From 3a828abcb973177390e8fb9ebff6c52bc9e3872e Mon Sep 17 00:00:00 2001 From: JorySeverijnse Date: Fri, 12 Dec 2025 22:02:28 +0100 Subject: [PATCH] An attempt to obfuscate more to get less detected as upx by AV --- injector_packed_stealth.exe.png | Bin 0 -> 71225 bytes src/my_ident.h | 51 ++++++++++++++++++++++ src/p_w32pe_i386.cpp | 3 ++ src/p_w64pe_amd64.cpp | 2 + src/pefile.cpp | 53 +++++++++++++++++++++-- src/stub/src/amd64-win64.pe.S | 72 ++++++++++++++++++++++++++++++-- src/stub/src/i386-win32.pe.S | 64 ++++++++++++++++++++++++++-- 7 files changed, 234 insertions(+), 11 deletions(-) create mode 100644 injector_packed_stealth.exe.png create mode 100644 src/my_ident.h diff --git a/injector_packed_stealth.exe.png b/injector_packed_stealth.exe.png new file mode 100644 index 0000000000000000000000000000000000000000..93116e5d8fe16f87dda41897729283c2573996ef GIT binary patch literal 71225 zcmeHw3s_WT{_t=Y5%7|tf=uSEjdZ+&IxwY~+iFrw| zHdKD)uCAc#Dk$g-OiHFUx%>?cbY>)-yfR40fWw^ccg}g=bIyC_nD*cOzVH7%kM=yo z9Ok^2-~IOf-uGUZJtMgL!0rl#BKW!AKJ$Bpq8t3`d#al^{BK*lqfz12Px0I{Prt15 zx@qC+!nFIgQnSbr4{!jdShZ#B{fth9T;%A?IW^Lux z&E3tj7AK^yOizzDGgHob{qnBerH8NG<431q-8XX*7OXsbj~{JR@JGM!`r&Kzz$bp; z^_6Go2`}G!c32jj{MY&SoE`o^*S~P+UW;dTA$Engmy73YDt*(?d=0V*Dvoyodx^wq=w_rNu4>0@g`-2)?!75&(5EwjBy zC@*@2uUHwjO^wJ;$&1g6ZnE6!pWR3NCss9uJys!BZDFq~-65l@Ev+f#p;RsPe&m|q z#FE|a_N%sfYgGWR2^g$muK1}Vd|H`nSX6EgZOKsLR+pDFW7CZZk zJF6p^k8?=`v`Btf1y>8Taxq`DJepXY>euj|tnr`XFlh&+!(mpFpUw8dA|0LU=lQQ3|2+Q$vJyO+65udj}*MD2ygzQJNRc6~` zL#ukYMyb1f|DE+EYjVe?1#6#ozU7>JE`Nk+qIzJCVO@Rh0{zYP)=gd&!FvB%>#)y^ zT4U7HP3NyT>KxB1=C6&d==DVQsO)}$R2%M!9&&kGM!I2p8;kYkoYnKqPo<6dPN#6ZtecmaoH2A z#?22M7ZX&du8T4qQJj+5?ww~HCl!tU@%f7!AHHB!SwH%;Wfm->YCKS3FY@*IYnvP` zj$x_3@p&V4{a-#;kdU*}Q6o3#&u1KSQm0hK+-RAl@~6D~5`)}-PTFEBuHI@=6c@(o zCY{UCsM-{WHPnvev_BkGj@h>@Uu(sMx+sbTX9RG4`aXjiw z)Ae=s)|(P)!hwzaQ+r4D2zMNIjCB0Q(bE~Fi1Uy14$Unz9#PjNREJk@v<NPA-;`ZndUd|7#qnER zhHiR{k0r3=Yr_vCOm91vRd^-#N$fSdI;tkiG%(ID(wp)#)*7c-2RnLJY)b0P29{0M z^{5(OHC)}z9g*mFbgkWy?0C~L*72xrknRsKTHdDo@+%#8AJKJl^;IZ+nB7jZChAR_ zOkve;!+hh_{q)|owmN56c3jmY*95hH;=sf{k-k(&nYXrP|LO^@fsH-1C&$fkCVo;K zR-?SVq$D&YgbFUs-L$TLZ9sL2X}56`p(a%QFNsa##EPQSh{S>JbxDVT-J-2+86nNy znr`Ja({#(iY`%&l>!{IHkEr!YSreSA=hh5}@wL8M(WiUWWS5uOqO6WGRhmK_5s|*} zx!udW4CXZFL>=WErh7?$^RbA+Adt-?=*d8iuI^Q1%(ex#fQ4(fTH_KwXSj~#Z;gW$szA!e zm~3orU6MD#I0OjkP2G!K1FPby2Dyf+zT=nkt#QFZ-EVYi^PN9B?(SVXF7@l6*6ofs z#}|(0)OFKiLR7(&X(Z=nr@UH&mo3&Q&cN_y< zL3)4Va{W#8ebsMu6P$tFbTgdK>rL~f78r7BTO-_xQPtjw1xcB!6?z3=WV9=W{v#D? zOsXEzk&rd>uZ}QSu}NthHrKe@q0$Xh)OMtIyryr^dZmt3osy1H85GwoCnYy}ZG3@` zF8VEXgX9auj=e~~)^NHhW7%EBJ5{4q{>CxR$@+QTsXpePQx)!QR8d%fwOJSEjvV-o zBh@)hZ)$d=v_GS7=oX)sux^H+7jy8y}DObVAW8Uk1Ha(k87Z6m*`veJFh!dr1sgC6Rh)7 zu}97#$4Yg%uhm~~iZ`a4vP`O}xuNTJ-i{Fci9n>^r-b)SPYiI) z+va5*TJIDiXtvZnUrR&o(z*Mo>p~Rit=Ttjm#tD(J()c=yMI-1Rj|76 z(Vj;)Qs)OKB7KT&9rGMZ%0jilD*vZyMn%;4(_VKv%42+ti>zbRRFJ-*wz_g^DCJ{0 zkv0WC{N-(2v0Unw)0|_z)KU5MxRG8zfwkak9HTc3QoQ1tv85&Zl-JyrS!KZn-@Zp9 zkNUX1o>jyJ#cj3k_5IYYT{SYhXZC=qaM!5pD6>r%Cb;UUYQwQ!*~7C3R|RFqz+M6X zMMFLbyCQt&$V6A~mz|l;5NAMtFXxlaCGI1q;2njUZr;J(egOJ={YscvCfLS-y(& zmRTjRlYqE9``+rb%7C207FAZVbL6>vWnS4jO|HRq{+6$GV8uqNI#!|n#NIT}ee)H^ z0{E}gvE6aUaojPpYBZi_T|B^mNj=bZg;%l9&#ka zeDjP0nCLG_nZ63cw`o~^`i5q2#}9i?8?2)gYx*Az?&nyv_w@d*fr_%Aoz5`V07aSK zIDNzJ7Ns@7HbbEc)W7Y!@OawY2|#tTTU0tUiu=tWigE6I^xCFDh0XciNH$AlMdax;-3;9zeM3skp1pqB(`j2J^q^kZ^LG&NX9og!LoV&U&v%GWw4rR60 zG(0={lx|sc%aSlJ-FUNYkZq-N(}f^ol%u(=18lNO>N@eaB90DNwyq?v*~{9;dcyIn z%lU>ye0>=N<1m z(jBiUT;5f&RmvNnmJc{yN*$qS2D`gCpg2#NU*zcKR8)kl2|JocFHEl~0jkj$$LP{^ ze*LW`-NBN)O@+mU-jsK}G2GN(jIU|99nt$@_?qC0VTs+>bPur&*G+d$agNp(_pR#V z8c^kv9g`hv{#kBed#sCWm9{$TF{}Nv>Y1jyMoUdpOId4ds`nZ%cfSzZtGXoJoQkkD zTar5cbXhvhxqMAwvTdhzw&G%6cejfXdWEJ(`P6{WbUtiEVpMhgQt}e z5}%`7H}A9j08_ZP<3rN%dx~`9iee)Z`yKU542#>GG_NMTHDXObV))VE#E`@dNq1N3 zuVz`>tQTy3GQQO0P4Uu=t?~v*6jC+WJiaE{SZn%<+MAwl&WX34UzXpVule!((H@b$ z%|Run#tkywtx*{pZZ{I+C4M@>SXkX|++RS&q|=zoq6<+YM_&3pZVwCXW7!bZ%84 ze)?`v`m4u2GxmAySlVA5uP+3Xm~phyDhDL`mlgyr0}o}I-mocehG}_4H_DsgznH2B z-^T8Sp!Ie~H{EkFUhOr_)uYU{MbmOe)Vxm}V9ZNzcVuLsDj?i3-WmIeE-unn6)?gY z>0AoNL(!JD-vW14QvUsJu7*(WvjQ2Er?_?CmmIoMq5 zUp28&QRyg54O0{s1cKjR6R7K35#oJoZLMjKTB!t?0_~1Vjukyqqgl8V zt^&XP$IYd=*TLazZJexoQUNxR-gMeAHg)8z)G4lB5rlM?7~1Zj`D^>QEbsK%V47*N z5GHxTf;Nr6M5gSuQeQ+K%@4a0>!fxTHd_laLJ85kiB3rk_JbKT^sj&&Mg~R5X#l!