Emulating Code In Radare2

More documents

Recommendations

Info

Current Applications For ESIL in Radare2 ● Emulate a block of code Code Emulation ● Used in real malware samples to decrypt Search Conditions Branch Prediction Assisted Debugging VM Emulation ● ● ● ● ● ● ● ● Evaluate an ESIL expression on every offset Useful for complex conditionals in exploiting Linear emulation: e asm.emu Catch data refs, conditional branch, reg calls.. Implements Software Watchpoints Step in every instruction and evaluate ESIL Fully emulates Baleful VM Can easily support Themida or ZeusVM
Current Applications For ESIL in Radare2 Code Analysis Decompilation ● ● ● ● a2f Used in real malware samples to decrypt Creates AST from ESIL Feeds the passes with info from r2 And More! ● ...
Page 1 and 2: Emulating Code In Radare2 pancake L
Page 3 and 4: Overview But it’s in fact way mor
Page 5 and 6: How To Solve All Those Problems? Ju
Page 7 and 8: Evaluable Strings Intermediate Lang
Page 9 and 10: How Does It Look? sub rsp, 0x648 16
Page 11: Other Translations Radeco is the ex
Page 15 and 16: Hooks ESIL API permits to hook on e
Page 17 and 18: Alternatives? Last Blackhat, the Ca
Page 19 and 20: Demo Time! e asm.emu=true cd radare

Emulating Code In Radare2

Create successful ePaper yourself

Delete template?

Save as template?