Conversation

namazso
@namazso
I still don't understand what's the point of these "releases". If you want to execute code without allocating executable memory just implement an interpreter. It's simpler, better, faster, less suspicious, and everyone is already doing it.
2
6
Bill Demirkapi
@BillDemirkapi
You believe packaging an entire interpreter in your application is more stealthy than abusing existing instructions through SEH? I am having trouble seeing how an interpreter would be "simpler" or "less suspicious". Got any public examples?
2
1
Bill Demirkapi
@BillDemirkapi
I think the big difference here is that packaging an entire interpreter is significantly more vulnerable to common AV techniques like signature scanning. Detecting that a program contains exception handlers is easy, but how would you detect a malicious EOP exception handler?
1
namazso
@namazso
how would you signature scan such a thing? most simple interpreters like PawnPP (minus the loader which can be replaced) is nothing but arithmetic heavy code. You can simply apply a pass of obfuscator-llvm and it will be wildly different each time. or just change compiler flags.
1
Bookmark