Jump to content
Tuts 4 You

[Release] Kal El: Protecting your Applications

Majii Guy

Recommended Posts

I wrote a class that uses a blend of polymorphic code; something I originally wrote for another user, who had too much trouble integrating it, I figure the community could use it.

The PHP script attached will verify an account ID given over a network pipe, then return the requested function. The script should store all valuable functions in an encoded/encrypted/encoded buffer, which the client will fetch when needed, decrypt, load to stack, and execute.

For an example, check out the WinMain.cpp file, and take note of the "GetFunction" and "QueueFunction".

The kePolymorphic class is, essentially, just a large NOP; a number of random instructions are completed on each run, but the instructions don't change, only which instructions get executed. That's where I would personally store strings that should appear interesting to a potential reverser, but in all reality, do nothing of value (As seen with examples such as "@lawnmower", "@godmode", etc).

Most, if not all of the strings in the library are encoded; you'll have to modify the host encoded buffer and the request to your specific server, where the modified PHP script would be hosted.

Lastly, there is a key in the keConfig.h file, you can modify it or not; I personally would. Below is a python script for encrypting given buffers, then writing to a file, "key.txt".


from time import sleep

eiEncrypt_Key = [ 0xA9, 0x9F, 0x02, 0x87, 0x3A, 0x16, 0xFF, 0x6F, 0x75, 0x74 ]

eiDecrypt_Key = [ 0x74, 0x75, 0x6F, 0xFF, 0x16, 0x3A, 0x87, 0x02, 0x9F, 0xA9 ]

def eiCrypt_Encrypt( eiString ):

i = 0

while eiString != 0x00:

j = 0

for l in eiEncrypt_Key:

eiString ^= eiEncrypt_Key[j]



return eiString

def eiCrypt_Decrypt( eiCryptedString ):

i = 0

while eiCryptedString != 0x00:

j = 0

for l in eiEncrypt_Key:

eiCryptedString ^= eiDecrypt_Key[j]



return eiCryptedString

x = input()

k = 0

m = []

while k < len ( x ):

m.append ( ord( x[k] ) )

k += 1

realstring = ""

m.append ( 0x00 )

for x in eiCrypt_Encrypt(m):

if x != 0x00:

realstring += "'\\x"+str(hex(x)).strip("0x")+", "

f = open ( "key.txt", "wb" )

k = " { %s };" % realstring

f.write ( k )

f.close ( )

Enjoy, everybody!


Use it as you want, credits or not; it's not terribly messy, some parts were a bit inflexible (e.g.: The GetFunction function should accept one or two more parameters for the hostname and request to be sent, etc). Otherwise, I think it works fairly well.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...