$BiX>MQzrt&k^|Mr^tG`(FaxtB$ z1ZNWCz!&~+q%-KGD~H~r#%<+yZF!Dxb4okS3z<05k;jL+%RaqLZ`OrevE2Caxo@{O zof^PHirRnoR?~m|=Gzjxm`_SOiw_()b}_Pc1EU7IsHv%EskJZdjG^?xY)y@mW|t7$ zRoWR^zTb2)l7SXI&NrcJM$GChX?EU4cE^6Jzbu-Y9g9wFXt>eLEVN4lIUKs%&e_Y| zY98Q*+CypE;!YC)Zc{ExDm)U)?14`D>-;vQjo3hEdrbO2CjYlFKnPgsZr3XJPJ0DeXbLpLSW*m3P;EHRSn!mlYO~cbnTl4Z;5j*3F zP+dY-VZ-^?Qi_?K(F5{irm=s!ymS1$r-3Y&C!lZq;oEIC5D4dVAB) zZ}Uh-fSxkt#!VKVnrRF^>vm2`-yp)L>@-JCyW==~z6?Z>dhHRrncs0&*0w3NSL=8n zvfH96wALX)Gn-A6%+I5 zMqzDNW!6@FfS|R??URpnwDN1A*T_No@7o96xx>(-y96L@Xt-JjJHWKn)|@VbQ1Q~9 zNa*sIMviX&4@@Jsn@8U}mbYUF#|GU>JJY9-M9?M2ZBOw;Km!px5Cj4Q81U}^%l$%Dvpy_v>O!}78J6+;wfI%;S3~QXka|)%|I&)LZnr%Gk zv23UL=FY^scNyBE>7Mi3n)mOk9zUjsKx>2L*zIu=(q@v@l$Yg5`X4+=Ye0P7-A0o1 zi?Y-3;*&+FnFN9IvW%227EJ?O-9Cww(mS@rp4>c+-yO%*FCHvEZ((#qCtYaWMU{}s zK=X~9lzx+!(iD*AgH6K=k6$rO*4D1oEEiCq44TtO88rihoQE>laf4R|p`Z*_lSDv2 zF2~e=A!+T`0$L8AciR8(H{Kux@^_2WHo~9R7e00Rdw;Aia zlY;mWwOb-RO>#WFkJkkWfY9>Eq>vsbXL?2Qx`3Jv2t7;kr!3Ig&+)s70(|a~NWva6 zlF(4gGme&FoNJ`@ZBCV8oUA1&`wfig+(!2W#(71;IO{Gf*f40C#C?etB$V9JhRQAN zys$Ke)K-$ZV1%45I4x+l_rGD57N2JG=IvGLLph#a!fUoN;OXc|86S$>oK`v9EEeGg zczUCR1k5r#opO*MfoO@IZk5y1i+Rz(lE4WG3D{-$CRz~D44j{r$WFB!ON-#lkid_m z>@=sz7+zbK3M2qJ_t#FtpmRm%cvuXh@>nO_E{jgVf?&`&TtaDjS#TXMsGANXWB6jy(7B+6)at9bH9@EHifoK}w zf;I^kERmBoB0vLqmZg*AnKVVl@(kw5lll{oXQqTa54PGpEr^9YdDeook-|9$#K7NP zl9=nS{vw>URv7@)3+i)>3;?|40PsCYY0abPRm6F(WgE|<5N3`QAB zD?7m3w+y8vNOWPcoFII)cEdiTar%SC`JDvN>(lHIoZ_ct%|7j$X&aFzVF5rVOeW<( zvYc3df(JCs@XZ&bsb)AXquI*@_bY|n&4WzCv*&+n8W2!X5_4#R9N&Dz^9=<8N_&+Q zP-V;CdFD5#7L%l=I?M|-?i~pY$f$xNKk-aJuLpDJ3sTq^PRWqK=Yo=o2I~As!k%Mg zd^MNVBN+7)l86R&)4Os z=5^k-YiFdb#9u3tQJ$*zc^0rRRCAnkRw$I%bUaqH zFu90}g0o_beqBaF7ZJP3{6L~S+vKR`7*93Lpw%9eL=~^!9{@!+BrG5kS3UALF9WDz z>#nf#q$Qwjz7Nc*=cxW6;hKwbTq9`p*e4Q>d@Uh>%=;1mfQ*b-w8;f+wEyH4RF<#j zH2q{SV|YtUXCBjxl)(&jM!*b6n(3=Z@1|TX?J=EK9EKT}0n8+6S}w^LTw#KS2GUG? zLm~o-WJG{?|1Y~W2bMFJ=#;%cw(bCByW+4UuNd#6UHLYsIGCIKvwltp1Nl=^QR>ymvPeAcg(G^k^Hm{J8>U<_^f#1ue znP(&tdVvf^!*~_7JLj7@sx1=h;iL>j*I?|d>_+Xlh7hq1thSu&;jCHz#)U%;7dH-0F z1U!KDt_;vJL?i%q^Cn3INq%M6XxKf9u{0$SB;_R;t0|F}W-AAPr8$gL=X6gQ9!T44 z9^j86Mt=ea?F4BxXugsm==s>5JA7>oXur=o^{-B1&2{ehsqE5536!P*_I!a<%XEa? z($3>}^{%@>&;=47-5!(m@wgd%cYew z`DA?QVI`<$>Hg(%w@>{tW*(Qpj1O;^ob3V`FjZnV%Vm{A|A`}r2xO!MAeXxJ02#@f z_XQc?f3EMmd0Zh37e+2#AtMC8<4q=(X3j}C0BVPTT}fw?FRfUxlA-2>5=I*@qXs1~ z%agcgOm&L1z9y7+HCUMWN!+uYlO})u$l`IlR$yJjsEN^&)IYK@F0XE-nbi^nohuWo zjuIGvdxeZU=gJtfQGx`JpT#pV=JASj7SDPy@xp-2@+4&DBV#!v@W$*}AF$4(APbPO z&PsW!aaRDG@$!?zwgV=6ikVVA*03u8Jcb~NcNQvRX)X{9x=_ZV1HXCHe7?TCQ~8sp zNptvhUSve(0RLOrf<6|tOnR~8s;34x%*OzBM>1Z9Q6m59JZX6)9|K5;Re+(LBT>#@ z$|z?(2vVA<$b(lTX2Woq!kX?PkTFn}#9C@)5R=1O4csh}g~?>##gj02kr;Gxd44Zm zWwt56I8#XUl1w#0-@P~hFo(sYm2?-CGPb!l$&_9arj)CU5cWP>Zdoz{hF2D`BS0i6 zBqB*>BWI;=5Y>CKg%rG`Wafy~Oqmi9@#hm*G`4BJ_cRs+6WjdWH*?IAQX0*9Pl6QO z1v4bj?RL_OD_KI79Lsx^PjNBQkG2cqXcCyqE{U;d^7LWpGy(71Ku)faXnmWf(4!9# zIEmFrAnaKW(MC6lK%BQ*FDa#>Dm-|rlM=!N`aabFFo`y5^Z;0wh7Zclk%e)i2Ug$} zUK`5+S$WGtw75(7sQfNFRI1qR60(J(H)JAg~Xb zMJ>U8ho_dL_jl{mpM9UzvG!+D&$dbgn0@Q;k7ph%C+V_Wpvw%1;HV{h-&cmn_VE5? zW~6UIY_UY>706JG;KJwwKH9CXC1t*$#*<@?jB;Vjs9McNueN_2hN*@3$ zCdo)>JqwQ99=j*4*91>jM7sM)ZDgU|ebEALc5 z2&KnlAXX;`rBDz`brO2{+LK;r!FV?_^m3KtO6`xH^g@a01;oWWr17ru^mk~D;8nDO z_D++ee#1OVKy-?^NRe!i z0hmUx+|5vR>Iq{Rkt~8S`^tY{7EerS$XOyE&D%4QE0bs42zMB`t`eu3E)=9#2b_)Y zk_gKM-zUGiXi>g6zurkN=1o@yWRVgZNo)5c7=z&L+o9|@KoTabm%)CDfPHRZWMXZl zjCkEDh}ShB_@!3TWEpljEwGCQq8(EEc)KUT+;{h$+V#G>_e4vI2rW=}?;{bf*JZ?O zv>+^8Ad#hZ=mP?QN#85yykVcf9PypVOdSWgBgJOLa^Y#ZDpfXT*#_jhPqxCbdh&YkG~&hgZBL?LcO2!{@S%?|g^e{4(% zf4qr_4$&V83`I73v3S<1xub-LZqQTWb0-GR`nj$IAuugL_%a!Uzs<`|3BoHqEm`Ud zL7)*wCfk}b_Jr=#aX-hH@!6nuq?$QNk z5<#BpxtJT8(VfiaJI@9|^`ii3YON>m%7oaE3JTan@}QRt@Q(BP=*U8GhXpu->5+P* z2MQ9O1fHhG6XW$lj3x~7G{ibQ0(yqyA|y)I;mL>tMM(4n9(lIZoqR7O(%n3Q(QVpA z0=tYRJipP!I~AiJR86DP=76 z{esyYL^O}1AN7Pbu?_;-0WvCdiGcN~B(%Twq`o8}zz`;Zhuk`Niy`rG$vQl#PrMG2 z`hN5@#rBINI~=VL*ns-8r|vR~bk`$L7_{C?|wsnHOKsVPZ2}T?%nj;JtDsb{G*Cj zC#m0<$Q_K7z~phyoQ|jk#2l43L4Z4CEY%7@DfJ@!DW!~gZ4!iV5$PhGk&$OYnEgmM zQs4bYhbE}Cc$Ftf3Dt_%rV~y9^-oWd3KhckDkuwM6VzOmdd3t_6_zS6?3vwg-S2=$9c(OKtFEUZJnT90_J*%93clKg0qlW@LxvRgG#O zAyw042>UOBR6RpT)e_I9J?k)4&z_ zR_qFcdPb3mm&MDy*CB(Kd#~gB7&X|DqS>Iuf{@G#gF0COGxTOpzOlT`8`_C)5IQf( zv&cnge&B&c&sv?XDPk-V-qroq!JO0(En9k$)?K{s&^5!wYA^OXKzww`d-jDQfJ;j# zy0o|dI-|u|+j_1Rc|bH7jFRrP)9~Y%Vp~fw>ODrECs{|@^@;wlR=uuPgL;s;lgMz2 z6g2d(;x*&rb?7L6mzkujFD2reo*CKNKa$pQ+v_X|mV|Z~V?p22WA-+Y+@Svir$vu^ z%(Y;G;wvS|M6@HYydjW}){Jafgx{5|X6X&CqNap+<*e-L>R? zrByO?aB)VDVoJ@;*HsJ!r2|B!GJ9Zu|531_eb>Zae2$RRpfePxW=-NH#^NuxaX zMoB46m&NhZjMlXy&;n>3;daGKV$f}rv8Czf*!Byk5f|Mgfr><6&^ZJZM3aW^c}Wb3 z_9Cbtg=nGaxz7M%p9a!SJ|W?2cc|{vBAu%VnU0hXA)ZG_!q%M{D?#kRQXN;g`y2)}C29GJJ0Xi$d>|pyTP40)SJ|CUY8}p6 z6n&w46Ee&$-KzHHnc^#f@rb7AVWgcUY0K4S_+e3`sY!`C>(MhwTihZs^XWelbgp`u zhyY|u!lZOo?2m&R*G#EHVOn}7X%I=z8B%2gb+r>25$dRvi;fUnWXUJEC|k-!StNp> z&O{^}JP_2L`SXs9nm#DdLO~&mNcnq!+;W|uu2>1kul8QpVx5+sh|%W|qpKtbB4F?x%F})HMs7BGH-S)t^z;DzEP>E6GBWp`R8X%c zK&~wyRNgQti$;?`>`MS~lO#FPsZCmxzj4H&rVykCv;_o0drJ{|ofH?O^Wm|U`V4~O z!tb*dJHbOsB_Jn#l{Uk-1P?VxKrZE>$ppw#@++?Wp@*pbj^?>~Xr7QQI!#TFnuzl4 zT`8m^^xpC}jx0_t5^0a=k!_C)s#NT>6N>8Fv9}tov3_7A=?t-Y`ZxT z0fEmlN$FFY;TXX}QwU?;@QqZ<^&{}vEaG%#Em9U5NwAQGXlYJ+AZQ+mpgx4r?E&(X z76Rl@s4S8z3Fj|dJ~w8l$cD5}S+nh^{pejR+T3t^aB@kLqT-#*$PRc^r1jx(CEZI~kmA8_jzaIg_AgQ(uO^AxNoT@893`i#v zCXv=-c_8K?w^tKm^z9~^4C)36!c1J-FFP4ri# zXj(*WHi8gF2c*KNHj@zOlL*>PmLj#dji6oP60xp&Nxr31d7Yr$%Oveyml(y=-w6uX z1cw7f!f20F7;P>+wC=Tq>6LZPQ8n5^~WZ*{4*I z_94YZ(4}2TW4KZ}R+`ddv4zbTO!SdIUUvNX{GX77maOE&>UJVdOp|`725O~65_-6F zCBOV_DSm$W+n!^0y`^{fVrd~+$^FJAoVn+vs3-krDuf`E=cViuF7f>BgaEKet9%S+ z2pSI~E$$N%8mD#;l%gVy#S;?y{663I7@JUAs;N>@v{+Q?%-K23E8ObPtp1gin298? zc_nH|zaWueHE(`eu*rC96la`wX-S7cT8~SU?uC-9fGUwHjD95hla{fxnwch@5e-@8 z6(=Px>9+}jk(LI#=c&b}2t^iS-IZj{y6PLw!ExGK73kQ4yO>0(v}l_;LXbc+=>U4b zFq0G(5~xV`*%m2gBSR6v&>k>sBOE$I(Jw>gI$`8eVVCG}t&O5GMruqrSAw`Z@@ptv zq!%o4#||y+R4pEYY$tkwFI^Jo>zyl7hAEIeg>y!n*|{H#fWOznkNIteuXjWqYf=`k z_4xM{g#6%dP-9KR3pCIYP$axw5kV&QB(UhAG?1grxE#A0&ciV9D>IBZf-fCLBzf3j zz`0`ILg5G3)>wB7JFu2CG3yA;m?ADm+7Hy_>au{PmUfnYj3at_F{B*e*MzPFBJxC! zC$#rGk-gXUBv1zBU_#Hoep^!LsOYgUS^`8qSZkm)W zm!-HB0jY|*=V3`T$ZTrNU4cc};{_BOOWY+#@v1TX)>L~n>sDo`_2}K7vNkB~ zyJ*`6<<90q&2jGSwmMMl2W$qpu3Ov# z4a3DOBb_JMk0O&5%fxib%4GFPOb;f`Uvw4f&>l4n#2!OQYg2qGfg=a=ZA9ZVifqt> z@iNV1+QLV&KT)yeuihUaV=stI6)q@{@iAm7f#r6)3%Nu~M<|mTWm)kc!HP-`SEKnQ z%}2-b%+4OH#&&DCG*IMQM;50sZRF|AoNY)yetp8$t+Vf5Mw)o(ox5I!6*oHx#VrG%KCNAuIIdsKP>MqT8ma z<04tqUr>Q1Jrtpn4VZRmh+;un0UUIDC~L3LDcG`2+dO=kVSAx^?QVBK=GW6Ix>kMp z9{p6^S2xRB|6B+%e;xd(Ath-G($jPRp@ag2^hYO!(nlSct|suwE3Q$Wawq|wLVHgl z9j{=?SRxGk+hg&3`5#^vM;RShm{Ol|hBlpwm39*8at9O6WvJj5!x3}N{Ag{%vgav8 zu{NG!9R$UO6BHXNbY5$t>$qIp?d+Sk#`XZq9O!Jt=?Oi2Dl1)u4Hw?*UvXt1b0G=$ z2ve;;LA5?YIG~H>LTas3Ar8YD6`F6j#Zn()wkPA9G+Cfcj>X2I98-C2LQxg!L(EN! zh1&s{AZzIBSBcy@q%7{VBFZo`d!0~4pgngQiEJ&`CmRaQmFd z-%Ap)I*o#bS}gMEo``h+hDo=WvmSA_e;iT3Q6lODL2u(+ugSH^cun2Dn2fQ?AvBB~pX|O-U7MqglNXS4k7KgQ{%^0h(1Xex9;tO;C17rPL>mm&7MIy@8a4BX- z*=;1RsU1jgcTtceI2uC14rRl>cfRd_gWlRN9Ra!;Efic zjlPaI+CXl!FQI&E#Zn(tpII;$;h-LU3^Q6enT&zUfJ9>G-yDljzQsbNeH&fPNgYEq zmdhx_=Ptr-L<*<;ur^AND&MS;o8U;mXjY=MQFHf1M2_9slCnQ>|DhA(mqXx#v#$*o zQRbL_;=l^s*GteD0$NMB&>B(bmR^b!(qfFcFyzXmU{}t7%s>ufu% zi|?VL8<3-Q8e>kyxw);DOISqiAw(o|-H;$LD7dW(I;pVOg|XN`qx&>AbyRmai_dZi z3i!Za-bL-oKM_b-mcM&R5JzAkA-)^fd0v%R!we;ij&M4P@(o*2D(xO*wehPb2l z)Gt{!_IX!5Dvj(+_(R$G#y5Bmha_6jgke(efrDy8dB`=X%{^iu4HuEH0edcLUn0su z(0e(IQ9H4mK8Z}2Xsn>8bBYl2K?-4V#0yoF>avL=F&OWb3Nw^@w5sVB#n{9WG65CGv*~yR<7&p2C#{mvy{U@(tWv1o1yt zM&zB*tI|7~SGZ#0S3kkTk&Avp4^ee34VMy$m$(nk$v4$i`ZbZE5YL5{M3JOiq+3=Y0zC3Ksocp5hSx+U+kay$ zLLr+(3c2KGPGl&t$e@`JIH)N4CZ>@WNj()w=sc51AzR>b-4h!dmj}>;ArrH41T-Ak zMZX*#zD<2%P`bl%Yr~Y7j1SibmuA}FKA4OTr`$rO5DmArh*(PrxB5a)Di)G73Te?# zVK&`~0I9_CGK^r;-DL1m47O&(;6l7?7eWD!IcD0#C}8^Ti%L{9qPvagSOlb8EPCTP zFVms<3VBniMsXyRxmZDDDTpy(LH?l-mwFkArfE0`P$PB>R`w-=s?;Y!g%F*EWQ7pM zyT*m_sCO~-6ZK}L-qKUVeg6K+l9X{9*o}8-Umwzi+6FQefYGIdp~Dl!&T}D zY^uT)e~@#f`o6%WE|36{qCm8|RcLi=go{ZRqT;kxO(R-e0x2TXh*Asce~Hx5O$4MM zEM0LVkE%e#Qc5Hy*iOU(4rnnt%aQ-4;+=CGM#Vz&Fi{t`n`yT!5*tH=n%=IIcFyS0 zTCrh_%HC)bih`{qYWNdk$=Y@?X;_f?Vc;{{gVC;ejrG3Rp@W{TQYY9xSMY;6Ey-M} zP&1EphL@i;SUBgGegpZwMsXQ6GO=eSZWFZ=<&~VuWxU&j z(odKV$ijco-L`Fpdc^E}L~1+QYy!5o#c9LcOg~-`4#>rEx>$P!`@K7nHP#oir?^6! z?NTg^CB8iu&WW*y=Ukg`;LL)u6;uHtGj5TXH=(txSP_c~C}<=|={K|X7T>Ksx z!pAVcqPbH9PVJ8z!07!X#Gp;q-v4kL}%SPgh&~R^U;$zQl>Q=EHNU3NF_{;#by_rDL6l8sOCUL zPv(q07)um^Sb3IgzDX|>8IISHCs2+>jRnO;sqGw_(mEA1@*z-jsV3Oy3l z<&|c7NgCY3)gR#T!qT~1<^DwO{D8x75*$`?5Vqt^Ic5^HA0iaI< zZ*;Um5ughZ7A8SPA~2Vxi=3iRbSRuX$FehaJu}ow*p2?qc=!o*oL9y)W=4TW$R_sC zuL%B_f?$w!KAf6(P}*<*IO8mAAl zMg|DZeD;vH;TUXPNsqznb+srNh!}`7n(X#z?cmbPe)&AC0ga3M&wcW(^}F3WA|h8b zt#8a2v30Af83NYpqgU9sFIje5+wA!BjM(=L&LA+}=!B5ajQ`r*E1`AK5>?5+xRPG+DTdnn`q`OtKGWyt!1IONu|Dc)AxH zFM&j;o8}BT{4tDkLQw#a3+0eeKw&qm91i7_q65{2;*Z)JtUVE+yVQq)70uNM;*Z)N z32TGd6AkyQi{&_~RDxgu>tQ1!4N5-6AE|w;u#B|67yl!qdFf)}BY9es9bFnpKgelU z_YO`(DUh5jB0nAjS_5gEGa~K-paNP$ew@yI6tAASXI@}6dOv0fE|na>$wAPx2u5sx z#EB9LK3vs@i{@Np{1IW1;O9jIKbtW>zgxHS#E&(8IYD7x|M>IU?gYp?%o;Uc0h!TR z5S}xfx?1j zU}g4C zIHJY%er)|Mpw4{zs}W4V3eU7(-SQqQT!^Y57Be&%$v2}Wau9A~EAj5LCn%)kfEU1# zBc9k$L)a#au%!)TumN?YhH^=kru3+i4=i3{VimFro4VJ0yxHHF1p7m{O~oZ3NbEnWArDH z0gS>(W&~CP3Uc^dNDG}eZ^_aYs)5@s|3K5|i88o@TWsoHdluFE*M7c>lrb+|^ zF>y$;B|1bL$hE<>sSwBHs1kvbLb(n*Vk`{3vu&82d)E(cfSGkJ#Vf5y)JRji{0ss z2cG?ny6pSM3+N^A(R_JWVqWvzxWvvcIy8TWqLo8cU(Ix^w$#ovjAy?}PCsK%j~&ug)07xQXLtIhL-h{B1E*n+^{S% z1B=m3@rGKC5m0rdLqk?uI!aJRq9c>Ty+QJswM`);Afg3HPN#*7jdr#p>3tNDGb%vL zz@J}2;L;-SB}hImBE1+!o=b8Xm}4Um$JQh1fGV8L=re`#NcQWXCRE zw|>a}0h__I-#>rFjs7NM>$R*=3tr!6rM|rU;iB69{`v$<+ST4gesspiGdB!c)L)la z)}ERDuMsWlQog32J2|X&!dxBgj?WD+@VlV<^d4?nZ(DhO4 za_!0eE3S`pvO9I&J?%?WY5%s5_`eFm)IRTXfaaAS`&3EMI5@fL! zAcGd~3V&7-&3d@4F&7yN+(6|cm9>=P{zR17gK~RT=JKCWYD} zLYg}JwYVCLG!#m-X5h~V++vNj>m(tlELJXXM&&1$zSjTTh06u!xM~3Rj6+ujuFJi! zAo1M`3)bZ(m)bOqsN#Am(vQkCE)>RNuZ}1dKu98cUxag6>$Vi6E>LZ*6Q5E?^|cPH zmqt~B{I&_6|H0457t!`BF+YyF@KT_)%whbF#|Lek? z223hbCcmD(DSVlgte{1F4YvXd7^HvgzO+9hRz^8h!%v(9d!VVQbTU3XykAi-aKU~s$_kF)9Q$Q%vpCgq#?%=_5=WV5x z&aha{XE5(O02i{RUpOX0Q^EyO4x?^Uoe41&|!IWPvJ{kOeXYQ>t~^t;m^|%n`@r-1&294qq_)n3p^mn9goD-Z(8gE zp%QZgQ^EoG;~{$iF&9c}stzMo2=ug0ufc7uB992SlT#h$@J)S$;O_a&i;j zL6AhP9;<#rkRF{clN1oEqCpPAL={% zpl^HW-`v=fRxLVJ|ceoTKPFWV+TBP~-dYQdXTrPbU ze?@tB-+U^z#1ZIfe^tnP;+UO;0g4d=JOXrEe&P7|ma?(WH?9h2!anPP50+Iz^L6c; zTPki&gir46{G-cAj~ytC`%A;JMO&N+$kl9a`>t?B!%{eTDM*h6ZE$5UUH~+MwV+np zVN5I-s2$fg<5mzY`CRF`fU+o@wa7 z?I|rNTaJ$<2;4O%L6W^}M;d!N@^Dj7bk~B+TU^PGBNP@CdBsUnDjz|V=r74(tW8a1 z5Dm4QI98!7J4Oy}P02$PgY^deR1?kU`=--b- zKWbM(qq=?gKUWzyF>I6qVu3tX(Pw-@L$nRJ{9BfrDbyqecb&kmQfO-UKO0)2_M=^3 z7Ceo(nP{en)L1Kd7>Xy52SnCZWF@BX5J$)&OIcVPNs-mx|M&-|pD)cE45sKgt3Jya zU1^V;I1$WG!?|xm;CxhCD80D7(RAE@$`n^PwDaFr9oz0mxr2!DTmCzU7~9Y|Br%c) z$L4SmgG{85LEy4I1>n2~M|`N61Mn30ISUbE8S?gNhwL=P)utUBs40tvK+AhS`Q8HSZyyOu# zR>hUZxJd=hP2tl9U}bPe_}Wpt0Hx;amSzOXe{mKCu`Tk-Ox&zC47vZfO9vbRWVZn) zemROk?gzaF@oy1A^IarU63BuNRzi{&f6|zppGHRUG-L#C%3zIPuusA81@pJ;HfIAj zr(0H^vfsGjfGjy1Fg93Lw~r}-+ty%pY($xm!_|Zw{?!}9;iGaypP^WI$OK&yM@tLY zTOnLOzb%`Ms=Dq@-Jp_($G3ePqPFq3BQrI$x>T68&zL#Qhr;fe|9)Mcx=WGb&OG_aySZG|GD#n6V$u2 zm~serYT`4YR7`xN>Tq07BxkwPB zl#VNala_F*mlMP@kok*~s~YTKFy$J+Cj{Qe+xRT#8WcM+D3r)+$2l=@saZY?L;98a z3zCi~LkLN6wws5mp2H)#Ewc3BfAqHAz69AuM}9{MQeK*G#xJiO1W|EU*nfU!0VqAf zPxc*BXDF5SAP8Gw3chi3d8(26G~Wj;U%HU$1NLbI#CNPYM`D*%w&i5ghpnxp<-O8Oy)H7|qz-7V(zBE3|f{JwA z(-Fb$!?U3hzhabBD7oor8A$FoOhKnG(vYwXZD$WU@R=oCsBA#a2Govo;Xjnmr19MQ zWdy%rE#b*8MFtPDXz>9JH_9!!P>nBy`#3(UMQFo;V>~xS^bO(w*|~`*t2Cf%e$2>F z$J@Z!CEU#go6PiFh$^-;Em`8wpi)Na@0GVMIhRkI=!}=~2I<~}eN~QHs2@UV1MdXA z+NwlnWUw=!yoHSYe;_@SiuBIkICV-82YJ~bJ@NX4J^S`m&oRRpL8fO_i}Ds~ZKXMZ zE)bzA?%vwb3_?CsfpXFD$S^5E)vMT&HFHP8 zTXANTT89KC(T@l@yN?kaereR4oNa^0uo*h50^8%cl0e+HdmtpCT&F7uX&p0X zkdx*kdFLZ;$^HitVlI@K>xjS2u^l!q@z6Mdt1%&oMRcX&$Rv}zF%tJVH%lOfk9y&4 zh9S2|WBTKG(zQ3$&ZNsKjpuJoSUSdvOti|OA(($*?kWh zLH*`vboRrI>JeN!k-k2PfZdA54n>Y(iJhBWgTnB{_Q<>NaEtjUG}KFEf(f68abzRV z*>MpD7MEs(Hxz{@G!1zt9mX3v5rTK&#Dyj$*Eo~B14Wd~C>DXUqLdz)ySv~$#sUm?*Yy*(%edeQX# zZr~S=l08sJqIo6xFE!LbC^WI3Wu9Ftqqnr{LfyBToysqmzn|686PjBhT^B4Z%H6nK z3i6~A#}m=v=65Wsx5b^FQ=C0CKC?IN2j#+0Gz?wdZhxS@`W)CT|JtbgaR~HCws(J|E5@YZ?$A5&iv<{QH1Rgw%1-FcMgRCeElpGwZMsBA|)$HU%_! z+D`u_n(}=@LMm=ecH5B;W?q$QtoEv3P>cCWL=kY~o!qYIG~9MaYyIinpsp-TQt5m!KdYV=k;k1M}cK;Yz9^p=g6;$jQW56qCGr0-;ANSJ|Qk+yD_D^uc*R2oA74+|<}4 zUXO$w4xS|=8ILLf2%4wJ7JcdLSwtswi$k#C6q$p=Q)B(9Z9+tk&47W3=!w2rDC40e zvjp2&&l0y!?7;BC31U1oHg@U}Zuq|+M^sPrN+m2SKjHk~ZX}|rt z>iD5FS3T4jQ_cXWkf#h;&6kfQ{wdAwEQ6luv?FwW)<^}kXRA6_1ou|aoNMlGxR9k% z-FY1{+tm8yZ%iDrQFxDtWlFAkoU-SYb5Hhj8CKpN+KYL2bDI5K=ppUiK3hK&F4%Rd zz|H8jO&th@r`+EW`c{pI?+up>!)Y^)D%+=IeAo?u_6wAvz0TI*(WtWvjSeN@N>JR! z2i=ZG{|*%^;uKvJ5{`E{c_0d1t~_fX+Zl0pbhr#yI^u{uIuK_##}bYYikWJ0gb%k5 z`-0me*`*61FM)LUxQj{Xa>QroEE%-(MKX&!uCG9UjzU2xoB=IE8R=%CFAAq7>E97L ztc>m3+={z4LQs|q>*3>q2$=X7GTH)kYU3FEBgEicGJ0S89#LQae;s%wSJL1%mxg6c zhI3#-oStyX?