I am not responsible for any damage caused by this program. It was made as a learning experiment to gather more knowledge about anti virus.
The project structure is very messy because i wasn't planning on releasing it, sorry i guess.
I will not provide any support for running the program, it is only made for people interested in cyber security to learn more about how AV work.
patate crypter officially supports 32bit and 64bit DLLs and PEs.
Note that the final payload does not use any Windows API, indirect syscalls are used instead.
There is an issue where the reallocations would fail for specific payloads, TOFIX.
There is code in the metadata.py file to generate random BMP images in the metadata of the PE but it makes the entropy go way to high (from 6.4 to 7.4) (see link).
There is currently 0/40 detections for a crypted meterperter :
The crypter (compile time) works by :
- storing the raw bytes of the payload into a buffer (XOR encrypted)
- adding junk code/control flow flattening to the decryption stub
- copying a Windows file signature on the generated PE (using SigThief)
Then the stub (at runtime) :
- if a VM is detected, proceeds to compute 20k digits of pi before exiting
- decrypts the sections of the payload one by one and encrypts them back after copying them into the memory (bypasses ESET AV emulation)
- rebases the payload to its new base address
- calls (Dll)main
Here are screenshots of the same function before and after the obfuscation pass :
Without obfuscation :
With obfuscation (only showing a few nodes, the original graph was more than 40K nodes) :
cd Builder
python gui.py
- Alcatraz
- SigThief
- What is file entropy
- Direct syscalls vs indirect syscalls
- some random gui on xss who released a big article explaining the basics of cryptors. //TODO, find link
- vx-underground's Blackmass Volume 2 (A Peek Into Antivirus Memory Scanning)
- pi spigot algorithm