Navigating the maze of binary obfuscation? Meet the “Donut-Decryptor”, a tool tailored to decode the elusive Donut obfuscation. Dive in to unravel its capabilities and bring clarity to concealed code.
Beyond mere decryption, it’s a spotlight in the shadowy corridors of cybersecurity. A must-have for those battling coded enigmas.
A configuration and module extractor for the donut binary obfuscator.
donut-decryptor checks file(s) for known signatures of the donut obfuscator’s loader shellcode.
If located, it will parse the shellcode to locate, decrypt, and extract the DONUT_INSTANCE structure embedded in the binary, and report pertinent configuration data.
If a DONUT_MODULE is present in the binary it is decrypted and dumped to disk.
donut-decryptor currently requires the separate installation of the chaskey-lts module.
You can install donut-decryptor for usage by navigating to the root directory of the project and using pip:
cd /path/to/donut-decryptor
python -m pip install .Following installation, a command-line script is available. For usage instructions use:
donut-decryptor --helpThe files present in the samples directory are 7z files password protected using the password `infected“, all of which contain donuts which can be decoded using this script.
BypassAV refers to the collection of techniques and tools used to bypass antivirus (AV) and…
ComDotNetExploit is a Proof of Concept (PoC) tool designed to demonstrate the exploitation of Windows…
Trigon is a sophisticated deterministic kernel exploit targeting Apple’s iOS devices, leveraging the CVE-2023-32434 vulnerability.…
Bug bounty report templates are essential tools for streamlining the process of documenting vulnerabilities. They…
FullBypass is a tool designed to circumvent Microsoft's Antimalware Scan Interface (AMSI) and PowerShell's Constrained…
Carseat is a Python-based tool that replicates the functionality of the well-known security auditing tool,…