I want to create my own, static obfuscator for any executables. What is the best way to do it with python? How should I start or what sources should I learn to do it? Anyon can give me some tips or links connected with this topic?
closed as too broad by perror, usr2564301, 0xec, ixje, ubnix Dec 27 '16 at 12:02
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
You should start with reading documents. Your problem definition is too broad to be covered by reading sources of already existing solutions.
- You need to learn the executable formats you are intending to work with, "any executable" is too broad (ELF, PE, jar, whatever else ?)
- You need to learn the platform architecture (is it ARM, MIPS, x64 ?)
- After that you need to define the list of obfuscating transformations you want to apply to the executable of type of your choice .
- All the rest depends very much on the list of the transformations and information you'll have to apply these transformations.
Here is the reading list (unfortunately, it is far from being covering the whole problem)
- Taxonomy of obfuscating transformations - classic work by Collberg and others
- Studies in program obfuscation - if you want to have some theoretical background on math around the obfuscation
- PE format - go by links from wiki, there are a lot
- ELF format - the same if you want to obfuscate elf executables
- Intel SDM - the best and definitive definition of Intel processors assembly language, replace it with similar document about your platform if you choose to obfuscate non-intel binaries
- tuts2you downloads section related to obfuscation - some articles inside
- In addition I'd recommend you to follow @Rolf Rolles, he wrote some excellent articles on deobfuscation, such as this or this.
After reading this you'll be able to search for more fine-grained information.
The most approachable methodology to deal with the issue is using LLVM. LLVM has python bindings that probably can be used for this. There are some works related to obfuscation with this methodology, but none of them has complete solution in python, for example
- Example of simple obfuscator with LLVM
- You'll probably find something interesting here, more invested LLVM based obfuscator
- By the way, here is work on deobfuscating results of one of version of obfuscator mentioned before
- McSema - a framework for transforming executable to LLVM IR. - you'll need it to read the executable and transform it into the form related to LLVM.
Your question is actually huge, and I'm far from covering the topic. However this topic is very interesting, and I wish you good luck with that :)
As it appears from comments the topic starter wants to write as a starter something similar to UPX, which looks much simpler.
Here is a list of links that may be helpful for that:
- UPX source code - it is not python, but good for reference
- pefile is a multi-platform Python module to parse and work with Portable Executable (aka PE) files.
I'd suggest to learn PE format first, and read the code of UPX.