+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: C, C++, & Obj-C (https://sinister.li/Forum-C-C-Obj-C)
+--- Thread: Polymorphic crypter (/Thread-Polymorphic-crypter)
Pages:
1
2
Polymorphic crypter - Merkuri - 03-11-2013
I found this in my files. It's polymorphic crypter on C++. Very well explain source code.
Code:
https://anonfiles.com/file/1c7dbad04cb707726decfb03a15b51e0RE: Polymorphic crypter - w00t - 03-11-2013
Isn't polymorphic, it doesn't change each load. There's a difference between a random cryptokey and polymorphism, and it's huge.
RE: Polymorphic crypter - Merkuri - 03-11-2013
Have you check the engine.cpp file ?
RE: Polymorphic crypter - w00t - 03-11-2013
Yes, and the actual encryption on the file i very good because of it. But the stub doesn't have any of the engine incorporated into it, so it's just a well encrypted file.
RE: Polymorphic crypter - Merkuri - 03-12-2013
(03-11-2013, 11:55 PM)w00t Wrote: Yes, and the actual encryption on the file i very good because of it. But the stub doesn't have any of the engine incorporated into it, so it's just a well encrypted file.
Crypter = encrypting files ? You may don't understand why I have share this. Basic this is a very good explained poly. code this isn't for using it but to get the idea, also this isn't crypter for malicious application/
RE: Polymorphic crypter - w00t - 03-12-2013
Yes, "crypters" is a colloquial name for a PE file encryption program.
As I said, this isn't polymorphic, the actual stub doesn't change each load, it's just an obfuscator and encryptor rolled into one.
RE: Polymorphic crypter - Merkuri - 03-12-2013
Code:
== What do it does? ==
smi²le will disassemble a block of code into a list of opcode information.
Using that list the engine can:
+add trash/junk code
+add random jmps to code
+mutate instructions
When reassembling, the instructions are written to a buffer in random(ish) offsets
and linked together with jmpsYou may want to read the beginning of the engine.cpp, each load the code will add random jumps etc.. (the list is above), I hope that you don't think that poly. is writing an new unique code each load like new program loaded.
RE: Polymorphic crypter - w00t - 03-12-2013
It does that each encryption. The stub does not have any calls to the engine.
RE: Polymorphic crypter - Ultimatum - 03-18-2013
Checked. Ain't polymorphic. Yes it's encrypted, but ain't polymorphic. w00t beat me here, but the code doesn't change on each execution, only the key which encrypts the file.
RE: Polymorphic crypter - Merkuri - 03-19-2013
Stup.cpp is manipulated in main.cpp by engine.cpp, engine.cpp add random jumps (asm) and trash code. The main operation was on ASM (I think not 100% sure) I can't say it in more pure way.