Cyber security

FLOWER – A Novel Obfuscation Technique For Enhanced Cybersecurity

In the evolving landscape of cybersecurity, obfuscation plays a critical role in protecting against intrusive memory scans.

‘FLOWER’ emerges as a groundbreaking technique, offering a fresh approach to sleep obfuscation. Developed by bakki at sillywa.re, FLOWER leverages unique methods to queue the ropchain, enhancing compatibility and evading detection.

This article delves into the intricacies of FLOWER, exploring its implementation, versatility, and the strategic advantages it offers in the digital defense arsenal.

/*!
 *
 * FLOWER
 *
 * flowing sleep obfuscation 
 *
 * bakki - sillywa.re
 *
!*/

This is a primitive implementation of the technique I discuss in my blogpost

for any technical explanation, caveats or IOCs, do give it a read.

A version of this that does not rely on any external technique to queue the ropchain will be made available.

FLAGS

To showcase the compatibility of this technique, several flags are made available for the user

Techniques

Self explanatory, specifies which technique you wish to use to queue the ropchain

FLOWER_EKKO_OBF
FLOWER_FOLIAGE_OBF
FLOWER_ZILEAN_OBF

Zero

Freeing the old region means a copy of our shellcode is still there for as long as the old region does not get used.

Considering changing the protection back to RW has, at this time, no perceivable caveats stealth wise; I added the option to zero out the old region before freeing it.

FLOWER_ZERO_PROTECT

Jop

Using jump gadgets is nowadays the preferred way to evade the PATRIOT memory scanner which targets the research of both @C5pider and ilove2pwn_.

In simple terms, PATRIOT will check if the Rip field of a CONTEXT struct points to a *Protect function.

Since it doesn’t inspect non-volatile registers we can simply store the address of our function in a non-volatile register and point the Rip of the CONTEXT to an arbitrary gadget that jumps to said register.

//
// use the given register to store our function address
// we then execute it through a JMP gadget
//
FLOWER_GADGET_RAX
FLOWER_GADGET_RBX

Stackspoofing

Will conceal the instruction pointer (RtlUserThreadStart + 0x21) and stack of the beacon thread (Rsp pointing to an empty buffer)

FLOWER_STACKSPOOF

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

3 days ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

3 days ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

3 days ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

3 days ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

3 days ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

3 days ago