Back to Browse

Ghidra: EditBytesScript (to fix/manipulate PE header to load ShadowHammer setup.exe sample)

2.6K views
Apr 9, 2019
3:23

Due to a bug in Ghidra some people (me included) were having trouble analyzing the ShadowHammer setup.exe sample with Ghidra. With the EditBytesScript.java you can fix/manipulate the PE header, then re-import the fixed sample into Ghidra via "Extract and Import ...". NOTE: I hope this PE parsing bug gets fixed in Ghidra. However, you can still use the EditBytesScript.java to fix/manipulate corrupted PE headers, or also other fields of binaries.

Download

0 formats

No download links available.

Ghidra: EditBytesScript (to fix/manipulate PE header to load ShadowHammer setup.exe sample) | NatokHD