From c352f0c102b52a0bfa1bec3e152050f418997e6b Mon Sep 17 00:00:00 2001 From: 0xHAX0R <lanegraham3@gmail.com> Date: Tue, 8 Aug 2023 20:01:39 -0700 Subject: [PATCH] Update README.md --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 5f55bd3..b3b3f0c 100644 --- a/README.md +++ b/README.md @@ -336,17 +336,17 @@ Some fields such as e_magic in the DOS header and SizeOfStackCommit / SizeOfStac #### .text section before scramble: - + #### .text section after scramble: - + I cannot show the whole .text section in one screenshot, so i tracked down a section above from a memory dump which was mutated (note that there are generaally hundreds or thousands of these regions which will be mutated depending on the symbol count / complexity of the binary) . -The interrupt padding (0xCC / INT3 on x86 PE files) between symbols is being tracked and permutated to change the appearance of the executable section in memory, which is a big thing , for me at least, as it is very hard to change machine code in a stable / reliable fashion during runtime. +The interrupt padding (0xCC / INT3 on x86 PE files) between symbols is being tracked and permutated to change the appearance of the executable section in memory. -The interrupt3 paddings (0xCC arrays) are regions that the instruction pointer never hits, so they are (almost) safely mutable to any form, the engine permutates them between { INT1, INT3, NOP } for the time being with random seed to accomplish this. +The INT3 paddings (0xCC arrays) are regions that the instruction pointer never hits, so they are (almost) safely mutable to any form, the engine now mutates these regions to random executable machine code which will make it extremely hard to determine where a function / subroutine ends, and which code is valid and executed. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------