Skip to content

A Unicorn based emulator to deobfuscate Equation Group string XOR obfuscation

Notifications You must be signed in to change notification settings

gdbinit/unicorn_string_deobfuscator

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 

Repository files navigation

Unicorn String Deobfuscator

A Unicorn based emulator to deobfuscate Equation Group string XOR obfuscation used in many samples.

Instead of reversing the algo just ripped off the function and emulated it on Unicorn.

Just a simple demo on how to use Unicorn to easily emulate functions you don't want to reverse because you are too lazy or they are too annoying and you just want to execute them.

Requires Unicorn Engine (http://unicorn-engine.org).

Have fun, fG!

About

A Unicorn based emulator to deobfuscate Equation Group string XOR obfuscation

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages