57 replies to this topic

[tibbar]

The other day I thought I wonder if i can write my own packer, and 3 evenings later here it is.

Nothing too advanced so far, it just applies an incredibly simple "encryption" to the code section of the input file, which makes it undetectable to AV.

It only will work with an unpacked input file and only exe's.

I plan to extend this in the future, so please report any binaries it fails to encrypt and report if AV detect a crypted file.

Future plans include encrypting all sections and moving to a polymorphic stub + encryption.

Usage is as follows:

D:\\Packer\packer\Release>codecrypt.exe
*** Code Crypt 0.0 by Tibbar@GovernmentSecurity.org ***
***                                                 ***
*** Usage: codecrypt filename.exe                   ***
*** Will encrypt the codesection to avoid detection ***
*** Disclaimer: This software is for educational    ***
*** purposes only.  No responsibility is held or    ***
*** accepted for misuse.                            ***

Source code is in the programming forum.

Enjoy!

Attached Files

•  codecrypt.zip   16.75K   765 downloads

[Erra]

wow dude thats impressive. Excellent work.

Will just have to give it a whirl and see how it goes... Will post back here my findings as well

Thanks again!

[apoc_neo]

yea it shure is impressvie thanks for the hardwork man i am going to put it to the test.

[sz0n]

Detected by NOD32 and Kav (only tested with those two), damn they are fast.
Anyway great job, it must be hard to write something like that

[apoc_neo]

Nice work dude i used your tool on hackerdefender and kav suspected it as a virus but could not tell wich virus it was, so then i packed hackderdefender nice and tight after using it and kav found nothing good work man big respect to you.

[jjfrost]

ive just tested it on the mirc.exe (winxp), but after this it doesnt start anymore. there is no error message or something like that

[apoc_neo]

ive just tested it on the mirc.exe (winxp), but after this it doesnt start anymore. there is no error message or something like that

<{POST_SNAPBACK}>

maybe because the latest version of mirc is tamper proof?

[vnet576]

Yep, it is tamper proof via checksum validation. Theres the next challenge for you tibbar, making it retain the same checksum.

On second thought that might be impractical since the only methods I've heard of are too program specific. Still this is something to think about.

Edited by vnet576, 12 July 2005 - 07:05 PM.

[tibbar]

isnt the checksum algorithm secret known to MS only?

[vnet576]

isnt the checksum algorithm secret known to MS only?

<{POST_SNAPBACK}>

Are we thinking about the same thing? I'm talking about CRC or MD5 checksums...

[tibbar]

oh i thought u meant the one in the pe header

[tibbar]

this is the one i meant:

http://216.239.59.10...lient=firefox-a

A checksum value is used to validate the executable file at load time.
The value is set and verified by the linker. The algorithm used for
creating these checksum values is proprietary information and will not be
published.

...............

So that's all. The algorithm is just simply adding the file (by words). Whenever overflow
occurs, checksum is cut to word and incremented. The position of the checksum itself is
excluded from this processing. After "summing" the whole file, this checksum is expanded
to DWORD and the file length is added. That's all. Simple but effective. Just two remarks:


1) If you wanna easily get inside the checksum test, set breakpoint on ZwOpenFile. When
you get there, type P RET once. I'm sure you'll find the way then :-)


2) As you can see from the code "above,.class" the PE EXE file checksum is stored at
offset 05A, starting from "PE". For more info see the relative Microsoft documentation.

[gr33dy]

Excellent work, tibbar. File sizes are kept small after packing unlike some other packers I've seen. This will come in very handy.

[cazad0r]

Correcting the version of the Web
This

[AdmiralB]

well maybe u could try to mimic armadillo
they have to good shit in the world.
no cracks for their latest version
and last i heard is that the last crack took the power of a entire uni's comps to break 1 key