Forum Discussion
python-scripting-for-malware-analysis-ep-5-code-obfuscation
- 7 months ago
there are several steps you need to do.
- identify the block which you need to 'carve out' in binary
- then use routine #1 to process the data (tip: it's about swapping)
- then use routine #2 to further process the data (tip: it's about xor but not with the password pentioned in Q3)
- then use routine #3 to process the data (tip: it's about adding something to each byte)
and then I think you'll see it somewhere as string at the end of the output. xx.xxxxxxxx.tld
hope that helps.
there are several steps you need to do.
- identify the block which you need to 'carve out' in binary
- then use routine #1 to process the data (tip: it's about swapping)
- then use routine #2 to further process the data (tip: it's about xor but not with the password pentioned in Q3)
- then use routine #3 to process the data (tip: it's about adding something to each byte)
and then I think you'll see it somewhere as string at the end of the output. xx.xxxxxxxx.tld
hope that helps.
- RobN7 months ago
Bronze III
Thanks for this - this is what I've already tried.
I've done each step of the offered solution and done both xxd and strings on the data although I wasn't looking for .tld. I shall try it again tonight using that as a search value as I used 'http' 'ftp' and '://' as search values.
Thanks again.
- steven7 months ago
Silver II
naah.. there's no ftp, http, :, ://, ... ist just
ix.sixxwxxlxxxxxxx.xs (where x is [a-z]).- netcat7 months ago
Silver III
An URL would contain a scheme, but the lab questions often lack concise wording. The right advice was already given: Look for a host (ip address or fqdn).