
Interesting Technique to Launch a Shellcode
In most attack scenarios, attackers have to perform a crucial operation: to load a shellcode in memory and execute it. This is often performed in a three-step process: Some memory must be allocated and flagged as “executable” with VirtualAlloc() (and sometimes combined with VirtualProtect()) The shellcode (often deobfuscated) is copied into this newly…