stealthy #1

Open

jory wants to merge 0 commits from stealthy into devel

pull from: stealthy

merge into: jory:devel

jory:devel

jory:test-misc

jory:jreiser-riscv64

jory:master

Conversation 0 Commits - Files Changed -

jory commented 2025-12-13 12:52:59 +00:00

Owner

Copy Link

All changes tested (exe and dll), all seems to work fine

All changes tested (exe and dll), all seems to work fine

jory added 6 commits 2025-12-13 12:53:00 +00:00

UPX evasion modifications for malware analysis testing ... d7b37970d1

- Modified section layout to increase BSS size for 'high BSS' heuristic
- Changed import order to LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess
- Added dummy imports (GetCurrentProcess, GetModuleHandleA) to break patterns
- Modified section flags to evade UPX detection heuristics
- Maintains DLL functionality while altering detection signatures

Changes are for isolated testing environment analysis purposes only.

Advanced UPX evasion techniques for malware analysis ... 12b648b963

- Modified UPX version strings to remove 'UPX' references
- Changed 'UPX' to 'PACK' in identification strings
- Added 64 bytes of random padding to break static analysis patterns
- Modified PE timestamp to fixed fake value (0x12345678)
- All changes maintain DLL functionality while evading detection

Combined with previous high BSS and import order modifications for comprehensive evasion.

Fixed DLL functionality by removing problematic evasion techniques ... 477535d32d

Working evasion features maintained:
- High BSS modification (increased .text section size)
- Modified import order (LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess)
- Dummy imports (GetCurrentProcess, GetModuleHandleA)
- Section flag modifications to break UPX patterns
- UPX string removal (changed to 'PACK')
- Modified timestamp (0x12345678)

Removed problematic features:
- Entry point randomization (caused execution issues)
- Section size randomization (broke memory mapping)
- Fake export table (broke DLL loading)
- Random file padding (corrupted file structure)

Focus on stable evasion techniques that maintain functionality.

Safe evasion techniques working - libphotoshop_packed_safe2.dll functional ... 97566c3344

Working features confirmed:
- High BSS modification (increased .text section size)
- Modified import order (LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess)
- Enhanced dummy imports (GetCurrentProcess, GetTickCount, QueryPerformanceCounter, GetModuleHandleA)
- Section flag modifications to break UPX patterns
- UPX string removal (changed to 'PACK')
- Modified timestamp (0x12345678)

Ready for additional evasion techniques based on should_evade.txt analysis.

Progress: UPX evasion - breaks most detection patterns ... 65a57ceea9

- Modified import counts (8 imports for EXE, 5 for DLL)
- Added NOP to entry point to break byte patterns
- UPX! string replacement via evasion script
- Overlay padding for entropy

Remaining: Generic NOP at EP detection needs more sophisticated entry point modification

Complete UPX evasion implementation ... 16d1ec0fff

- Breaks all detection patterns from should_evade.txt detection script
- Modified import counts: 8 imports for EXE, 5 for DLL (breaks 2-6 pattern)
- Sophisticated entry point modification using stack manipulation instead of generic NOP
- Avoids 'Generic NOP at EP' detection
- String obfuscation via evasion script (UPX! → random)
- Overlay padding for entropy analysis evasion
- Maintains full functionality while evading detection

Both EXE and DLL files now evade detection completely.

Some checks failed

Hide all checks

CI / Rebuild stubs (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }}-0 (ubuntu-22.04) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }}-0 (ubuntu-22.04-arm) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }}-0 (ubuntu-24.04) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }}-0 (ubuntu-24.04-arm) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }} (ubuntu-22.04, true) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.os) }} (ubuntu-24.04, true, true) (push) Has been cancelled

Details

CI / ${{ format('{0} {1}{2}', matrix.os, matrix.xcode_version && 'xcode-' || '', matrix.xcode_version) }} (gcc-13, g++-13, macos-14, true) (push) Has been cancelled

Details

CI / ${{ format('{0} {1}{2}', matrix.os, matrix.xcode_version && 'xcode-' || '', matrix.xcode_version) }} (gcc-14, g++-14, macos-15, true) (push) Has been cancelled

Details

CI / ${{ format('{0} {1}{2}', matrix.os, matrix.xcode_version && 'xcode-' || '', matrix.xcode_version) }} (gcc-14, g++-14, macos-15-intel, true) (push) Has been cancelled

Details

CI / ${{ format('{0} {1}{2}', matrix.os, matrix.xcode_version && 'xcode-' || '', matrix.xcode_version) }} (gcc-15, g++-15, macos-26, true) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-11-arm64, windows-11-arm, arm64, 2022) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-11-arm64ec, windows-11-arm, true, arm64, 2022) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-2022-amd64, windows-2022, amd64, 2022) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-2022-i386, windows-2022, amd64_x86, 2022) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-2025-amd64, windows-2025, amd64, 2022) (push) Has been cancelled

Details

CI / ${{ format('{0}', matrix.name) }} (windows-2025-i386, windows-2025, amd64_x86, 2022) (push) Has been cancelled

Details

CI / ${{ format('windows-bh {0}', matrix.name) }} (-arm64EC, /machine:arm64ec, arm64ec-win64-vs2025, windows-2025, amd64_arm64, 2022) (push) Has been cancelled

Details

CI / ${{ format('windows-bh {0}', matrix.name) }} (amd64-win64-vs2025, windows-2025, amd64, 2022) (push) Has been cancelled

Details

CI / ${{ format('windows-bh {0}', matrix.name) }} (arm64-win64-vs2025, windows-2025, amd64_arm64, 2022) (push) Has been cancelled

Details

CI / ${{ format('windows-bh {0}', matrix.name) }} (i386-win32-vs2025, windows-2025, amd64_x86, 2022) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (-march=i586, i386-linux-gnu.2.17) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (-march=i586, i386-linux-gnu.2.3.4) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (aarch64-macos-none) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (aarch64-windows-gnu) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (alpine:3.18, qemu-aarch64, -fPIE, aarch64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (alpine:3.18, qemu-x86_64, -fPIE, x86_64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (i386-windows-gnu) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-aarch64, aarch64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-arm, arm-linux-musleabihf) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-armeb, armeb-linux-musleabihf) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-i386, -march=i586, -fPIE, i386-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-i386, -march=i586, i386-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-mips, mips-linux-musleabi) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-mips, mips-linux-musleabihf) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-mipsel, mipsel-linux-musleabi) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-mipsel, mipsel-linux-musleabihf) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-ppc, powerpc-linux-musleabihf) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-ppc64, -fPIE, powerpc64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-ppc64, powerpc64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-ppc64le, -fPIE, powerpc64le-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-ppc64le, powerpc64le-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-riscv64, UPX-UNSUPPORTED, -fPIE, riscv64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-riscv64, UPX-UNSUPPORTED, riscv64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-x86_64, x86_64-linux-gnu.2.17) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-x86_64, x86_64-linux-gnu.2.3.4) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (qemu-x86_64, x86_64-linux-musl) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (x86_64-macos-none) (push) Has been cancelled

Details

CI / ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }} (x86_64-windows-gnu) (push) Has been cancelled

Details

This pull request has changes conflicting with the target branch.

• src/pefile.cpp

View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin stealthy:stealthy

git checkout stealthy

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No Label

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: jory/upx#1

No description provided.