search

senzee1984 / InflativeLoading

Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.
266 stars 57 forks source link

Polymorphic engine #3

Open Beykir opened 5 months ago

Beykir commented 5 months ago

Hello,

first of all, you have a nice and interesting project here. I have tested it with different calc.exe shellcodes, and the calculator always popped up. My testing also included using the original donut shellcode generator, and I noticed that there are some edrs that detect donut generated shellcodes with a yara rule or something. My guess as to why the shell code generated by InflativeLoading is not detected is that the donut is a lot more widely known. So maybe you can add some sort of polymorphism like https://github.com/cryptolok/MorphAES or Shikata ga nai encoding.

senzee1984 commented 4 months ago

Hi Bekyir, InflativeLoading has some built-in obfuscation. But, of course, the detection is a matter of sooner or later. Thanks for sharing the project, I will take a look at it.