search

mgeeky / ShellcodeFluctuation

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents
MIT License
921 stars 154 forks source link

What am I missing? #5

Open cookpoo78 opened 1 year ago

cookpoo78 commented 1 year ago

I wanted to observe the protection permission requests, I expected to see intermittently calls to RW & RX, but the actual requests were RWX & RX instead:

image

Why is it happening? shouldn't I see calls that revoke the X permissions also? like NtVirtualProtect(...RW...)

Also, I think it's missing some steps:

image