[FASM] Self encrypting code 12-04-2014, 04:57 PM
#1
That was an old example how superior the FASM macroses are. It’s a self encrypting code at the moment of parsing.
Explanation: the encrypt macro does XOR 0xAA on every byte between two labels, which is a primitive way to crypt the code. The code on the start label decrypts it.
Source: https://blez.wordpress.com/2012/09/18/se...e-in-fasm/
Explanation: the encrypt macro does XOR 0xAA on every byte between two labels, which is a primitive way to crypt the code. The code on the start label decrypts it.
Code:
; selfencrypt
; 04.07.2008
format PE GUI 4.0
entry start
include "%include%/win32a.inc"
;
; This is the encryption macro.
; It is a simple XOR with 0xAA (10101010 in binary).
;
macro encrypt dstart,dsize {
local ..char,..key,..shift
repeat dsize
load ..char from dstart+%-1
..char = ..char xor $AA
store ..char at dstart+%-1
end repeat
}
section ".code" code readable writeable executable
start:
;
; This will be the only non-encrypted part of the code.
; Here we will decrypt the code at run-time.
;
mov edx,real_start
xor eax,eax
mov ecx,code_size
@@: xor byte [edx],$AA
inc edx
loop @B
real_start:
;
; Everything from here on will be encrypted.
;
stdcall [MessageBox],0,HelloWorld,HelloWorld,MB_ICONASTERISK
stdcall [ExitProcess],0
;
; Encrypt everything from real_start to here.
;
display "Encrypting code... "
code_size = $ - real_start
encrypt real_start,code_size
display "done",13,10
section ".data" data readable writeable import
library kernel32,"kernel32.dll",user32,"user32.dll"
include "%include%/api/kernel32.inc"
include "%include%/api/user32.inc"
HelloWorld db "Hello World!",0
Source: https://blez.wordpress.com/2012/09/18/se...e-in-fasm/