In the previous chapter, we covered polymorphism and how changing a few bytes can evade signature detection. We didn't, however, try to change the whole program so that all the signature detection that was performed by our Python script was bypassed. Therefore, in this chapter, we'll analyze a fully polymorphed version of our reverse shell binary and compare and contrast it to the original version. We'll return to our trusted analysis methodology in this chapter.
In this chapter, we will cover the following recipes:
- Automating the initial phases
- Performing static analysis
- Using EDB for dynamic analysis
- Analyzing deobfuscation loops
- Wrapping up dynamic analysis