Deobfuscating malware samples using scripts
In the previous chapter, we showed how Alina injects shellcode into the explorer.exe process. We analyzed this by simply reading the strings, which is a quick, practical approach, but we can be more accurate in our analysis. Let's focus on some shellcode details.
The delta offset
When injecting code, it is placed in a position that is unknown at development time. As a consequence, the data cannot be accessed by using absolute addresses; instead, it must be accessed via relative positions. The shellcode retrieves the current address at runtime. In other words, it retrieves the EIP register.
The purpose of the EIP register in x86 architecture (32-bit) is to point to the next instruction to execute; so, it controls the flow of a program. It determines the next instruction to execute.
But, as the EIP register is controlled implicitly (by control-transfer instructions, interruptions, and exceptions), it cannot be accessed directly...
