EntropyReducer algorithm is determined by BUFF_SIZE and NULL_BYTES values. The following is how would EntropyReducer organize your payload if BUFF_SIZE
was set to 4, and NULL_BYTES
to 2.
BUFF_SIZE
, if not, it pads it to be as so.BUFF_SIZE
chunk from the payload, and makes a linked list node for it, using the InitializePayloadList function, initializing the payload as a linked list.NULL_BYTES
, that will be used to lower the entropyObfuscate
function here.Obfuscation Algorithm
was serializing the linked list, the first thing that must be done here is to deserialize the obfuscated payload, generating a linked list from it, this step is done here in the Deobfuscate
function.BUFF_SIZE
and NULL_BYTES
. However, it can be determined using the following equationFinalSize = ((OriginalSize + BUFF_SIZE - OriginalSize % BUFF_SIZE ) / BUFF_SIZE) * (BUFF_SIZE + NULL_BYTES + sizeof(INT))
".ER"
file generated as an example of deserializing and deobfuscating it.All you have to do is add EntropyReducer.c and EntropyReducer.h files to your project, and call the Deobfuscate function. You can check PoC/main.c for reference.
In this example, BUFF_SIZE
was set to 3, and NULL_BYTES
to 1.
FC 48 83
)5.883
, view by pestudio.7.110
.7.210
4.093
Click to Open Code Editor