Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
Chemiculs authored Aug 9, 2023
1 parent 3abdd81 commit c352f0c
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -336,17 +336,17 @@ Some fields such as e_magic in the DOS header and SizeOfStackCommit / SizeOfStac

#### .text section before scramble:

![.text before scramble](img/beforescramble.png)
![.text before scramble](img/beforescramblenew.png)

#### .text section after scramble:

![.text before scramble](img/afterscramble.png)
![.text before scramble](img/afterscramblenew.png)

I cannot show the whole .text section in one screenshot, so i tracked down a section above from a memory dump which was mutated (note that there are generaally hundreds or thousands of these regions which will be mutated depending on the symbol count / complexity of the binary) .

The interrupt padding (0xCC / INT3 on x86 PE files) between symbols is being tracked and permutated to change the appearance of the executable section in memory, which is a big thing , for me at least, as it is very hard to change machine code in a stable / reliable fashion during runtime.
The interrupt padding (0xCC / INT3 on x86 PE files) between symbols is being tracked and permutated to change the appearance of the executable section in memory.

The interrupt3 paddings (0xCC arrays) are regions that the instruction pointer never hits, so they are (almost) safely mutable to any form, the engine permutates them between { INT1, INT3, NOP } for the time being with random seed to accomplish this.
The INT3 paddings (0xCC arrays) are regions that the instruction pointer never hits, so they are (almost) safely mutable to any form, the engine now mutates these regions to random executable machine code which will make it extremely hard to determine where a function / subroutine ends, and which code is valid and executed.

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Expand Down

0 comments on commit c352f0c

Please sign in to comment.