Showing posts with label packer. Show all posts
Showing posts with label packer. Show all posts

Wednesday, February 25, 2015

x86obf source code

After releasing the x86obf tool for free I received quite a few requests
for the source code. It was planned for the future, but I've decided to
release it sooner.

The source code has been slightly stripped. Junk code generators are
removed (they emit NOP only), data encryption is removed and so is
bytecode encryption/obfuscation.

Virtualization handlers have been removed for some important and some
not so important instructions. One of the important handlers were Jxx
instructions which cannot be executed by the VM in its native form. In
fact, every instruction that somehow changes execution flow (e.g. CALL,
RET, JMP, Jxx, etc) must be handled manually.

I am releasing this as a learning material, not a ready to use
compile-my-own-protector source. It will successfully virtualize and
produce working binaries for short blocks of code which don't have
conditional jumps. If you want to build a real protector on top of this,
you will have to develop some code yourself.

x86obf was initially meant to be a commercial application, but it didn't
work out. It had two versions, local and remote, which is why it's split
into two projects and still has context data transferring code which is
not needed in its current state.

If you have any questions, feel free to send me an email!

The public version of x86obf will continue to be developed, in fact it's
being rewritten slightly to provide better functionality and also to
compensate for this source code release - I am changing its internal VM
design.

You're free to use this source code in free and commercial projects, but
please do credit me.

Writing virtualization handlers is straightforward:


Download:  x86obf_source.zip

Wednesday, June 1, 2011

ChapljaVM Code Obfuscator 0.0.1 alpha

This is a release of a very early alpha version of the program, make sure to read the README!

Download: chaplja.net/ChapljaVM.zip

README file contents:

# ChapljaVM Code Obfuscator readme

ChapljaVM Code Obfuscator is a tool used for protection of PE executable
files. It is currently in alpha stage and is thus far from finished.
Many instructions are not supported yet or may be improperly mutated
which can result in the protection application not functioning correctly
(e.g. crashing).

Notes: The input executable must be compiled with image randomization
disabled and no relocation sections or it will crash when loaded at non
default base address. This means you must disable the above mentioned
features in your compiler for your EXE files as well. Only 32bit files
are supported at this stage and instructions in the marked code blocks
must not have any prefixes (e.g. lock, repne, etc). Also, certain
instructions are currently supported only in certain forms, for example:
"xor register, register" may be supported, but "xor [mem], imm" not.

More instructions will be supported soon, but you may report an
instruction used by your program if it's not supported and it will take
priority over other instructions. Contact details are on the bottom of
this file.

The code produced at this stage is a bit too large (100 bytes of code
becomes around 1600 bytes of code, but that will be optimized soon) and
not all instructions are mutated, some are simply copied in its original
form. Remember, this is an alpha version! Many things are temporary and
the obfuscation complexity will be much more complex in future versions.

The protection options are not customizable at this stage, the options
block will be enabled at a later point.

How to use: Include the "ChapljaVM_SDK.h" in your C/C++ project and use
CVM_BEGIN and CVM_END macros to mark the start and the end of a code
block you wish to protect.

Please report all bugs to chaplja@gmail.com - this includes unsupported
instructions as well as any other kind of bug (e.g. the generated exe
file is crashing or producing wrong results).

# Credits for used libraries
* PeLib - www.pelib.com
Copyright 2004 by Sebastian Porst
Original license in PELIB_LICENSE.txt

* libudis86 - http://udis86.sourceforge.net
Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008
Original license in UDIS86_LICENSE.txt

* AsmJit - http://code.google.com/p/asmjit/
Copyright (c) 2008-2010, Petr Kobalicek
Original license in ASMJIT_COPYING.txt

# www.chaplja.net | www.valsimot.com | chaplja.blogspot.com
# chaplja@gmail.com

Monday, May 30, 2011

ChapljaVM progress update

Here's a binary obfuscated with the current CVM version. It's still in a very early development phase and the mutation complexity is very simple compared to the plans I have for later, but it should already stop quite a few newbies from easily reversing a mutated block of code.

The obfuscated application is a SHA-1 implementation with a self-test program which computes a checksum of predefined values and compares them to the expected result. The original program's source can be found here: http://www.packetizer.com/security/sha1/

Download the obfuscated binary here: http://chaplja.net/SHA1_2011_05_30.exe

Hopefully I'll be able to release a test version for testing to public soon.