Plugin focus: SK3wldbg

This is a guest entry written by Chris Eagle. His views and opinions are his own and not those of Hex-Rays. Any technical or maintenance issues regarding the code herein should be directed to the author.

The SK3wldbg Plugin

When I first started analyzing obfuscated code, I quite often wished that I could simply de-obfuscate the code within IDA without the need to run the code under debugger control, capture modified memory regions, and finally copy the modified blocks back …

author capture chris code control copy debugger eagle entry focus hex hex-rays ida malware analysis memory obfuscated opinions own plugin run technical under