Writing an unpacker for a 3-stage stub with emulation via speakeasy
Emulation is an awesome technique for writing static unpackers that are robust to changes in the unpacking stub. We will be writing an unpacker for PEUnion.
Final script: https://github.com/struppigel/hedgeho...
Speakeasy: https://github.com/mandiant/speakeasy
PEUnion: https://github.com/bytecode77/pe-union
Malware analysis courses: https://malwareanalysis-for-hedgehogs...
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: / struppigel
#emulation #unpacking #malwareanalysis #reverseengineering #malwareanalysis
00:00 Advantages of emulation
01:09 How the unpacking stub works
02:28 Creating the packed file with PEUnion
05:01 Writing a basic Speakeasy script
12:36 Figuring out why it detects emulation
16:33 Defeating emulation detection with hooking
19:49 Dumping the emulators memory
21:51 Hooking VirtualProtect to dump stage 2
27:39 Dumping the exact payload