Live Stream VOD: Emotet Deobfuscation Part 4 - IDA Python Binary Patching (Patreon)

In this Twitch stream we create a binary patching script using IDA Python to patch our obfuscated Emotet sample.

In the end we determine that directly patching the end of each state is not going to work since the flags we rely on may change within the state. Our workaround is to save the flags which gives us a complete solution but it still doesn't look great for the analyst. We need another solution.... 

Sample: c7574aac7583a5bdc446f813b8e347a768a9f4af858404371eae82ad2d136a01

Sample Unpacked (this is the one we use in the stream): eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827

Rough notes (with code): Emotet Deobfuscation Generic Solution