57 replies to this topic

[Killaloop]

well maybe u could try to mimic armadillo
they have to good shit in the world.
no cracks for their latest version
and last i heard is that the last crack took the power of a entire uni's comps to break 1 key

<{POST_SNAPBACK}>

well there is a hudge difference between packer/crypter and pe protector like armadillo.
and by the way I tried armadillo with some viri and rootkits and kav detected them.

[realloader]

Kaspersky still detect my file.exe!

[satknis]

nice work tibbar, but it is not undetected. have you tested it with Norton ?
I tested it with F-Secure and Ewido both detected the files wich where crypted.
And that with old Updates, older than your post. F-Secure just told me "Type 32", but
Ewido told me the right Name of the trojan.
Maybe u just crypt the Header of the EXE files, that could be the reason that
your crypter can't fool the detections.
A other point is that your crypter doesn't tell me if it is crypted or not, it just quits
after crypting, so u maybe add a line to say "done".

[Killaloop]

Nothing too advanced so far, it just applies an incredibly simple "encryption" to the code section of the input file, which makes it undetectable to AV.

as you can read the code section is crypted.
nothing more and it only increments and decrements.
if the virus signature is somewhere else and not only in the code section it wont help you.

[[R]]

no it does not work...


if i crypt my files and exec it, i only got an error msg. bad.

Attached Files

•  Image2.png   6K   126 downloads

[tibbar]

killaloop is right. i am only crypting the code section, so signitures based on other sections will not be stopped...that's for next version.

note that i tested iroffer and lithium rat, these both became undetected to mcafee and both functioned correctly.

if the prog is already packed, or does checksum check it will fail.

[tibbar]

no it does not work...


if i crypt my files and exec it, i only got an error msg. bad. 

<{POST_SNAPBACK}>

can you send me the file in question, i can debug it to see what went wrong. perhaps it was already packed?

[cazad0r]

With the Stud_pe it leaves an error like this one: "PE import Dir corrupted"
but if they are possible to be seen entry point and the sections but, at the moment for compiling it remotely, because in the machine where it found me was with win98 and it did not work, raising the server the remote machine, in a Windows xp without antivirus I executed the Codecrypt and when me I bring it for here (FTP) leaves the following errors:

Image001

Image002
And executing it in Win Xp:

ImageWinxp
Not in which I make bad, but to tell the truth the program is good, not in what failure, and if he is indetectable, proven with KAV.

[nolimit]

The latest armadillo has been cracked, how else would 0-day groups be releasing apps protected by them. armadillo is nothing compared to star force and safedisc, and groups have cracked those.

Any protection can be cracked, The amount of effort required is the only moderator.

[tibbar]

is this ftp.exe from microsoft windows? if so it wont work as they do a checksum verification.

[belgther]

tibbar, this verification is only done for PE header. I tested it with some windows tools(net.exe), modifying the raw data doesn't matter.

[cazad0r]

tibbar,What happens is that it was in a machine with Windows 98 (192.168.1.36) and, good when executing codecrypt foot me a tie export to kernel32.dll "GetFIleSize" that does not exist and that made me migrate to Windows xp, in a network, but as it were to the other side and it is of my good friend , which hize was to use RPC GUI of r3l4x (exploit) and to send by FTP updater.exe, decompressed (server of bifrost 1.1.02) and codec.exe (codecrypt.exe) to win xp (192.168.1.30), single that, single FTP login without password, that is everything.

But that the single thing does not come the previous case of saying to him that I believe that it would have I who to make some modifications, to cracking to server.exe modified with codecrypt, am to say codecrypt it would be beta?
thanks

[tibbar]

tibbar, this verification is only done for PE header. I tested it with some windows tools(net.exe), modifying the raw data doesn't matter.

<{POST_SNAPBACK}>

yes but i add code and increase the file size, but dont bother recalculating the checksum.

[tibbar]

tibbar,What happens is that it was in a machine with Windows 98 (192.168.1.36) and, good when executing codecrypt foot me a tie export to kernel32.dll "GetFIleSize" that does not exist  and that made me migrate to Windows xp, in a network, but as it were to the other side and it is of my good friend , which hize was to use RPC GUI of r3l4x (exploit) and to send by FTP updater.exe, decompressed (server of bifrost 1.1.02) and codec.exe (codecrypt.exe) to win xp (192.168.1.30), single that, single FTP login without password, that is everything. 

But that the single thing does not come the previous case of saying to him that I believe that it would have I who to make some modifications, to cracking to server.exe modified with codecrypt, am to say codecrypt it would be beta?
thanks

<{POST_SNAPBACK}>

this is release 0.0, so bugs are likely. could you email me the file that fails, to:

tibbarDOTgsoATgmailDOTcom

replace DOT with .
and AT with @

same goes for anyone else who has problems, email me the file.

[vnet576]

Yep, this is what I meant when I said that removing the md5 checksum would be too program specific. You would have to manually find exactly where the program performs the checksum and physically change it or change it when its being calculated in the memory. And this would be different with every program, but maybe some else has ideas for this.

On a side note, armadillo and programs like it place the target exe inside a "container" without actually altering the file. So its pointless to compare tibbar's program to it. Completely different concept.