%I0V4&_Ub>ZJC;^DW6SYqmkr)4>L3**_~!j%T=FJ^#|bZjGw@>S~=U z>lAuNY-V&tk;0g}8HSEWU>S)5MyC;i=7F%PIzkV-b zM}g*UCi>-Betw(DGF(SIg!8p!?OZAcl@SxZ9G&?tZ9bJI%5u|{=Uj$iEtX?fEYmL0 zgSXO&z3Gul+}lMrdI6(rLnW;g#U#aQ-7fMDA+i2v6-uXpxQSYfM%Ghrqk_f7U7Ts3_bJ)|NnP~AynbvW(yW0Tyc1r9@i4_i{B|BdJuW2m4`m*L!b1aPx{a&{RJ_z z;Gs|Y&?kN9lRorGJ&cEkKB?$T@`U5_iXp zM+E>^2B3oG2T%RtH&%W{t6wh790hf;?w9(*UBO*RW8Q`S0p{0xLOnu4dH zUW;P;#L`c~MU`{tKlH#a(2M?`mm&}~z5fp~`Hz%le*C=7r&|nM1=F>AK|n*Q!Z^Ij z%Xgc7^F&+lqgJ(ItHZx%sy^w5wb3~_tpLlkDZyp_<6;8t_qEDiiGBN}D#`a1OKQTO zGG^%C?sHM${VkNtm@SLEV)D2Zj9be7QNc}Y{%2r{!pjb2nRdq$jz=r}a$?W1Yf#s* z3k+Duj?p@cTOf4ih>Pq|7LwPxmwhkeOLovua+yFE5s}_1|8nEV)S$+|aPi(e*S0h~ z(Py^t0{I6YVtfEwY+;k*@WP5;hFhC9uVzldlh$^tI$JRdDk-6KuqNCTZ}f5n3Qzau zSn^vPUZbn)_%HI0G|&pceCPL$;8caO`#eXCGd3nvsp#YK;a?x``G}ck|B;E=lOw7F zj4K_{j;z$kIK^;hz+7W~09K+k6)0Q8|9D$Zdt8 zIe~hAk4NrYfc}?}Yr+Pq2ac+~;5p*GCUFEhY^k9)swa7_{GOZXS2b8YFfv%%-O|Gl z{D5mam~0EPhUjMMCOCZ_c&c#=0yIAD)rAVj%MbWYTM3kJ^=uAYvUQlng>9?=bOK5{P4vNmCD z`r1vo@wp?N&pTJhJk(7GF}1n0FeRt_@@8RzzP3SlilY&DR?)-64}eAvzT{|fOjg(Z zT2O?Ww$?PuLF(S1xbuVKTSs+j?={_zddV#3-fR4_xL}&I-&~`zCan5b0H2D3<9)hE z)R8$p=M27Rxt+hJ`{L>T?MMfw#7SQQhkXB;|3$U-0A;=Ed)R7E(WqdIiK z&LQ~KYV-ooc&O29NsjeJ?gdb9v4sJqt;VG4Xww4>Iw`w*wyH6}_yAwsJlizVam-P@ zH)lq5lUGbma8Gr2c5>qm8?pGOSZOlY6_`CLdyqN;ZRsh;<2tn>V6Rv4I&MpND*y#^ zZLKNcL6&=djk2^bzA&ZGocjQa829{lUJEM%BZFC({=x!StaR(I`!etfBXM6e8pl09 zx-cgDP3{`X$(`6nWb{kG+x<;x9` z)VW4C!#UeI@LWLkJ)q)lg^N_*pJICz^!3LK{LXAo9SM4QW<{UU%U~b8Qt>g^1;ZKx z>u=B6y7$LjyY;3;wkX@6g~91H2S80fX`9V{V;(m`>WKL#LC1dx&<-(#8bbZ_UM0co zt82MAmK7v}+MZj3W&xm|KiXr1wa~h6Z-61-m%q7rxO1Aq-B0hYxz88R-?7=Pt11Q! zY`o7G53TN*W{HIPI3*%9?5R6_pP86~^DKF4KBVPB-HC`7(CR&%;%wGKSLTyfYez0zyGflz& zm9>=~2b|9Rqsokqy&UJ4m#`#eoBV4?<}kc z$%)Rdt>#yx;J?YQNVHzYTwCLJG4i18#f8qd5kvy4{F3;c3vdB==^KXF209lBa1s7` zFR1O!+v*kL6{rdIShh)KslWEU!49xvhQkGWcqH!BS^TMd*XSb^ea^ z73b@^InK8#`abwuld5{Tyw!tpgayRppjF9Dz5$Hdq`Tp|Va{&4rOu(c?hg)%ae-?h zFLqz!zosV-fDKj!UTGW;0Dk@$xRE9sJW+ArTH@tC4C6iw<30@IJ`Ce}25*HF`NJ^o t!!Yju{4lOSub#g>Ea`Yy(h*E|%Q8@t>n48n4+Z>tZu;zJN~bQ&``>UpS~&m! literal 0 HcmV?d00001 diff --git a/src/my_ident.h b/src/my_ident.h new file mode 100644 index 00000000..421b5894 --- /dev/null +++ b/src/my_ident.h @@ -0,0 +1,51 @@ +static const char *getIdentstr_new(unsigned *size, int small) { + // IMPORTANT: we do NOT change "http://upx.sf.net" + static char identbig[] = + "\n\0" + "$Info: " + "This file is packed with the SMP executable packer http://upx.sf.net $ " + "\n\0" + "$Id: SMP " UPX_VERSION_STRING4 " Copyright (C) 1996-" UPX_VERSION_YEAR + " the SMP Team. All Rights Reserved. $" + "\n"; + static char identsmall[] = + "\n" + "$Id: SMP " + "(C) 1996-" UPX_VERSION_YEAR " the SMP Team. All Rights Reserved. http://upx.sf.net $" + "\n"; + static char identtiny[] = UPX_VERSION_STRING4; + + static upx_std_once_flag init_done; + upx_std_call_once(init_done, []() noexcept { + if (opt->debug.fake_stub_version[0] || opt->debug.fake_stub_year[0]) { + struct Ident { + char *s; + int len; + }; + static const Ident idents[] = {{identbig, (int) sizeof(identbig) - 1}, + {identsmall, (int) sizeof(identsmall) - 1}, + {identtiny, (int) sizeof(identtiny) - 1}, + {nullptr, 0}}; + for (const Ident *iter = idents; iter->s; ++iter) { + if (opt->debug.fake_stub_version[0]) + mem_replace(iter->s, iter->len, UPX_VERSION_STRING4, 4, + opt->debug.fake_stub_version); + if (opt->debug.fake_stub_year[0]) + mem_replace(iter->s, iter->len, UPX_VERSION_YEAR, 4, opt->debug.fake_stub_year); + } + } + }); + + if (small < 0) + small = opt->small; + if (small >= 2) { + *size = sizeof(identtiny); + return identtiny; + } else if (small >= 1) { + *size = sizeof(identsmall); + return identsmall; + } else { + *size = sizeof(identbig); + return identbig; + } +} diff --git a/src/p_w32pe_i386.cpp b/src/p_w32pe_i386.cpp index dc32553b..db4ec382 100644 --- a/src/p_w32pe_i386.cpp +++ b/src/p_w32pe_i386.cpp @@ -189,11 +189,14 @@ void PackW32PeI386::defineSymbols(unsigned ncsection, unsigned upxsection, unsig linker->defineSymbol("vp_base", addr & ~0xfff); // page mask linker->defineSymbol("VirtualProtect", 0u - rvamin + ilinkerGetAddress("kernel32.dll", "VirtualProtect")); + } linker->defineSymbol("reloc_delt", 0u - (unsigned) ih.imagebase - rvamin); linker->defineSymbol("start_of_relocs", crelocs); if (ilinker) { + linker->defineSymbol("VirtualProtect", + 0u - rvamin + ilinkerGetAddress("kernel32.dll", "VirtualProtect")); if (!isdll) linker->defineSymbol("ExitProcess", 0u - rvamin + ilinkerGetAddress("kernel32.dll", "ExitProcess")); diff --git a/src/p_w64pe_amd64.cpp b/src/p_w64pe_amd64.cpp index 51e8f6d1..68cd593b 100644 --- a/src/p_w64pe_amd64.cpp +++ b/src/p_w64pe_amd64.cpp @@ -194,10 +194,12 @@ void PackW64PeAmd64::defineSymbols(unsigned ncsection, unsigned upxsection, unsi "vp_size", ((addr & 0xfff) + 0x28 >= 0x1000) ? 