The Hidden ART Of Rolling Shellcode Decryption
summary
Kong Loader implements rolling decryption: a vectored-exception, hardware-breakpoint loader that decrypts, executes, and re-encrypts one instruction at a time. A tiny disassembler intercepts calls to Windows APIs so only ~2,000 breakpoints are needed versus ~13 million for VoidGate on a hello world, and complex C2 beacons still launch in ~30 seconds. Multithreading is handled by duplicating encrypted pages per thread. Prototype runs MSFvenom and Nant C2 payloads without Microsoft Defender detection.
AI-written summary · about
chapters (14)
- 0:00Introduction and motivation
- 3:36Shellcode basics and loading
- 8:16Limitations of sleep masks
- 10:21Rolling decryption concept
- 13:28Implementation with SEH
- 14:52Comparison with VoidGate
- 16:59Optimizing breakpoint handling
- 18:50Handling fake encryption states
- 21:15Multi-threaded shellcode challenges
- 22:42Performance and detection caveats
- 25:14Defensive detection strategies
- 26:39Future improvements and FTMs
- 27:21Live demonstrations
- 29:30Conclusion and resources
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
25mCommSec D1 - A Deep Dive Into Malicious Documents
50m.NET Reversing and Exploitation for Cool Kids
50mWrite Once, Pwn Anywhere
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
51mSneaking Past Device Guard
57mReturn Oriented Programming, an introduction