[Merkuri]

I found this in my files. It's polymorphic crypter on C++. Very well explain source code.

Code:

https://anonfiles.com/file/1c7dbad04cb707726decfb03a15b51e0

[w00t]

Isn't polymorphic, it doesn't change each load. There's a difference between a random cryptokey and polymorphism, and it's huge.

[Merkuri]

Have you check the engine.cpp file ?

[w00t]

Yes, and the actual encryption on the file i very good because of it. But the stub doesn't have any of the engine incorporated into it, so it's just a well encrypted file.

[Merkuri]

Yes, and the actual encryption on the file i very good because of it. But the stub doesn't have any of the engine incorporated into it, so it's just a well encrypted file.

Crypter = encrypting files ? You may don't understand why I have share this. Basic this is a very good explained poly. code this isn't for using it but to get the idea, also this isn't crypter for malicious application/

[w00t]

Yes, "crypters" is a colloquial name for a PE file encryption program.

As I said, this isn't polymorphic, the actual stub doesn't change each load, it's just an obfuscator and encryptor rolled into one.

[Merkuri]

Code:

== What do it does? == smi²le will disassemble a block of code into a list of opcode information. Using that list the engine can: +add trash/junk code +add random jmps to code +mutate instructions When reassembling, the instructions are written to a buffer in random(ish) offsets and linked together with jmps

You may want to read the beginning of the engine.cpp, each load the code will add random jumps etc.. (the list is above), I hope that you don't think that poly. is writing an new unique code each load like new program loaded.

[w00t]

It does that each encryption. The stub does not have any calls to the engine.

[Ultimatum]

Checked. Ain't polymorphic. Yes it's encrypted, but ain't polymorphic. w00t beat me here, but the code doesn't change on each execution, only the key which encrypts the file.

[Merkuri]

Stup.cpp is manipulated in main.cpp by engine.cpp, engine.cpp add random jumps (asm) and trash code. The main operation was on ASM (I think not 100% sure) I can't say it in more pure way.