mirror of
https://github.com/vxunderground/VXUG-Papers.git
synced 2024-06-20 13:58:10 +00:00
Add files via upload
This commit is contained in:
parent
a6dbe47b59
commit
ff8a5c6f3d
105
Mocoh Polymorphic Engine.asm
Normal file
105
Mocoh Polymorphic Engine.asm
Normal file
@ -0,0 +1,105 @@
|
|||||||
|
; .__
|
||||||
|
; _____ ____ ____ ____ | |__
|
||||||
|
; / \ / _ \_/ ___\/ _ \| | \ Poly Engine
|
||||||
|
;| Y Y ( <_> ) \__( <_> ) Y \
|
||||||
|
;|__|_| /\____/ \___ >____/|___| /
|
||||||
|
; \/ \/ \/
|
||||||
|
;
|
||||||
|
; [+] Simple Polymorphic PoC (code and decrypt routine)
|
||||||
|
; [+] 1byte XOR random key
|
||||||
|
; [+] The engine can change the key, and some instructions (code and order)
|
||||||
|
; [+] This is not new, not advanced... Just for education purposes
|
||||||
|
;
|
||||||
|
; By: SWaNk 2019 - Back in business, VX forever!
|
||||||
|
;
|
||||||
|
;https://pt.wikipedia.org/wiki/Mocó (Kerodon rupestris)
|
||||||
|
|
||||||
|
format PE GUI 4.0
|
||||||
|
entry start
|
||||||
|
|
||||||
|
include "%include%/win32a.inc"
|
||||||
|
|
||||||
|
; This is the poly encryption macro (1 byte xor).
|
||||||
|
; It is a simple XOR random 0x00 to 0xFF at compilation time.
|
||||||
|
;This is just a example how this can be done... Use your imagination to improve
|
||||||
|
|
||||||
|
macro encrypt dstart,dsize {
|
||||||
|
local ..char
|
||||||
|
|
||||||
|
key = %t and 0xff
|
||||||
|
|
||||||
|
repeat dsize
|
||||||
|
load ..char from dstart+%-1
|
||||||
|
..char = ..char xor key
|
||||||
|
store ..char at dstart+%-1
|
||||||
|
end repeat
|
||||||
|
}
|
||||||
|
|
||||||
|
;The idea was to create a didactic macro. this guy will split the 1 byte range in 2 (0xff / 2 = 0x7f)
|
||||||
|
;
|
||||||
|
;If the pseudo random key is bigger than 0x7f, edx will receive the real_start then ecx will receive
|
||||||
|
;the code_size. if the key is smaller than 0x7f, the order chage
|
||||||
|
;
|
||||||
|
;If the pseudo random key is bigger than 0x7f, the increase of edx will be made with "inc edx" otherwise
|
||||||
|
;with "add edx, 1"
|
||||||
|
|
||||||
|
macro simplePoly {
|
||||||
|
if key > 0x7f
|
||||||
|
mov edx,real_start
|
||||||
|
mov ecx,code_size
|
||||||
|
else
|
||||||
|
mov ecx,code_size
|
||||||
|
mov edx,real_start
|
||||||
|
end if
|
||||||
|
|
||||||
|
@@: xor byte [edx],key
|
||||||
|
|
||||||
|
if key > 0x7f
|
||||||
|
inc edx
|
||||||
|
else
|
||||||
|
add edx,1
|
||||||
|
end if
|
||||||
|
|
||||||
|
loop @B
|
||||||
|
}
|
||||||
|
|
||||||
|
;this macro will generate this instructions starting at the entry point
|
||||||
|
|
||||||
|
; mov edx,mocoh.401010 | The order of this instructions
|
||||||
|
; mov ecx,1C | can change
|
||||||
|
|
||||||
|
; xor byte ptr ds:[edx],F4 | The key will change (this case is F4)
|
||||||
|
; inc edx | This can change to "add edx, 1"
|
||||||
|
; loop mocoh.40100A
|
||||||
|
|
||||||
|
;============================================================
|
||||||
|
section ".code" code readable writeable
|
||||||
|
;============================================================
|
||||||
|
start:
|
||||||
|
|
||||||
|
simplePoly
|
||||||
|
|
||||||
|
real_start:
|
||||||
|
|
||||||
|
; Add your code here, start of encrypted code
|
||||||
|
|
||||||
|
stdcall [MessageBox],0,msg,title,MB_ICONASTERISK
|
||||||
|
stdcall [ExitProcess],0
|
||||||
|
|
||||||
|
; end of encrypted code
|
||||||
|
|
||||||
|
|
||||||
|
display "Encrypting this shit... "
|
||||||
|
code_size = $ - real_start
|
||||||
|
encrypt real_start,code_size
|
||||||
|
display "done",13,10
|
||||||
|
|
||||||
|
;============================================================
|
||||||
|
section ".data" data readable writeable import
|
||||||
|
;============================================================
|
||||||
|
library kernel32,"kernel32.dll",user32,"user32.dll"
|
||||||
|
include "%include%/api/kernel32.inc"
|
||||||
|
include "%include%/api/user32.inc"
|
||||||
|
|
||||||
|
title db "SWaNk 2019",0
|
||||||
|
msg db "compile 2 times and compare the hashes and decryption instruction bitches!",0
|
Loading…
Reference in New Issue
Block a user