Главная
Study mode:
on
1
Introduction
2
ROPInjector
3
Objectives
4
Detection
5
Why use ROP
6
Borel code
7
Overview
8
Encryption
9
Static Analysis
10
Challenges
11
Steps
12
CellCode Analysis
13
CellCode Transformation
14
Intermediate Representation Layer
15
OnetoOne Mapping
16
Missing Gadget Example
17
Final Steps
18
Code Run
19
Evaluation
20
Results
21
Outcome
22
Questions
23
Conclusion
Description:
Explore advanced techniques for polymorphism and antivirus evasion using Return Oriented Programming (ROP) in this Black Hat conference talk. Dive into the innovative ROPInjector tool, which transforms shellcode into its ROP equivalent and injects it into non-packed 32-bit Portable Executable (PE) files. Learn about the limitations of current polymorphism methods and how ROP overcomes them by avoiding the need for writeable code sections. Discover the algorithms developed for x86 instruction set analysis and manipulation, and see a demonstration of the ROPInjector tool in action. Examine the evaluation results showing near-complete evasion of antivirus software on VirusTotal. Gain insights into topics such as Borel code, static analysis challenges, CellCode analysis and transformation, and the intermediate representation layer used in the process.

ROPInjector - Using Return Oriented Programming for Polymorphism and Antivirus Evasion

Black Hat
Add to list
0:00 / 0:00