Adding a few anti-disassembler tricks

Emmanuel Fleury · Emmanuel Fleury · commit f650a0764668 · 2014-06-23T15:54:14.000+02:00
diff --git a/anti-disassembler/Linux/anti-debug/Makefile b/anti-disassembler/Linux/anti-debug/Makefile
@@ -0,0 +1,28 @@
+CFLAGS   = -Wall -Wextra -g
+CPPFLAGS =
+LDFLAGS  =
+
+PTRACE = anti-ptrace
+BREAKPOINT = breakpoint_detection
+
+EXEC = $(PTRACE)-i386 $(PTRACE)-amd64 \
+       $(BREAKPOINT)-i386 $(BREAKPOINT)-amd64
+
+all: $(EXEC)
+
+$(PTRACE)-i386: $(PTRACE).c
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(PTRACE)-amd64: $(PTRACE).c
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(BREAKPOINT)-i386: $(BREAKPOINT).c
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(BREAKPOINT)-amd64: $(BREAKPOINT).c
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	@rm -f *~ $(PTRACE)-i386 $(PTRACE)-amd64 \
+	          $(BREAKPOINT)-i386 $(BREAKPOINT)-amd64
+
diff --git a/anti-disassembler/Linux/anti-debug/anti-ptrace.c b/anti-disassembler/Linux/anti-debug/anti-ptrace.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <sys/ptrace.h>
+
+int
+main ()
+{
+  if (ptrace (PTRACE_TRACEME, 0, 1, 0) == -1)
+    {
+      printf ("don't trace me !!\n");
+      exit (EXIT_FAILURE);
+    }
+
+  return EXIT_SUCCESS;
+}
diff --git a/anti-disassembler/Linux/anti-debug/breakpoint_detection.c b/anti-disassembler/Linux/anti-debug/breakpoint_detection.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <stdint.h>
+
+#if defined(__i386__)
+# define OFFSET 6
+#elif defined(__amd64__)
+# define OFFSET 4
+#else
+# define OFFSET 0
+#endif
+
+void
+foo ()
+{
+  printf ("No breakpoint detected...\n");
+}
+
+int
+main ()
+{
+  /* Looking for a breakpoint at foo() */
+  if ((*(volatile unsigned *) ((uintptr_t) foo + OFFSET) & 0xff) == 0xcc)
+    {
+      printf ("Breakpoint detected!\n");
+      exit (EXIT_FAILURE);
+    }
+
+  /* No breakpoint found */
+  foo ();
+
+  return EXIT_SUCCESS;
+}
diff --git a/anti-disassembler/Linux/dynamic_jump/Makefile b/anti-disassembler/Linux/dynamic_jump/Makefile
@@ -0,0 +1,19 @@
+CFLAGS   = -Wall -Wextra -nostdlib
+CPPFLAGS =
+LDFLAGS  =
+
+SRC = dynamic_jump
+I386 = $(SRC)-i386
+AMD64 = $(SRC)-amd64
+
+all: $(I386) $(AMD64)
+
+$(I386): $(I386).s
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(AMD64): $(AMD64).s
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(I386) $(AMD64) *~
+
diff --git a/anti-disassembler/Linux/dynamic_jump/dynamic_jump-amd64.s b/anti-disassembler/Linux/dynamic_jump/dynamic_jump-amd64.s
@@ -0,0 +1,13 @@
+.globl _start
+	
+.text
+_start:
+	mov	$end, %rax
+	jmpq 	*%rax
+	.long	0x12345
+	add 	$10, %eax
