New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Generic plugin - Unpacker #181

Open

gheorghitamutu opened this issue Jun 28, 2023 · 2 comments · Fixed by #338

Assignees

Labels

Collaborator

gheorghitamutu commented Jun 28, 2023

We need a generic plugin that unpacks (a buffer, binary, file, etc) and opens it in a new window (with the possibility of dropping on disk the unpacked data).

gheorghitamutu self-assigned this

Collaborator Author

gheorghitamutu commented Jun 28, 2023 •

edited

Loading

Examples:

aplib / M8Z
AutoIT Decompiler
- https://research.checkpoint.com/2020/how-to-de-obfuscate-a-huge-autoit-script-in-less-than-two-minutes
- http://domoticx.com/autoit3-decompiler-exe2aut (Exe2Aut might cause malicious scripts to get executed. Although this is unlikely to happen, we strongly advise you to always run Exe2Aut within a virtual environment.)
- https://github.com/fossabot/myAut2Exe
- https://github.com/nazywam/AutoIt-Ripper (along with AutoIT version comparison)
- https://blog.talosintelligence.com/get-a-loda-this
- https://www.trendmicro.com/en_us/research/18/k/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor.html (using HIEW)
- https://r3mrum.wordpress.com/2017/07/10/autoit-malware-from-compiled-binary-to-plain-text-script
- https://labs.vipre.com/autoit-script-containing-nanocore-rat-found-in-fake-hr-spam-email
- https://doc.malcat.fr/ui/views/decompiler.html
- https://lifeinhex.com/deobfuscating-autoit-scripts/
Base64 Decoder (and maybe more?)
LZMA
LZMAT
NSIS
ZLIB
Py2Exe extractor
LZXPRESS (prefetch)

gheorghitamutu assigned Cosmin765

Collaborator Author

gheorghitamutu commented Apr 4, 2024 •

edited

Loading

An initial Base64 implementation has been created in #192.

gheorghitamutu added the Enhancement label

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add dummy interface for Dropper generic plugin #182 #181

556bc9a

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add dummy integration for Dropper with a special strings …

de9af75

…mini plugin - ip address #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + expose/export ZonesList structure while hiding it's templ…

00907c0

…ate based implementation based on std::vector #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add regexes for IP Address mini-plugin for Dropper #182 #181

cae4df7



Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add dummy integration for Dropper with an executables min…

cbd5b72

…i plugin - MZPE #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + start iteration for Dropper mini plugins #182 #181

9d536ad

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + fix Dropper MZPE mini plugin #182 #181

2029f47

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add dummy integration for Dropper with a multimedia mini …

de14263

…plugin - PNG #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + finish integration for Dropper with a multimedia mini plu…

552a2ef

…gin - PNG #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add log file for Dropper #182 #181

7bdea9d

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + handle selected zones in Dropper #182 #181

532ded0

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + finish integration for Dropper with a special strings min…

fae15d9

…i plugin - IP Address (via regex for now) #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + finish artefact dumping for Dropper (single file & file/o…

8dd80d9

…bject) #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] # fix unicode regex issue #182 #181

e5b251a

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] ^ update AppCUI #182 #181

320732f

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + replace std::regex with re2 #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] # fix Dropper MZPE plugin size computation #182 #181

107da6e

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add email address plugin to Dropper #182 #181

f9fa077

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add filepath plugin for Dropper #182 #181

77717ba

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add summary & progress status #182 #181

40b81d9

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] # fix cache performance for Dropper plugin usage #182 #181

5334c74

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add URL mini-plugin for Dropper #182 #181

24dd351

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add Wallet mini-plugin for Dropper #182 #181

17cd639

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add Registry mini-plugin for Dropper #182 #181

bb2e1c7

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add Text mini-plugin for Dropper #182 #181

ce3cb6c

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu mentioned this issue

[Utils] Cache performance issues - optimize reads operation #291

Open

gheorghitamutu added a commit that referenced this issue


          [Dropper] + highlight objects in buffer viewer (1) #182 #181

440478e

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + highlight objects in buffer viewer (2) #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + replace regex in text plugin and ad html objects mini-plu…

2940e40

…gins for Dropper #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] # fix next offset computation for Dropper #182 #181

1a99f4e

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add Dropper UI stub (tab pages) #182 #181

8d43dd8

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + add Dropper UI selection radio boxes and start binary tab…

cc10b16

… page #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + finish Dropper UI binary tab page interface (only) #182 #181

aacd9ff



Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + finish Dropper UI binary tab page interface (backend) #182 …

6ec38d3

…#181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI objects tab page fronted (wip) #182 #…

b916c81

…181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI objects tab page frontend (done) #182 …

586e542

…#181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI objects tab page backend #182 #181

91e3f6f

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI strings tab page frontend (without s…

c5cd156

…uspicious artefacts dialog) #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI strings tab page backend (without su…

5f7667f

…spicious artefacts identification) #182 #181

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] + implement Dropper UI strings tab page (done) #182 #181

3912cbc

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] +- remove old DropperStrings #182, rename Unpackers to Unpa…

090a87e

…cker #181, add stub for entropy visualization #310

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Unpacker] # fix build #181

2c96456

Signed-off-by: Gheorghita Mutu <gheorghitamutu@gmail.com>

gheorghitamutu added a commit that referenced this issue


          [Dropper] # fix osx build #182 #181

f03dbbd

gheorghitamutu linked a pull request

that will close this issue

181 generic plugin unpacker #338

Merged

gheorghitamutu closed this as completed in #338

gheorghitamutu reopened this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment