Full Disclosure mailing list archives
Re: Hyperion - Paper about Windows PE run-time encryption
From: Christian Ammann <c.ammann () hs-osnabrueck de>
Date: Wed, 09 May 2012 11:25:19 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Dimitris, thanks for your reply. I just checked your slides and your approach looks really good :) Of course we are interested in AV evasion ;) We also observed that the increased AES-128 encryption entropy is a problem and marked as suspicious by AV heuristics. My idea was to experiment with different encodings (e.g. convert the bytes to a string representation to make the AV heuristic think its just a collection of strings used by the execuatble for user interaction). The idea to use instructions which load the encrypted binary into memory looks very promising to me, so thanks for your advice. Yes, you are right, the current implementation of Hyperion is very signature friendly. Our idea was to encrypt the complete binary (also the decrypter and pe loader) and generate a decrypter stub using polymorphism. Again, the idea to use metamorphism instead is also a good apprroach. So, there will be definitely an enhanced version of Hyperion using the discussed concepts to avoid AV detection. The motivation our paper was to present a detailled description and implementation of a basic PE encrypter/packer to the public. Therefore, people can modify the reference implementation (which will be released soon under a BSD license) or just use the concepts to build their own PE crypter/packer. Best regards, Christian -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPqjf/AAoJENerUt+Ej3tqR3oH/is2KGDPqzaomzP10jD+fHCT OhNxYT0gDZNnIwSPPldYAB2uGqymSatGntMFUCzfHFbckloul/vbNg7ajZHPRgh2 V4XpAskjwQE11/rSTSeg9uGXvTskWx3VcKIzkytOaJJ2cMIs358YNDJwblkY4uMI NQfbRgk5mYod/K3iYx9uZvb9fqpB5EXbdxPATWTwbCrXdmx1/EN/TnHdDBwh7rkA 26JqfTfcYVfEN2Z19uEANs6wFiZefXi/veJR3U/dWyerEFDdgjytUekRJkx/NvUG 521dLitXcx6+1gcLKerEZfkDihKaGmbaX/Vp+3xHXdfD68oGuRHYh0Nmu5Oi6wM= =1k20 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Hyperion - Paper about Windows PE run-time encryption Levent Kayan (May 08)
- Re: Hyperion - Paper about Windows PE run-time encryption Dimitris Glynos (May 09)
- <Possible follow-ups>
- Re: Hyperion - Paper about Windows PE run-time encryption Christian Ammann (May 09)