Question Shift-Attack about secml_malware HOT 4 CLOSED

Hi!

There is no "shuffling" of the sections: the shift attack makes space between the PE header and the first section.
In theory, you can shuffle them by messing with the offset contained in the various section entries.
you can find all the info inside the paper
We wrote every details of the algorithm there 👍

Thank you for your interest!!!

from secml_malware.

Thank you very much for the quick answer!

Am I right in assuming that this space is generated the same way as in the extend-attack (by moving the offset which points to the section backwards and inserting the payload to keep the file structure intact)?

from secml_malware.

Exactly, but the content is added in different locations.
Extend exploits the ambiguity posed by the PE offset, Shift exploits the section entry physical offset.

from secml_malware.

Thank you a lot for your help!!

from secml_malware.