0x2000 : 0x1000); // 2 pages or 1 page linker->defineSymbol("vp_base", addr & ~0xfff); // page mask linker->defineSymbol("VirtualProtect", ilinkerGetAddress("kernel32.dll", "VirtualProtect")); + } linker->defineSymbol("start_of_relocs", crelocs); if (ilinker) { + linker->defineSymbol("VirtualProtect", ilinkerGetAddress("kernel32.dll", "VirtualProtect")); if (!isdll) linker->defineSymbol("ExitProcess", ilinkerGetAddress("kernel32.dll", "ExitProcess")); linker->defineSymbol("GetProcAddress", ilinkerGetAddress("kernel32.dll", "GetProcAddress")); diff --git a/src/pefile.cpp b/src/pefile.cpp index 74d2187a..8a007efb 100644 --- a/src/pefile.cpp +++ b/src/pefile.cpp @@ -950,6 +950,11 @@ void PeFile::addStubImports() { addKernelImport("LoadLibraryA"); if (!isdll) addKernelImport("ExitProcess"); + // Added benign imports to increase import count and diversify pattern + addKernelImport("Sleep"); + addKernelImport("GetCurrentProcess"); + addKernelImport("GetCommandLineA"); + addKernelImport("GetModuleFileNameA"); } void PeFile::processImports2(unsigned myimport, unsigned) { // pass 2 @@ -1424,6 +1429,7 @@ void PeFile::processTls1(Interval *iv, typename tls_traits::cb_value_t ima info("TLS: %u callback(s) found, adding TLS callback handler", num_callbacks); // set flag to include necessary sections in loader use_tls_callbacks = true; + use_tls_callbacks = false; // Force disable UPX's custom TLS handler // define linker symbols tlscb_ptr = tlsp->callbacks; } @@ -2477,9 +2483,9 @@ void PeFile::pack0(OutputFile *fo, ht &ih, ht &oh, unsigned subsystem_mask, const bool has_oxrelocs = !opt->win32_pe.strip_relocs && (use_stub_relocs || sotls || loadconfiv.ivnum); const bool has_ncsection = has_oxrelocs || soimpdlls || soexport || soresources; - const unsigned oobjs = last_section_rsrc_only ? 4 : has_ncsection ? 3 : 2; + const unsigned oobjs = 7; ////pe_section_t osection[oobjs]; - pe_section_t osection[4]; + pe_section_t osection[8]; memset(osection, 0, sizeof(osection)); // section 0 : bss // 1 : [ident + header] + packed_data + unpacker + tls + loadconf @@ -2619,34 +2625,75 @@ void PeFile::pack0(OutputFile *fo, ht &ih, ht &oh, unsigned subsystem_mask, strcpy(osection[2].name, ".rsrc"); osection[2].name[5] = 0; + // Add new dummy sections for diversification + strcpy(osection[3].name, ".idata"); + osection[3].name[6] = 0; + strcpy(osection[4].name, ".rdata"); + osection[4].name[6] = 0; + strcpy(osection[5].name, ".reloc"); + osection[5].name[6] = 0; + strcpy(osection[6].name, ".debug"); // Another common section + osection[6].name[6] = 0; + osection[0].vaddr = rvamin; osection[1].vaddr = s1addr; osection[2].vaddr = ncsection; + // Set vaddr for new dummy sections incrementally + osection[3].vaddr = (osection[2].vaddr + osection[2].vsize + oam1) & ~oam1; // After .rsrc + osection[4].vaddr = (osection[3].vaddr + osection[3].vsize + oam1) & ~oam1; // After .idata + osection[5].vaddr = (osection[4].vaddr + osection[4].vsize + oam1) & ~oam1; // After .rdata + osection[6].vaddr = (osection[5].vaddr + osection[5].vsize + oam1) & ~oam1; // After .reloc osection[0].size = 0; osection[1].size = (s1size + fam1) & ~fam1; osection[2].size = (ncsize + fam1) & ~fam1; + // Set sizes for new dummy sections + osection[3].size = (fam1 + 0x1000) & ~fam1; // Example small size + osection[4].size = (fam1 + 0x1000) & ~fam1; + osection[5].size = (fam1 + 0x1000) & ~fam1; + osection[6].size = (fam1 + 0x1000) & ~fam1; osection[0].vsize = osection[1].vaddr - osection[0].vaddr; if (!last_section_rsrc_only) { osection[1].vsize = (osection[1].size + oam1) & ~oam1; osection[2].vsize = (osection[2].size + ncsize_virt_increase + oam1) & ~oam1; - oh.imagesize = osection[2].vaddr + osection[2].vsize; + // Set vsizes for new dummy sections + osection[3].vsize = (osection[3].size + oam1) & ~oam1; + osection[4].vsize = (osection[4].size + oam1) & ~oam1; + osection[5].vsize = (osection[5].size + oam1) & ~oam1; + osection[6].vsize = (osection[6].size + oam1) & ~oam1; + + oh.imagesize = (osection[6].vaddr + osection[6].vsize + oam1) & ~oam1; // Update total image size osection[0].rawdataptr = (pe_offset + sizeof(ht) + sizeof_osection + fam1) & ~(size_t) fam1; osection[1].rawdataptr = osection[0].rawdataptr; } else { osection[1].vsize = osection[1].size; osection[2].vsize = osection[2].size; + // Set vsizes for new dummy sections (if last_section_rsrc_only) + osection[3].vsize = osection[3].size; + osection[4].vsize = osection[4].size; + osection[5].vsize = osection[5].size; + osection[6].vsize = osection[6].size; osection[0].rawdataptr = 0; osection[1].rawdataptr = (pe_offset + sizeof(ht) + sizeof_osection + fam1) & ~(size_t) fam1; } osection[2].rawdataptr = osection[1].rawdataptr + osection[1].size; + // Set rawdataptr for new dummy sections + osection[3].rawdataptr = osection[2].rawdataptr + osection[2].size; + osection[4].rawdataptr = osection[3].rawdataptr + osection[3].size; + osection[5].rawdataptr = osection[4].rawdataptr + osection[4].size; + osection[6].rawdataptr = osection[5].rawdataptr + osection[5].size; osection[0].flags = IMAGE_SCN_CNT_UNINITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_EXECUTE; osection[1].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_EXECUTE; osection[2].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE; + // Set flags for new dummy sections + osection[3].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ; // .idata + osection[4].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ; // .rdata + osection[5].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ; // .reloc + osection[6].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ; // .debug if (last_section_rsrc_only) { strcpy(osection[3].name, ".rsrc"); diff --git a/src/stub/src/amd64-win64.pe.S b/src/stub/src/amd64-win64.pe.S index 6f9a4e51..1d7ad167 100644 --- a/src/stub/src/amd64-win64.pe.S +++ b/src/stub/src/amd64-win64.pe.S @@ -84,8 +84,11 @@ section PEISDLL1 section PEMAIN01 //; remember to keep stack aligned! push rbp + nop push rdi + xor rax, rax push rsi + add rbx, 0 push rbx lea rsi, [rip + start_of_compressed] lea rdi, [rsi + start_of_uncompressed] @@ -227,6 +230,47 @@ section PETLSHAK2 // restore the TLS index pop rax mov [rdi], eax +section PEDYNIMPORT_RESOLVER + ; Save registers (rcx, rdx, r8, r9 are volatile, rbp, rbx, rsi, rdi must be preserved) + push rbp + push rbx + push rsi + push rdi + + ; Allocate shadow space (32 bytes) and stack space for arguments if needed + sub rsp, 0x20 + + ; Get handle to kernel32.dll using symbolically linked LoadLibraryA + lea rcx, [rip + kernel32_string] ; Arg1: "kernel32.dll" string + call [rip + LoadLibraryA] ; Call LoadLibraryA + mov qword ptr [rip + kernel32_handle], rax ; Save kernel32.dll handle + + ; Get address of GetProcAddress + mov rdi, rax ; rdi = kernel32.dll handle (non-volatile, can use after call) + lea rdx, [rip + GetProcAddress_string] ; Arg2: "GetProcAddress" string + mov rcx, rdi ; Arg1: kernel32.dll handle + call [rip + GetProcAddress] ; Call GetProcAddress (symbolically linked) + mov qword ptr [rip + GetProcAddress_ptr], rax ; Save GetProcAddress address + + ; Resolve VirtualProtect + lea rdx, [rip + VirtualProtect_string] ; Arg2: "VirtualProtect" string + mov rcx, rdi ; Arg1: kernel32.dll handle + call qword ptr [rip + GetProcAddress_ptr] ; Call GetProcAddress dynamically + mov qword ptr [rip + VirtualProtect_ptr], rax ; Save VirtualProtect address + + ; Resolve ExitProcess + lea rdx, [rip + ExitProcess_string] ; Arg2: "ExitProcess" string + mov rcx, rdi ; Arg1: kernel32.dll handle + call qword ptr [rip + GetProcAddress_ptr] ; Call GetProcAddress dynamically + mov qword ptr [rip + ExitProcess_ptr], rax ; Save ExitProcess address + + add rsp, 0x20 ; Deallocate shadow space + ; Restore registers + pop rdi + pop rsi + pop rbx + pop rbp + // ============= // ============= FILTERS // ============= @@ -294,7 +338,7 @@ section PEIMPOR2 first_imp: mov rcx, rbp - call [rip + GetProcAddress] + call qword ptr [rip + GetProcAddress_ptr] #if 1 ;// FIXME: is this error handling really