gWX0
June 20th, 2009, 13:40
Quote:
I wrote a class that uses a blend of polymorphic code; something I originally wrote for another user, who had too much trouble integrating it, I figure the community could use it. The PHP script attached will verify an account ID given over a network pipe, then return the requested function. The script should store all valuable functions in an encoded/encrypted/encoded buffer, which the client will fetch when needed, decrypt, load to stack, and execute. For an example, check out the WinMain.cpp file, and take note of the "GetFunction" and "QueueFunction". The kePolymorphic class is, essentially, just a large NOP, not being actually polymorphic; a number of random instructions are completed on each run, but the instructions don't change, only which instructions get executed. That's where I would personally store strings that should appear interesting to a potential reverser, but in all reality, do nothing of value (As seen with examples such as "@lawnmower", "@godmode", etc). Most, if not all of the strings in the library are encoded; you'll have to modify the host encoded buffer and the request to your specific server, where the modified PHP script would be hosted. Lastly, there is a key in the keConfig.h file, you can modify it or not; I personally would. Below is a python script for encrypting given buffers, then writing to a file, "key.txt". Quote:
Enjoy, everybody! |
+", "http://www.sendspace.com/file/wnbgdq
Use it as you want, credits or not.
__
Anyways, the only "polymorphic" feature in the above, is the feature to dynamically load functions to the stack, execute, and remove from the stack. Functions can be stored, or fetched from the attached script.
Other than that, enjoy; I may come back and re-write the kePolymorph class to actually be polymorphic. At one point, I did have plans to include a small metamorphic engine, which would modify resources slightly on each run, using the working polymorphic engine. From there, ideally, the resource could be executed at random, functions could be stored in the resource, being loaded and unloaded from the main binary, etc.
Regardless, just enjoy it, and excuse any messiness I left in.