+	nop
+	nop
+end:	mov 	$0x0, %ebx
+	mov 	$0x1, %eax
+	int 	$0x80
diff --git a/anti-disassembler/Linux/dynamic_jump/dynamic_jump-i386.s b/anti-disassembler/Linux/dynamic_jump/dynamic_jump-i386.s
@@ -0,0 +1,13 @@
+.globl _start
+	
+.text
+_start:
+	movl	$end, %eax
+	jmp	*%eax
+	.long	0x12345
+	add	$10, %eax
+	nop
+	nop
+end:	mov	$0x0, %ebx
+	mov	$0x1, %eax
+	int	$0x80
diff --git a/anti-disassembler/Linux/exotic_instructions/Makefile b/anti-disassembler/Linux/exotic_instructions/Makefile
@@ -0,0 +1,19 @@
+CFLAGS   = -Wall -Wextra -nostdlib
+CPPFLAGS =
+LDFLAGS  =
+
+SRC = exotic_instructions
+I386 = $(SRC)-i386
+AMD64 = $(SRC)-amd64
+
+all: $(I386) $(AMD64)
+
+$(I386): $(I386).s
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(AMD64): $(AMD64).s
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(I386) $(AMD64) *~
+
diff --git a/anti-disassembler/Linux/exotic_instructions/exotic_instructions-amd64.s b/anti-disassembler/Linux/exotic_instructions/exotic_instructions-amd64.s
@@ -0,0 +1,14 @@
+.globl _start
+	
+.text
+_start:
+	movq	$0xdeadbeef, %rax
+	pushq	%rax
+	movq	%rsp, %rcx
+	movq	(%rcx), %mm0
+	paddb	(%rcx), %mm0
+	movq	%mm0, (%rcx)
+	fwait
+	mov 	$0x0, %rbx
+	mov 	$0x1, %rax
+	int 	$0x80
diff --git a/anti-disassembler/Linux/exotic_instructions/exotic_instructions-i386.s b/anti-disassembler/Linux/exotic_instructions/exotic_instructions-i386.s
@@ -0,0 +1,13 @@
+.globl _start
+
+.text
+_start:
+	pushl	$0xdeadbeef
+	movl	%esp, %ecx
+	movq	(%ecx), %mm0
+	paddb	(%ecx), %mm0
+	movq	%mm0, (%ecx)
+	fwait
+	mov 	$0x0, %ebx
+	mov 	$0x1, %eax
+	int 	$0x80
diff --git a/anti-disassembler/Linux/instruction_overlapping/Makefile b/anti-disassembler/Linux/instruction_overlapping/Makefile
@@ -0,0 +1,15 @@
+CFLAGS   = -Wall -Wextra -std=c99 -g -nostdlib
+CPPFLAGS =
+LDFLAGS  =
+
+all: instruction_overlapping-i386
+
+%: %.s
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+%.o: %.s
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -c -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f instruction_overlapping-i386 *~
+
diff --git a/anti-disassembler/Linux/instruction_overlapping/instruction_overlapping-i386.s b/anti-disassembler/Linux/instruction_overlapping/instruction_overlapping-i386.s
@@ -0,0 +1,12 @@
+.globl _start
+	
+.text
+_start:
+	mov $0xbbc10300, %eax
+	mov $0x05000000, %ecx
+	add %ecx, %eax
+	jmp .-0xa
+	add %ebx, %eax
+	mov $0x0, %ebx
+	mov $0x1, %eax
+	int $0x80
diff --git a/anti-disassembler/Linux/packer/Makefile b/anti-disassembler/Linux/packer/Makefile
@@ -2,15 +2,16 @@ CFLAGS   = -Wall -Wextra -std=c99 -g -z execstack
 CPPFLAGS =
 LDFLAGS  =
 
