Posts

IPv4/v6 DeObfuscation In this post, we will examine how a network configuration function, which looks completely ordinary from the outside, is transformed into a shellcode decoder. Our goal is to understand the attacker’s mindset and design our defensive systems to catch these types of “normal-looking anomalies.” Note: You can find the entirety of the code explained in this text at malware-development-library Furthermore, once you establish the logic of this topic and examine the full version of the code, you can also construct DeObfuscation processes applied to other techniques. They are pretty much the same anyway; you only need to make a few modifications, that is all. ...

ChaCha20 Encryption In this post, I will talk about ChaCha20. Frankly, I thought about how to introduce the topic, but I couldn’t come up with a sensible introductory sentence. Therefore, I prefer to dive straight into the subject. File size and simplicity are everything. There is only one reason we prefer ChaCha20: it is compact, fast, and eliminates the need to write an extra decryption routine. So why do we choose ChaCha20? Because it is exceptionally fast, does not rely on dedicated CPU cryptographic hardware extensions (such as AES-NI), and is far less cumbersome to implement from scratch in C/C++. Furthermore, we use the exact same code for both encryption and decryption, which minimizes the overall stub size of the software. ...

IPv4/IPv6 Obfuscation In the world of cybersecurity, when we want to hide data, we generally have two fundamental paths ahead of us: we either encrypt the data directly (such as AES, RC4, or XOR) or we obfuscate it. When developing software, obfuscating the code sometimes plays a critical role not only in protecting intellectual property but also in bypassing security mechanisms. For example, suppose we have a shellcode and we want to hide it. Although encryption is the first solution that comes to mind, it might not always be the smartest route. This is because encrypted data causes the entropy (randomness rate) in that specific section of the file to skyrocket, and this situation immediately catches the radar of security analysts or AV/EDR solutions. At this point, obfuscating without drawing attention transforms into a much more logical alternative. ...

In the world of network security and cybersecurity, understanding how a packet is formed, how it can be manipulated, and how to craft custom packets is a crucial skill. The Python programming language and the Scapy library provide an excellent platform for learning these skills. In this post, I will detail step-by-step the fundamentals of creating and analyzing network packets using Scapy. 1. What is Scapy and Why is it Important? Scapy is a powerful network packet manipulation library written in Python. Essentially, it allows us to: ...