Publication

RE tip of the day: To store the unpacked payload, malware needs memory space. It can allocate a new region with WinAPIs like VirtualAlloc or reuse an existing one. Some packers use the section table to create an empty section. #infosec #cybersecurity #malware #reverseengineering

@re_and_more Handy follow-up: after the allocation, watch for VirtualProtect flipping the region to RWX, or a jump into a section that was never executable on disk. Breaking right after that change usually lands you near the OEP.