mkpoly is a simple program that can make any executable polymorphic.
The target platform is the Linux operating system.
git clone https://github.com/loreloc/mkpoly.git
cd mkpoly
make
sudo make install
Additionaly, build the example with:
nasm -f elf64 example.asm
gcc -no-pie example.o -o example
In order to use mkpoly, the target executable must contains a DECRYPTOR_SECTION (see mkpoly.inc and example.asm) that is a piece of code that contains the function used by the program to decrypt itself. Also, the section to encrypt must be aligned to 16 bytes and its size must be a multiple of 16. The macro DECRYPTOR_SECTION defines two local labels: .mkpoly_loop and .mkpoly_func that are, respectively, the begin of the decryptor loop and the begin of the decryption function.
mkpoly takes 4 input parameters (all in the hexadecimal format):
- The filename of the binary to make polymorphic
- The offset in the binary file of the section to encrypt
- The size of the section to encrypt
- The offset in the binary file where to place the decrypt function
When executed, the polymorphic engine randomly generates the encryption and the decryption functions. The encryption function is used to encrypt the section specified by the user. The decryption function is placed in the DECRYPTOR_SECTION at the offset specified by the user. So, when the output binary is executed, it will decrypt parts of itself executing the DECRYPTOR_SECTION.
Executing the following commands we know the offset of the section to encrypt (hello), the size of the section to encrypt (the difference between the offsets of the labels hello.end and hello), and the offset in which to place the decrypt function (decrypt.mkpoly_func).
$ objdump -h example | grep -E ".text"
12 .text 00000315 0000000000401060 0000000000401060 00001060 2**4
$ objdump -x example | grep -E "hello|decrypt"
000000000040115e l .text 0000000000000000 decrypt
00000000004011b0 l .text 0000000000000000 decrypt.mkpoly_loop
00000000004011bb l .text 0000000000000000 decrypt.mkpoly_func
00000000004012f0 l .text 0000000000000000 hello
0000000000401300 l .text 0000000000000000 hello.end
This will create a random encrypted version of the program example called example.crypt.
$ mkpoly example 12f0 10 11bb