Simple Shellcode Dissection | Hacker News Reader

Simple Shellcode Dissection

isc.sans.edu

69 pointskencausey3 comments

Love the analysis steps, it's wild how many utilities out there exist for this work, it can be maddening to keep track.

In another article there by Didier Stephens [0], he posts a link to his GitHub [1] where he provides numerous such tools. Very interesting stuff!

    [0] String Obfuscation: Character Pair Reversal
        https://isc.sans.edu/diary/String%20Obfuscation%3A%20Character%20Pair%20Reversal/29654

    [1] https://github.com/DidierStevens/DidierStevensSuite

Shoutout to @xme, great sans instructor, had him for a day.

Keep in mind scdbg is an emulator, if you want to debug it and see what it does the best way I know is to use jmp2it and attach your favorite debugger.

Reply on news.ycombinator.com