+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Help getting started on modifying python script (/showthread.php?tid=5905325)
Help getting started on modifying python script - l0rf - Nov 8, 2018
I was working on using a python script from the github repo rxwx/CVE-2018-0802, and after I attach and executable it, as I expected, is detected by antivirus. How should I begin analyzing and modifying the code to eventually start to make the code better at less detected?
Thanks
RE: Help getting started on modifying python script - FoxBlood - Nov 9, 2018
Encode the source code, and execute it, usually an anti-virus check the signature of the program, if there is any byte modified in source code, you get another signature. Other anti-virus create a virtual environment in memory and test the program.
RE: Help getting started on modifying python script - l0rf - Nov 9, 2018
(Nov 9, 2018 04:47 AM)FoxBlood Wrote: Encode the source code, and execute it, usually an anti-virus check the signature of the program, if there is any byte modified in source code, you get another signature. Other anti-virus create a virtual environment in memory and test the program.
What do you mean by encode the source code?
RE: Help getting started on modifying python script - Infamia - Nov 9, 2018
(Nov 9, 2018 06:42 AM)l0rf Wrote: What do you mean by encode the source code?
nothing intelligent.
antiviruses do both static analysis and dynamic analysis (during the process' runtime) of programs, in python's case, the AV will most likely signature the compiled bytecode, and/or perhaps do some form of call-graph analysis.
just change it around a bit, it might just be the way you're attaching it, pretty much no antiviruses actually implement analysis for python bytecode last i checked:
Quote:... and after I attach and executable it ...
are you freezing it to an executable? most EXE packing software creates a whole ton of false positives regardless of whether it is malware or not, perhaps the way you attach it is detected.