9A 69 E8 C8 C2 CD C3
generates instructions that decode correctly at every bytes, independantly of the following bytes...
9A 69E8C8C2CDC3 callf 0C3CD:0C2C8E86969 E8C8C2CDC3 imul ebp,eax,0C3CDC2C8E8 C8C2CDC3 call 0C40E0C36C8 C2CDC3 enter 0CDC2,0C3C2 CDC3 retn 0C3CDCD C3 int 0C3C3 retn
sadly the 69 imul doesn't always decode that way, it's not a generic 5 bytes cloaker.
Posts
No comments:
Post a Comment