diff --git a/README.md b/README.md
index 62b6163..9d8573e 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ RedSiege came to the following wrong result:
| No Obfuscation | 27 |
-But didnt bother to question the data. There are many issues with it:
+But didnt attempt to question the data. There are some issues with it:
* Why are the top three Base64, UUID, and reverse hex string? Especially the later is very obscure
* No negative test (without malicious shellcode)
@@ -50,8 +50,8 @@ But didnt bother to question the data. There are many issues with it:
* As they store the shellcode in a variable, static analysis tools can try out their deobfuscation on all the variables (explains high detection of ReverseString and Base64)
* Scans performed with large intervals between them (weeks?)
-Which means that the test has been performed wrong, and the results are invalid.
-Any conclusion based on the data is also invalid - and building [trainings](https://redsiege.com/training-av-edr-evasion/) on it distributes the misinformation.
+Which means that the test has been performed wrong, and the results are invalid,
+and conclusions based on the data are misleading.
Luckily RedSiege published the [shellcode encoder sources](https://github.com/RedSiege/Chromatophore).
I made this framework based on it to test it for myself.
@@ -77,24 +77,24 @@ Conclusion:
| **What** | **Library** | **Includes** | **Function / IAT** | **Random** | **Metasploit** |
| ------------------ | --------------------- | ------------------------- | ---------------------------------- | ---------- | -------------- |
-| aes | crypt32.lib, advapi32 | wincrypt.h | Crypt\* | **5** | **6** |
-| base64 | \- | \- | \- | 3 | 3 |
-| base64api | crypt32.lib | wincrypt.h | CryptStringToBinaryA | **5** | **6** |
-| bin2ip | Ntdll.lib | ntstatus.h
Ip2string.h | RtlIpv4StringToAddressA | **8** | **10** |
-| bin2mac | Ntdll.lib | ntstatus.h
Ip2string.h | RtlEthernetStringToAddressA | **8** | **18** |
-| cesar | \- | \- | \- | 2 | 2 |
-| jargon | \- | \- | \- | 3 | 2 |
-| jigsaw | \- | \- | \- | 2 | 3 |
-| offset | \- | \- | \- | 2 | 3 |
-| rc4api | \- | \- | GetProcAddress (SystemFunction033) | 2 | 2 |
-| reverse_byte_order | \- | \- | \- | 2 | 2 |
-| reverse_hex_string | \- | \- | \- | 2 | 2 |
-| twoarray | \- | \- | \- | 2 | 3 |
-| uuidapi | rpcrt4.lib | rpc.h | UuidFromStringA | **8** | **11** |
-| xor_multibyte | \- | \- | \- | 1 | 2 |
-| xor_reverse | \- | \- | \- | 2 | 3 |
-| xor_single | \- | \- | \- | 1 | 3 |
-| **NO OBFUSCATION** | \- | \- | \- | 2 | 3 |
+| [aes](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/aes_work.c) | crypt32.lib, advapi32 | wincrypt.h | Crypt\* | **5** | **6** |
+| [base64](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/base64_work.c) | \- | \- | \- | 3 | 3 |
+| [base64api](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/base64api_work.c) | crypt32.lib | wincrypt.h | CryptStringToBinaryA | **5** | **6** |
+| [bin2ip](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/bin2ip_work.c) | Ntdll.lib | ntstatus.h
Ip2string.h | RtlIpv4StringToAddressA | **8** | **10** |
+| [bin2mac](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/bin2mac_work.c) | Ntdll.lib | ntstatus.h
Ip2string.h | RtlEthernetStringToAddressA | **8** | **18** |
+| [caesar](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/caesar_work.c) | \- | \- | \- | 2 | 2 |
+| [jargon](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/jargon_work.c) | \- | \- | \- | 3 | 2 |
+| [jigsaw](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/jigsaw_work.c) | \- | \- | \- | 2 | 3 |
+| [offset](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/offset_work.c) | \- | \- | \- | 2 | 3 |
+| [rc4api](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/rc4api_work.c) | \- | \- | GetProcAddress (SystemFunction033) | 2 | 2 |
+| [reverse_byte_order](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/reverse_byte_order_work.c) | \- | \- | \- | 2 | 2 |
+| [reverse_hex_string](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/reverse_hex_string_work.c) | \- | \- | \- | 2 | 2 |
+| [twoarray](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/twoarray_work.c) | \- | \- | \- | 2 | 3 |
+| [uuidapi](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/uuidapi_work.c) | rpcrt4.lib | rpc.h | UuidFromStringA | **8** | **11** |
+| [xor_multibyte](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/xor_multibyte_work.c) | \- | \- | \- | 1 | 2 |
+| [xor_reverse](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/xor_reverse_work.c) | \- | \- | \- | 2 | 3 |
+| [xor_single](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/xor_single_work.c) | \- | \- | \- | 1 | 3 |
+| [**NO OBFUSCATION**](https://github.com/dobin/ShellcodeObfuscationLab/blob/main/lab_results/metasploit/noobfuscation_work.c) | \- | \- | \- | 2 | 3 |
The results of the test are at [lab_results/](https://github.com/dobin/ShellcodeObfuscationLab/tree/main/lab_results).