2

I am stuck on making (my little self-task for learning) that thing: enter image description here

Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM code between pointers, obfuscate it etc, and write it to some DLL. On original application, we have a patched trampoline with generated by our "disasm tool" function... Hmm, any example how to make that? =)

Maybe it is not a good idea of protection software code or something like that, i just do that for learning. I know how ASM pointers works in theory. For example, i can do all of that manually with Olly, but how to do that programatically like VMProtect, Enigma or Themida "compiler tools" do this? Never tried to make a something like that by my self. And did not find any examples, because that is "arcane" level of programming, and also such things hard to find on opensource =(

So to questions:

1)How to search programmatically ASM pointer inside compiled application?

2)How to "cut" & disasm code between 2 ASM pointers programmatically?

3)How to paste them back (after edit) programmatically?

  • 1
    It is difficult to understand this. – julian Apr 14 '18 at 22:17
  • I don't understand the trampoline function. But I know little about hooking with Easyhook. Link: easyhook.github.io – Biswapriyo Apr 15 '18 at 6:29
  • 1
    check rewolf opensource virtualizer github.com/rwfpl/rewolf-x86-virtualizer – blabb Apr 16 '18 at 11:32
  • Ohh thanks, that's exactly what i need. Found, std::vector<std::pair<DWORD, DWORD>> scanForMarkers(BYTE *data, DWORD length) and other usefull things. ;) – Happy Day Apr 16 '18 at 11:42
  • @HappyDay: please post answers in the answer box, don't add them into the question body or comments. but make sure it's an actual answer and not just "something that looks like it". – Igor Skochinsky Apr 16 '18 at 13:30
1

1) If by pointer you mean "pattern" or "watermark" the first thing that comes into my mind is BlackMagic (read FindPattern function)

2)

  • A program is a file that have a certain structure (PE file format), so you have to read it as an array since all you want to do is replacing bytes withing a range
  • after obtaining the Start offset and End offset (which are the address of the "Begin" and "End" respectively) you disassemble the bytes between them, you can use for example Distorm or Olly disasm (this one can assemble back your code)
  • the original code should replaced by something like (don't forget to replace the remaining bytes)
push offset dllName    
call LoadLibraryA    ; load the dll

push offset FunctionName     
push eax  
call GetProcAddress   ; obtain the address of the moved function

call/jmp eax ; call or jump to the moved function

3) At this point the disassembled code should have been obfuscated/encrypted, and since it will be moved to another dll it's there (inside the dll) where it should be compiled back, you can either choose to assemble it manually (on memory) with (for example) Olly disasm (your program should manually generate a dll which is a lot of effort) or compile it (to disk) with (for example) MASM32

Notes :

  • you should check that addresses inside the moved function is not called/reference somewhere else
  • in case of presence of relocation (i.e the program doesn't have fixed image base) the addresses referenced by the moved function should be updated at runtime (for example : patched by the decryption routine)
  • You should learn more about PE structure since you'll have to deal a lot with it in your project.
  • this are some hints and not the only way to do it
1

The answer is LLVM. It allows to load the assembly and manipulate it. If you own the source code of the program, which you want to protect, it's even easier, because you'll be able to compile it via LLVM and have higher level of code manipulation. See LLVM pass there's an example on modifying the binary code during the compilcation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.