Due to a bug in Ghidra some people (me included) were having trouble analyzing the ShadowHammer setup.exe sample with Ghidra.
With the EditBytesScript.java you can fix/manipulate the PE header, then re-import the fixed sample into Ghidra via "Extract and Import ...".
NOTE: I hope this PE parsing bug gets fixed in Ghidra. However, you can still use the EditBytesScript.java to fix/manipulate corrupted PE headers, or also other fields of binaries.
Download
0 formats
No download links available.
Ghidra: EditBytesScript (to fix/manipulate PE header to load ShadowHammer setup.exe sample) | NatokHD