Live Stream VOD: Guloader ( Part 4 ) Deobfuscation (Patreon)

In this twitch stream we take a fourth look at Guloader and finally fully deobfuscate the control flow (VEH redirect) and write a simple string decryptor.

This stream is sort of a wrap up of all the previous streams, we fully fix the control flow obfuscation and use an IDA plugin to removed the VEH redirection. We also write a simple Unicorn emulator script to handle the constant-unfolded-data used to build the encrypted strings.

Sample

E3A8356689B97653261EA6B75CA911BC65F523025F15649E87B1AEF0071AE107

Notes

Guloader - VEH Program Flow Redirection