Skip to content
Branch: master
Find file History
Latest commit 7de9dd8 Jun 6, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.
PINdemonium reorganize folders Apr 14, 2017
PINdemoniumPlugins reorganize folders Apr 14, 2017
PINdemoniumReport reorganize folders Apr 14, 2017
Scylla reorganize folders Apr 14, 2017
ScyllaDependencies reorganize folders Apr 14, 2017
ScyllaDumper reorganize folders Apr 14, 2017
ScyllaWrapper reorganize folders Apr 14, 2017
.gitignore reorganize folders Apr 14, 2017
AUTHORS reorganize folders Apr 14, 2017
LICENSE reorganize folders Apr 14, 2017
PinUnpacker.sln reorganize folders Apr 14, 2017 fix guide Jun 6, 2017




  1. Download the linked version of PIN

  2. Unzip PIN to the root directory and rename the folder to C:\pin

  3. Clone this repository

  4. Extract the archive in ScyllaDependencies/diStorm.rar into PINdemonium/Scylla/

  5. Extract the archive in ScyllaDependencies/tinyxml.rar into PINdemonium/Scylla/

  6. Extract the archive in ScyllaDependencies/WTL.rar into PINdemonium/Scylla/

  7. Open the file PinUnpacker.sln with Visual Studio 2010 ( NB: The version is mandatory )

  8. Copy the folders PINdemonium\PINdemoniumDependencies and PINdemonium\PINdemoniumResults in C:\pin\

  9. Be sure that you are compiling in Release mode

  10. Be sure that all the module inside the project are compiled using the platform toolset v100 ( you can see this with right click on the module -> Properties -> platform toolset field )

  11. Compile the solution

  12. Optional : Create a folder called PINdemoniumPlugins in C:\pin\

			   	|			              	\---config.json
			   	|					\---Yara
			   	|								\--yara_rules.yar
			   	|								\--rules
			   	|					\---Scylla
			   	|								\---ScyllaDLLRelease
			   	|									\---ScyllaDLLx86.dll
			   	|								\---ScyllaDLLDebug
			   	|									\---ScyllaDLLx86.dll
			   	|								\---ScyllaDumper.exe


  1. Run this command from the directory C:\pin\

    pin.exe -t PINdemonium.dll -antiev -antiev-sread -antiev-swrite -poly-patch -- <path_to_the_exe_to_be_instrumented>
  2. Check your result in C:\pin\PINdemoniumResults\< current_date_and_time >\

Plugin System

PINdemonium provides a plugin system in order to extend the functionalities of the IAT fixing module.

To write your own plugin you have to:

  1. Copy the sample project called PINdemoniumPluginTemplate located in PINdemonium\PINdemoniumPlugins\ wherever you want.

  2. Change the name of the project with a name of your choice

  3. Implement the function runPlugin

  4. Compile the project

  5. Copy the compiled Dll in C:\pin\PINdemoniumPlugins

  6. Launch PINdemonium with the flag plugin active followed by your plugin name (EX : -plugin PINdemoniumStolenAPIPlugin.dll)

Inside the template two helper function are provided:

  • readMemoryFromProcess : this function reads the memory from the specified process, at the specified address and copies the read bytes into a buffer

  • writeMemoryToProcess : this function writes the bytes contained inside a specified buffer into the process memory starting from a specified address

Yara Rules

Every time a dump is taken yara is invoked and the rules contained inside C:\pin\PINdemoniumDependencies\Yara\yara_rules.yar are checked. The current rule comes from - rules\evasion_packer : Try to identify antiVM/antiDebug techniques and the presence of a known packer - rules\malware: Try to identify the malware family of the unpacked stage


Config file located at C:\pin\PINdemoniumDependencies\config.json contains variables which allow to set the location of the outputs


Results are located at C:\pin\PINdemoniumResults\< current_date_and_time >\ and contains:

  • report_PINdemonium: Json file which contains the most important information about the unpacking process;
  • log_PINdemonium.txt: Log which contains useful debugging information

Report Structure

	//Array containing information for each dump
         "eip":4220719,         	 //EIP where the dump was taken     
         "start_address":4220439,	 //start address of the Write-set block
         "end_address":4221043,		 //end address of the Write-set block
            	//Yara Rules Heuristic
            	//Long Jump Heuristic
            	//Entropy Heuristic
            	//Jump Outer Section Heuristic
			//.... Imported functions....


This work has been possible thanks to:

  1. NtQuery/Scylla

  2. Yara-Rules/rules

  3. VirusTotal/yara

You can’t perform that action at this time.