0

I want to create my own, static obfuscator for any executables. What is the best way to do it with python? How should I start or what sources should I learn to do it? Anyon can give me some tips or links connected with this topic?

closed as too broad by perror, usr2564301, 0xec, ixje, ubnix Dec 27 '16 at 12:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

You should start with reading documents. Your problem definition is too broad to be covered by reading sources of already existing solutions.

  1. You need to learn the executable formats you are intending to work with, "any executable" is too broad (ELF, PE, jar, whatever else ?)
  2. You need to learn the platform architecture (is it ARM, MIPS, x64 ?)
  3. After that you need to define the list of obfuscating transformations you want to apply to the executable of type of your choice .
  4. All the rest depends very much on the list of the transformations and information you'll have to apply these transformations.

Here is the reading list (unfortunately, it is far from being covering the whole problem)

  1. Taxonomy of obfuscating transformations - classic work by Collberg and others
  2. Studies in program obfuscation - if you want to have some theoretical background on math around the obfuscation
  3. PE format - go by links from wiki, there are a lot
  4. ELF format - the same if you want to obfuscate elf executables
  5. Intel SDM - the best and definitive definition of Intel processors assembly language, replace it with similar document about your platform if you choose to obfuscate non-intel binaries
  6. tuts2you downloads section related to obfuscation - some articles inside
  7. In addition I'd recommend you to follow @Rolf Rolles, he wrote some excellent articles on deobfuscation, such as this or this.

After reading this you'll be able to search for more fine-grained information.

The most approachable methodology to deal with the issue is using LLVM. LLVM has python bindings that probably can be used for this. There are some works related to obfuscation with this methodology, but none of them has complete solution in python, for example

  1. Example of simple obfuscator with LLVM
  2. You'll probably find something interesting here, more invested LLVM based obfuscator
  3. By the way, here is work on deobfuscating results of one of version of obfuscator mentioned before
  4. McSema - a framework for transforming executable to LLVM IR. - you'll need it to read the executable and transform it into the form related to LLVM.

Your question is actually huge, and I'm far from covering the topic. However this topic is very interesting, and I wish you good luck with that :)

UPDATE:

As it appears from comments the topic starter wants to write as a starter something similar to UPX, which looks much simpler.

Here is a list of links that may be helpful for that:

  1. UPX source code - it is not python, but good for reference
  2. pefile is a multi-platform Python module to parse and work with Portable Executable (aka PE) files.

I'd suggest to learn PE format first, and read the code of UPX.

  • Thanks so much. I know that question is too broad. I want to create an obfuscator for PE files first. Platform architecure is x64. So at the beginning I should understand the form I want to obfuscate and then go deepper? I'm interesting in RE, but in practical side I decided to create something like UPX packer. – allocer Dec 26 '16 at 10:31
  • 1
    You need to understand the form (PE) - or you'll not be able to create a valid executable, the platform (x64) - or you'll not be able to add something meaningful to the executable, and you need to choose specific obfuscating transformations set to apply. UPX, by the way, is not obfuscator, but packer: it scrambles and archives IAT and the original code and AFIK unpacks it prior to the execution. – w s Dec 26 '16 at 10:42
  • So maybe at the begining, write own packer instead of obfuscator would be simpler? I should try same way - learn PE format and go step by step through your list? – allocer Dec 26 '16 at 10:44
  • I'll update the answer – w s Dec 26 '16 at 10:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.