Code self-clearing, self-encryption, and decryption

On the first page, article center, hacker tool, hacker School, hacker Technology Forum, guest security training, free channel, Alibaba Cloud, latest updates to rising's online anti-virus service
Baidu simplified traditional Chinese
 
 

Set as Homepage
Add to favorites
Release tutorial
Intrusion detection | IM Security | remote control | cracking encryption | comprehensive tutorial | Security Software | common tools | member zone | video tutorial | one-day tutorial
Information Center | vulnerability announcement | intrusion detection | Network skills | Security Protection | operating system | free resource software download news
 
 

 
Your current location:-hacker animation-> Article center-> Intrusion Detection-> programming code-> Article content exit Login User Management
 
 
CATEGORY navigation
 
 
 
 
· Recommended articles
· Popular articles
· Latest article

 
Popular articles
 
 
 
 
· How To seal others' QQ
· QQ coins-wide...
· Free QB
· [Image and text] QQ creates 400 groups for free
· Remotely cracked your Q in 400 seconds...
· [Note] tips for QQ pet egg
· [Group chart] Give you a picture that never shuts down...
· Again have the opportunity to get free...
· Run the program with the specified permission
· Add QQ VIP
 

 
Related Articles
 
 
 
 
· Sangu news-right...
· Nmap official reference...
· Php injection...
· Anti-virus literacy...
· Introduction to infiltration in China...
· Code self-clearing...
· General and simple...
· TU of the online world...
 
Baidu
 

 
Code self-clearing, self-encryption, and decryption
 
Author: Anonymous Source: Reproduced Release Date: 14:08:45 Author: noangel
Decrease font to increase font color default gray olive green blue brown red

[Add to ViVi] [add to YouNote] [add this page to 365Key] [add this page to bbmao]

Recently developed shells, but the main security of my shells is not written in the topic, so the methods for self-encryption and decryption of codes in delphi are publicly available, very simple.
First, we need to define several processes,
Procedure EncryptCode (Badress, size, key: cardinal); // Badress indicates the encryption start address, size indicates the encryption size, and key indicates the encryption key.
Var
CTemp: cardinal;
Begin
Virtulloc (pointer (Badress), Size, Page_readwrite, Ctemp); // The function name cannot be pulled.
Asm
Push eax;
Push ebx;
Push ecx;
Mov eax, badress;
Mov ebx, size;
Mov ecx, key;
Xor dword ptr ds: [eax], ecx;
Add eax, 4;
Dec ebx;
Db $75, fc; // here may be incorrect. Jump to xor dword ptr ds: [eax], ecx; To pull
Pop ecx;
Pop ebx;
Pop eax;
End;
End;

Encryption and decryption are the same piece of code.
Code clearing
Procedure CleanCode (Badress, size, key: cardinal); // Badress indicates the encryption start address, size indicates the encryption size, and key indicates the encryption key.
Var
CTemp: cardinal;
Begin
Virtulloc (pointer (Badress), Size, Page_readwrite, Ctemp); // The function name cannot be pulled.
Asm
Push eax;
Push ebx;
Push ecx;
Mov eax, badress;
Mov ebx, size;
Mov ecx, key;
Xor dword ptr ds: [eax], 0;
Add eax, 1;
Dec ebx;
Db $75, fc; // here may be incorrect. Jump to xor dword ptr ds: [eax], ecx; To pull
Pop ecx;
Pop ebx;
Pop eax;
End;
End;
Now you can call pull. The calling method is very simple, but it should be noted that encryption code cannot be called in its own process. Of course we use this badress
Call XXXXXXXX;
Pop eax;
Done.
Of course there is still a lot to do. I believe everyone knows.