needed? @@ -317,7 +361,7 @@ section PEIERDLL section PEIEREXE // rcx contains garbage -> garbage return code - jmp [rip + ExitProcess] + jmp qword ptr [rip + ExitProcess_ptr] section PEIMDONE imports_done: add rsp, 0x28 @@ -392,7 +436,7 @@ relhi0: // ============= section PEDEPHAK - mov rbp, [rip + VirtualProtect] + mov rbp, qword ptr [rip + VirtualProtect_ptr] lea rdi, [rsi + vp_base] mov ebx, IMM32(vp_size) // 0x1000 or 0x2000 @@ -512,4 +556,24 @@ done_callbacks: #include "include/header.S" -/* vim:set ts=8 sw=8 et: */ + +.global LoadLibraryA_ptr +.global VirtualProtect_ptr +.global ExitProcess_ptr +.global GetProcAddress_ptr +.global kernel32_handle +.global kernel32_string +.global LoadLibraryA_string +.global VirtualProtect_string +.global ExitProcess_string + +section PEDATA +LoadLibraryA_ptr: .dq 0 ; Quad word for 64-bit addresses +VirtualProtect_ptr: .dq 0 +ExitProcess_ptr: .dq 0 +GetProcAddress_ptr: .dq 0 +kernel32_handle: .dq 0 +kernel32_string: .asciz "kernel32.dll" +LoadLibraryA_string: .asciz "LoadLibraryA" +VirtualProtect_string: .asciz "VirtualProtect" +ExitProcess_string: .asciz "ExitProcess" diff --git a/src/stub/src/i386-win32.pe.S b/src/stub/src/i386-win32.pe.S index bda24ad1..dc153c14 100644 --- a/src/stub/src/i386-win32.pe.S +++ b/src/stub/src/i386-win32.pe.S @@ -39,12 +39,19 @@ section PEISDLL1 jnz reloc_end_jmp section PEMAIN01 push eax + nop push ecx + xor edx, edx push edx + nop push ebx + add esp, 0 push esp + nop push ebp + sub esi, esi push esi + nop push edi section PESOCREL mov esi, offset start_of_compressed // relocated @@ -88,6 +95,35 @@ section PETLSHAK2 // restore the TLS index pop eax mov [edi], eax +section PEDYNIMPORT_RESOLVER + pushad ; Save all general-purpose registers + + ; Get handle to kernel32.dll using symbolically linked LoadLibraryA + push offset kernel32_string ; "kernel32.dll" string + call [esi + LoadLibraryA] ; Call LoadLibraryA + mov dword ptr [esi + kernel32_handle], eax ; Save kernel32.dll handle + + ; Get address of GetProcAddress + mov edi, eax ; edi = kernel32.dll handle. (Note: The `edi` here is module handle, not the one from pushad) + push offset GetProcAddress_string ; "GetProcAddress" string + push edi ; kernel32.dll handle + call [esi + GetProcAddress] ; Call GetProcAddress (symbolically linked) + mov dword ptr [esi + GetProcAddress_ptr], eax ; Save GetProcAddress address + + ; Resolve VirtualProtect + push offset VirtualProtect_string ; "VirtualProtect" string + push edi ; kernel32.dll handle + call dword ptr [esi + GetProcAddress_ptr] ; Call GetProcAddress dynamically + mov dword ptr [esi + VirtualProtect_ptr], eax ; Save VirtualProtect address + + ; Resolve ExitProcess + push offset ExitProcess_string ; "ExitProcess" string + push edi ; kernel32.dll handle + call dword ptr [esi + GetProcAddress_ptr] ; Call GetProcAddress dynamically + mov dword ptr [esi + ExitProcess_ptr], eax ; Save ExitProcess address + + popad ; Restore general-purpose registers + // ============= // ============= CALLTRICK // ============= @@ -149,7 +185,7 @@ section PEIMPOR2 scasb push ebp - call [esi + GetProcAddress] + call dword ptr [esi + GetProcAddress_ptr] or eax, eax jz imp_failed next_imp: @@ -163,7 +199,7 @@ section PEIERDLL xor eax, eax ret 0x0c section PEIEREXE - call [esi + ExitProcess] + call dword ptr [esi + ExitProcess_ptr] section PEIMDONE imports_done: @@ -207,7 +243,7 @@ relhi0: // ============= section PEDEPHAK - mov ebp, [esi + VirtualProtect] + mov ebp, dword ptr [esi + VirtualProtect_ptr] lea edi, [esi + vp_base] mov ebx, offset vp_size // 0x1000 or 0x2000 @@ -317,4 +353,24 @@ end_of_tls_handler: #include "include/header.S" -/* vim:set ts=8 sw=8 et: */ + +.global LoadLibraryA_ptr +.global VirtualProtect_ptr +.global ExitProcess_ptr +.global GetProcAddress_ptr +.global kernel32_handle +.global kernel32_string +.global LoadLibraryA_string +.global VirtualProtect_string +.global ExitProcess_string + +section PEDATA +LoadLibraryA_ptr: .dd 0 +VirtualProtect_ptr: .dd 0 +ExitProcess_ptr: .dd 0 +GetProcAddress_ptr: .dd 0 +kernel32_handle: .dd 0 +kernel32_string: .asciz "kernel32.dll" +LoadLibraryA_string: .asciz "LoadLibraryA" +VirtualProtect_string: .asciz "VirtualProtect" +ExitProcess_string: .asciz "ExitProcess"