 shell code, the emulation work starts at the 1h 13min mark.
Samples
Packed Parent
dca16a0e7bdc4968f1988c2d38db133a0e742edf702c923b4f4a3c2f3bdaacf5
Dumped Stage 2
d4f37699c4b283418d1c73416436826e95858cf07f3c29e6af76e91db98e0fc0
Notes
Rhadamanthys Emulation Attempt
Comments
Hell .. very nice pseudo-code of sc stage2. Thanks Mishap!!
m4n0w4r
2023-04-28 07:33:49 +0000 UTCPlugin worked on IDA for OSX as expected :)
justin thattil
2023-03-12 09:25:24 +0000 UTCYes it should be cross platform as it's a python plugin, log any bugs if you find them!
OALABS
2023-02-14 21:21:01 +0000 UTCThanks for the awesome walkthrough.. A qq...Can HashDB plugin be used on IDA for OSX? Versions:OSX 12/IDA 7.6
justin thattil
2023-02-14 11:08:40 +0000 UTC
