Tag Archives: runtime executable decryption

PoURaN PE-Encryptor: A XOR based encryptor injecting code to EXE/DLL files..Full C/ASM source available.

  By PoURaN | November 10, 2011 - 8:32 pm |
4 Comments

 

– =[ The tool presented in this post, is the automatic process of what presented manually here : 133tsec previous post ]= –

What did I use:
PEditor – to check fast the pe header values..
Ollydbg – ofc.. the most usefull one..
M$ VC Compiler – to compile :p
HxD – HexEditor
Notepad++ – The best source/text editor 🙂

References:
Structures in PE: IMAGE_NT_HEADERS,IMAGE_FILE_HEADER,

IMAGE_OPTIONAL_HEADER,IMAGE_DATA_DIRECTORY
..And ofcourse IcZelion’s tuts are very helpful for such topics..

Source: PoURaN PE-Cryptor v1.00 cpp

Hello 🙂
As title says, am going to present you a PE Encryptor that i coded in C++ and inline asm.. Actually, I used .cpp source file and not c, for only onw reason.. to use some SEH easy.. 🙂  I used M$ Visual studio’s command line compiler, and it is a console application. I started coding it, and I was sure that in 3-4 days it should be ready 😛 but I was absolutely wrong.. The most time took me to optimize some functionalities, and to test it in many executables etc.. Many probs occured, and needed lot of debugging and changes. So after about 10-12 days, I have a good working tool 😀

  1. At the moment (in this version) it is a simple pe encryptor doing the following: Takes as input a PE file (.exe or .dll)
  2. Takes as second input a “source” file, a file with raw data, that are going to XOR encrypt the sections, and later decrypt them.. These data will be injected in the PE as is, and will be used in runtime for decryption of the sections.
  3. Asks for the output filename.. The resulted .exe/.dll with injected code and encrypted sections..

The above files must have a max of 100 chars in filenames… (no you’ll not overflow the buffer if you input > 100chars :p )

After taking some input from the user, it checks for a valid header (depends on some standard chars and if there is an exception searching the header.. look at the source). Opens and maps the files into memory. Some functions receive as argument the handle of the files, and some functions receives the pointer to the mapped file on memory.. Most of them returns a pointer to the memory where the pe file is changed.

Am starting by addind a new section in the PE file, named “.PoURaN” and giving it the correct section values so the file is correctly aligned.. The file with the new section is a copy of the original PE file with only a section added, and 4096bytes more in space, and stored in disk with a filename same with the original PE, added by “.new”.. for example if the pe file is “test.exe” the added section file will be “test.exe.new”

The next move is to take that “added section” new file, map it in memory, make again some pe verification, and then read the sections one by one, and through a function named “IsSectionEncryptable” i confirm which of the sections are gonna be encrypted. After looping all sections, i XOR encrypt the “IsSectionEncryptable” sections with the source/key file given (as second input).. Then reading the PE Header i make the proper changes to the injected assembly code, (hardcoded addresses, OEP etc..) and injecting them in the last section.. After the injected code, I add the source/key file as is.. I change the header to make the PE file valid after the changes (you can see the sources) and there it is..!

Where the encryptor doesn’t work:

  1. Files with already 8 sections: Yes doesnt work on those.. Cos normal PE has max 8 sections..
  2. Files with messed sections.. If there are random bytes between the last section header,  and the rawdata of the 1st section, this check will fail, and exit(0);
  3. At the moment, the encryptor has as “IsSectionEncryptable” criteria, the section’s characteristics.. It looks for the two executable flags (20h and 20000000h ..look the sources or video).. If there is no such section (like aspack, makes all sections C0000040h) it will not work either!! 😀
  4. Some fucked up PE Header may cause exceptions or failure of the encryptor.. 😀 let me know for that plz.. 🙂
  5.  …. maybe some more that I miss atm.. plz let me know too …

 

Ofcourse the source code is not at it’s best shape.. I know i made some n00bish fast implementation but I hope to improve it soon.. Optimizations that I already have in mind, will be posted ofcourse, and new versions… and added functionalities.. So keep in touch 🙂

Any recommendations and/or discussions, ofcourse, are welcome!

Below I show the compile, and use of the encryptor, with some executables and a dll example.. Enjoy!

Compile & use on 2 executables.. one executable i just create, and another one 3rd party executable..

 

Here am using the cryptor on a virus, facing some difficulties, and showing how i bypass them.. After that, i compare the virustotal results as expected.. 🙂