Packers Vs Cryptors Reverse Engineering KH6052CEM Lecture 10 | The knowledge Hub universities - Conventry university

School of Engineering and Computing Reverse Engineering KH6052CEM School of Engineering and Computing Lecture 10 School of Engineering and Computing Packers Vs Cryptors Packer ot noisserpmoc sesu ti dna ,tupni ...

School of Engineering and Computing Reverse Engineering KH6052CEM School of Engineering and Computing Lecture 10 School of Engineering and Computing Packers Vs Cryptors Packer ot noisserpmoc sesu ti dna ,tupni sa elbatucexe eht sekat taht margorP : nihtiw derots neht si tnetnoc detacsufbo sihT .tnetnoc s'elbatucexe eht etacsufbo dekcap( elfi elbatucexe wen a si tluser eht ;elfi elbatucexe wen a fo erutcurts eht .ksid eht no tnetnoc detacsufbo htiw )margorp Cryptor : Similar to a Packer, but instead of using compression, it uses encryption to obfuscate the executable's content, and the encrypted content is stored in the new executable file. Upon execution of the encrypted program, it runs a decryption routine to extract the original binary in the memory and then triggers the execution. School of Engineering and Computing Packing School of Engineering and Computing What is Generic Unpacking? Malware authors always try to hide and evade detection not just by packing the code but also by using different injection techniques like Self Injection , PE Injection , Process Hollowing ,…etc. School of Engineering and Computing What is Generic Unpacking? Each technique of the injections we talked about requires a set of API calls to be achieved, So by monitoring the APIs calls made by the executable we can predict the technique used and the functionality of the sample. School of Engineering and Computing Generic Unpacking Techniques We will talk about three APIs we can set a breakpoint on them and watch the parameters passed or the return value. VirtualAlloc : This function is a memory-allocation routine that can allocate memory in a current process or in a remote process if using VirtualAllocEx, So for sure, it will be useful to see if the malware is allocating memory and view changes that happen to the allocated memory as maybe the unpacked pe file will be written to the allocated memory or a shellcode will be written there. School of Engineering and Computing Generic Unpacking Techniques VirtualProtect : This function is used to change memory protection and usually follows the VirtualAlloc. CreateProcessInternalW: A low-level API call that is used to create a new process, We can set a breakpoint there and see the parameters passed to the API. School of Engineering and Computing Generic Unpacking Techniques (Self Injection) From the name we can guess that the malware will inject the malicious payload to its own process and then transfer the execution to the newly unpacked malicious code. Hands-on Self Injection https://youtu.be/zEk3mi4Pt_E?si=Kenq_UqEglAkZC-t School of Engineering and Computing Before Entry Point - TlsCallBack TLS (thread local storage) calls are subroutines that are executed before the entry point.