Comments (8)
Before answering, I'd like to mention this project has not been updated for so long; it might have some errors.
Do you mean you want to analyze the assembly code to see what it actually does, or do you mean how to test the PoC if it works?
from zsc.
Before answering, I'd like to mention this project has not been updated for so long; it might have some errors.
Do you mean you want to analyze the assembly code to see what it actually does, or do you mean how to test the PoC if it works?
Thanks for your warm reply. What I want to say is how do we make sure that the functions of the code before and after the code obfuscation are the same?
from zsc.
Before answering, I'd like to mention this project has not been updated for so long; it might have some errors.
Do you mean you want to analyze the assembly code to see what it actually does, or do you mean how to test the PoC if it works?Thanks for your warm reply. What I want to say is how do we make sure that the functions of the code before and after the code obfuscation are the same?
by understanding how the obfuscation process takes place, and then going in reverse order.
from zsc.
by understanding how the obfuscation process takes place, and then going in reverse order
Do you know any general theorems or open materials to independently prove this?
from zsc.
reverse order
'in reverse order' ,what does this mean? Can you explain more details to me about it?
from zsc.
Sorry for my late answer;
@taylorgag yes, code functionality is the same after and before obfuscation;
there are a few modules that obfuscate the shellcode, it takes the hex values and recalculates them in some random ways. for example if the value is 100
, then 50+50
, 110-10
, 25*4
, 300/3
are the same thing, right? so when it calculates the values for example syscall "exec" is 0x100
or whatever, it will just change the value in a way it's just mention to it indirectly.
here is an old blog post it explains a little bit about this; https://web.archive.org/web/20161012002249/http://www.z3r0d4y.com/2015/05/zcr-shellcoder-review-and-analysis_20.html
and here is also a blog post help you to analysis a shellcode;
let me know if you have more questions.
from zsc.
Sorry for my late answer;
@taylorgag yes, code functionality is the same after and before obfuscation;
there are a few modules that obfuscate the shellcode, it takes the hex values and recalculates them in some random ways. for example if the value is
100
, then50+50
,110-10
,25*4
,300/3
are the same thing, right? so when it calculates the values for example syscall "exec" is0x100
or whatever, it will just change the value in a way it's just mention to it indirectly.here is an old blog post it explains a little bit about this; https://web.archive.org/web/20161012002249/http://www.z3r0d4y.com/2015/05/zcr-shellcoder-review-and-analysis_20.html
and here is also a blog post help you to analysis a shellcode;
let me know if you have more questions.
Thanks for your warm reply. In fact, I am now doing a new language obfuscation, and then I need to prove that the functionality of the code before and after the obfuscation is same before I can proceed with the next experiment.
from zsc.
you can create functionality to deobfuscate the code and compare it with the original one maybe...
from zsc.
Related Issues (20)
- obfuscate: no validation on file type HOT 1
- --show-payloads turns my terminal green HOT 7
- No tab completion when calling ZSC from different directory HOT 3
- shell-storm download mangles quotes HOT 2
- shell-storm search changes contexts HOT 1
- Confusing addition to `help` command HOT 3
- Implement continuous integration with travis HOT 1
- After one has choosen obfuscate and then the language there is no way to go back to change language HOT 1
- OWASP Code Sprint 2017 HOT 1
- issue in php encoders HOT 1
- Update fails HOT 12
- It is impossible to exit/quit/back in shellcode download menu. HOT 1
- Obfuscate other sources code? HOT 1
- can close
- how to obfuscate with this? HOT 1
- ZSC made nothing HOT 5
- output shellcode file not showing the shellcode after obfuscate method
- compiling HOT 4
- Can not update
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zsc.