I hereby claim:
- I am g-les on github.
- I am glesnewich (https://keybase.io/glesnewich) on keybase.
- I have a public key ASC1pkCbjKDRmT41uYt-kT0-3i4YkwNvWM5PUPNx__axaQo
To claim this, I am signing this object:
bv.navigate(bv.view, bv.get_next_data_var_start_after(here)) |
rule donut_shellcode_fixed | |
{ | |
meta: | |
description = "Tested against shellcodes x86/x64 generated by Donut v0.9.3" | |
author = "Telsy CTI team" | |
date = "18/11/2021" | |
condition: | |
uint8(0) == 0xe8 and // shellcode starts with a call | |
uint32(1) == uint32(5) and | |
// xor generator key and xor initial key cannot be null it is 32 bytes |
I hereby claim:
To claim this, I am signing this object:
/* | |
Goals for #100DaysofYARA: | |
better understanding of bitwise operators | |
use math module beyond general entropy of a section / resource | |
position specific things beyond what PE module tells us | |
do some funky stuff with hashing | |
*/ |