+I386 = packer-i386
 
-all: self-modifying-32
+all: $(I386)
 
-self-modifying-32: self-modifying-32.c
+$(I386): $(I386).c
 	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
 
-self-modifying-32.o: self-modifying-32.s
+$(I386).o: $(I386).s
 	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -c -o $@ $< $(LDFLAGS)
 
 clean:
-	rm -f self-modifying-32 self-modifying-32.o *~
+	rm -f $(I386) $(I386).o *~
 
diff --git a/anti-disassembler/Linux/packer/packer-i386.c b/anti-disassembler/Linux/packer/packer-i386.c
@@ -0,0 +1,13 @@
+#include <stdlib.h>
+
+char code[] =
+  "\xe8\x25\x00\x00\x00\x5e\x83\xc6\x11\x89\xf7\xb9\x08\x00\x00"
+  "\x00\xac\x34\xaa\xaa\xe2\xfa\x9b\x6a\x29\x6a\xd5\xc1\x6a\xd7"
+  "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xeb\xd9";
+
+int main() {
+  int (*func)() = (int (*)()) code;
+  (int)(*func)();
+
+  return EXIT_SUCCESS;
+}
diff --git a/anti-disassembler/Linux/packer/packer-i386.s b/anti-disassembler/Linux/packer/packer-i386.s
@@ -0,0 +1,30 @@
+.globl _start
+
+.macro crypt start_addr end_addr
+	.set current \start_addr
+.endm
+	
+	
+.text
+_start:
+	call	.+0x25
+	popl	%esi
+	addl	$0x11, %esi
+	movl	%esi, %edi
+	movl	$0x8, %ecx
+	
+decrypt:
+        lodsb
+        xor	$0xaa, %al
+        stosb
+        loop	.-0x4
+
+hidden:
+	xor	%eax, %eax
+	add	$127, %eax
+	imul	$125, %eax
+	
+end:	mov	$1, %eax
+	mov	$0, %ebx
+	int	$0x80
+	jmp	.-0x25
diff --git a/anti-disassembler/Linux/pc_manipulation/Makefile b/anti-disassembler/Linux/pc_manipulation/Makefile
@@ -0,0 +1,18 @@
+CFLAGS   = -Wall -Wextra -std=c99 -g
+CPPFLAGS =
+LDFLAGS  =
+
+I386 = pc_manipulation-i386
+AMD64 = pc_manipulation-amd64
+
+all: $(I386) $(AMD64)
+
+$(I386): $(I386).c
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(AMD64): $(AMD64).c
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(I386) $(AMD64) *~
+
diff --git a/anti-disassembler/Linux/pc_manipulation/pc_manipulation-amd64.c b/anti-disassembler/Linux/pc_manipulation/pc_manipulation-amd64.c
@@ -0,0 +1,19 @@
+#include <stdio.h>
+#include <stdint.h>
+
+int foo (void) {
+  char buffer[8];
+  char * ret;
+  ret = buffer + 24;
+  (*ret) += 7;
+  return 0;
+}
+
+int main (void) {
+  int i;
+  foo ();
+  i = 1;
+  printf ("%d\n", i);
+  return 0;
+}
+
diff --git a/anti-disassembler/Linux/pc_manipulation/pc_manipulation-i386.c b/anti-disassembler/Linux/pc_manipulation/pc_manipulation-i386.c
@@ -0,0 +1,19 @@
+#include <stdio.h>
+#include <stdint.h>
+
+int foo (void) {
+  char buffer[8];
+  char * ret;
+  ret = buffer + 16;
+  (*ret) += 12;
+  return 0;
+}
+
+int main (void) {
+  int i;
+  foo ();
+  i = 1;
+  printf ("%d\n", i);
+  return 0;
+}
+
diff --git a/anti-disassembler/Linux/self-modifying_code/Makefile b/anti-disassembler/Linux/self-modifying_code/Makefile
@@ -0,0 +1,17 @@
+CFLAGS   = -Wall -Wextra -std=c99 -g -z execstack
+CPPFLAGS =
+LDFLAGS  =
+
+I386 = self-modifying_code-i386
+
+all: $(I386)
+
+$(I386): $(I386).c
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(I386).o: $(I386).s
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -c -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(I386) $(I386).o *~
+
diff --git a/anti-disassembler/Linux/self-modifying_code/self-modifying_code-i386.c b/anti-disassembler/Linux/self-modifying_code/self-modifying_code-i386.c
@@ -1,13 +1,13 @@
+#include <stdlib.h>
+
 char code[] =
   "\xe8\x1f\x00\x00\x00\x58\xc6\x40\x0e\xeb\x43\xc6\x40\x06\xeb"
   "\xc6\x40\x07\x08\x50\xf5\x42\x51\x4b\xb8\x01\x00\x00\x00\xbb"
   "\x00\x00\x00\x00\xcd\x80\xeb\xdf";
 
 int main() {
-   int *ret;
-
-   ret = (int *) &ret + 2;
-   (*ret) = (int) code;
+  int (*func)() = (int (*)()) code;
+  (int)(*func)();
 
-   return 0;
+  return EXIT_SUCCESS;
 }
diff --git a/anti-disassembler/Linux/self-modifying_code/self-modifying_code-i386.s b/anti-disassembler/Linux/self-modifying_code/self-modifying_code-i386.s
@@ -1,5 +1,5 @@
 .globl _start
-	
+
 .text
 _start:
 	call	.+0x24
diff --git a/anti-disassembler/Linux/stack-buffer-overflow/Makefile b/anti-disassembler/Linux/stack-buffer-overflow/Makefile
@@ -0,0 +1,19 @@
+CFLAGS   = -Wall -Wextra -std=c99 -g -static
+CPPFLAGS =
+LDFLAGS  =
+
+SRC = stack-buffer-overflow
+I386 = $(SRC)-i386
+AMD64 = $(SRC)-amd64
+
+all: $(I386) $(AMD64)
+
+$(I386): $(SRC).c
+	$(CC) -m32 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+$(AMD64): $(SRC).c
+	$(CC) -m64 $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(I386) $(AMD64) *~
+
diff --git a/anti-disassembler/Linux/stack-buffer-overflow/stack-buffer-overflow.c b/anti-disassembler/Linux/stack-buffer-overflow/stack-buffer-overflow.c
