Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going to be significantly different than the previous one. I'll be using shikata_ga_nai (https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/shikata_ga_nai.rb) to achieve polymorphism. However I'm currently working to improve on garbage assembly generation. There are a lot of possibilities to create garbage assembly. However most of the encoders, including shikata_ga_nai generate garbage assembly at a fixed relative position - meaning the garbage instructions are placed at the end of the code or the beginning. Is there anyway to scatter these garbage instructions across the code WITHOUT messing up the conditional/unconditial
call instructions with relative offsets?
For the sake of simplicity take the below piece of assembly as an example of a code that my PE file is going to execute
0x42: 0F B7 2C 17 movzx ebp, word ptr [rdi + rdx] 0x46: 8D 52 02 lea edx, [rdx + 2] 0x49: AD lodsd eax, dword ptr [rsi] 0x4a: 81 3C 07 57 69 6E 45 cmp dword ptr [rdi + rax], 0x456e6957 0x51: 75 EF jne 0x42
Let's say the garbage instruction I want to insert is
cmovne rsi, rsi. If I insert this instruction at the beginning or the end of the code the logic of it doesn't change.
However If I insert
cmovne rsi, rsi before the
cmp instruction the
0x4a offset, when the conditional jmp instruction at the
0x55 will execute, it's going to skip the instructions located at
0x42: movzx ebp, word ptr [rdi + rdx] and start executing at address
lea edx, [rdx + 2] becase the offset it's trying to jmp is relative to the
(Old offset ->
0x42+ garbage instruction length ->
0x4= New WRONG offset ->
Garbage padded payload
0x42: 0F B7 2C 17 movzx ebp, word ptr [rdi + rdx] 0x46: 8D 52 02 lea edx, [rdx + 2] 0x49: AD lodsd eax, dword ptr [rsi] 0x4a: 48 0F 45 F6 cmovne rsi, rsi 0x4e: 81 3C 07 57 69 6E 45 cmp dword ptr [rdi + rax], 0x456e6957 0x55: 75 EF jne 0x46
Is there any approach I can take to resolve this?