mirror of
https://github.com/opsxcq/mirror-textfiles.com.git
synced 2025-08-19 17:31:40 +02:00
217 lines
8.1 KiB
Plaintext
217 lines
8.1 KiB
Plaintext
|
||
|
||
TridenT Polymorphic Engine version 1.3
|
||
============================================================
|
||
|
||
Written by Masud Khafir of the TridenT virus research group.
|
||
|
||
|
||
|
||
What is it?
|
||
~~~~~~~~~~~
|
||
|
||
The TPE is a module that can be included in programs to make
|
||
them able to produce polymorphic programs. The TPE comes as
|
||
an OBJ file. If you want to include the TPE in your program
|
||
you must link it to it. If you have never linked an object
|
||
file to a program, DON'T start with the TPE. First do this,
|
||
then return to the TPE.
|
||
|
||
The TPE does two things. First, it will encrypt the original
|
||
code. This is done in a different way each time the TPE is
|
||
called. Second, it will generate a decryption routine for it.
|
||
The encrypted code will be put right after the decryption
|
||
routine. The size of the decryption routine will not be very
|
||
big. At most a few hundred bytes. Of course, the decryptor
|
||
will also be different each time the TPE is called. The TPE
|
||
can produce plain decryptors or decryptors with some random
|
||
non-functional instructions inserted.
|
||
|
||
The size of the TPE is 1411 bytes; We believe this is not too
|
||
big.
|
||
|
||
|
||
|
||
What's new?
|
||
~~~~~~~~~~~
|
||
|
||
Read the file HISTORY.DOC for more information about this
|
||
new version of TPE.
|
||
|
||
|
||
|
||
How can I use it?
|
||
~~~~~~~~~~~~~~~~~
|
||
|
||
The TPE offers you 3 subroutines: 'rnd_init', 'rnd_get' and
|
||
'crypt'. It also can give you the addresses of the begin and
|
||
end of TPE. If you write your program in assembler, you must
|
||
include the following in your source code:
|
||
|
||
.model tiny
|
||
.code
|
||
|
||
extrn rnd_init:near
|
||
extrn rnd_get:near
|
||
extrn crypt:near
|
||
extrn tpe_bottom:near
|
||
extrn tpe_top:near
|
||
|
||
The first (rnd_init) is a subroutine to initialize the random
|
||
number generator. You are advised to call this subroutine
|
||
before the first time you call the encryption subroutine. If
|
||
you don't, the random number generator may not function
|
||
perfectly. All registers will be preserved.
|
||
|
||
The second is a subroutine that returns a random number in AX.
|
||
This subroutine is used by TPE, but you can use it also for
|
||
other things in your program. Your imagination is the limit.
|
||
All registers, except AX, are preserved.
|
||
|
||
The third is the actual encryption subroutine. This one needs
|
||
several input parameters. When it finishes, it will return
|
||
some output parameters. All parameters are passed in registers
|
||
(see below).
|
||
|
||
The last two are the begin and end addresses of the TPE in
|
||
your program. You may need these if your program is going to
|
||
include the TPE in the generated program.
|
||
|
||
You can leave out 'extrn' commands of things you don't use
|
||
in your source code.
|
||
|
||
Be sure that there is enough stack space for the TPE. (100
|
||
bytes appear to be enough). If you use the TPE in a resident
|
||
program, it is recomended to maintain your own stack.
|
||
Otherwise the chance is that you will blow the DOS stack.
|
||
|
||
Of course, you must link TPE.OBJ to you program!
|
||
If you are using more than one segment in your program, the
|
||
complete TPE will be put in the CODE segment (called _TEXT).
|
||
|
||
|
||
|
||
Input parameters of the crypt routine:
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
ES = Work segment
|
||
|
||
This is the place where the decryptor and the encrypted
|
||
code will be generated. Be sure that it is large enough.
|
||
It must at least be as large as the size of the code to
|
||
encrypt plus the size of the decryptor. 512 bytes plus
|
||
the length of the code ought to be enough.
|
||
|
||
DS:DX => Code to encrypt
|
||
|
||
This must point to the code you want to encrypt.
|
||
|
||
CX = Length of code to encrypt
|
||
|
||
Put the size of the piece of code you want to encrypt
|
||
in CX. The TPE cannot encrypt more than 32768 bytes,
|
||
so the value of CX must be lower.
|
||
|
||
BP = Offset where the decryption routine will be executed
|
||
|
||
You must put the address where the decryptor will start
|
||
in BP. For example, if the generated program will be a
|
||
COM file which starts with the decryptor, you must set
|
||
this value to 100h.
|
||
|
||
SI = Distance between decryptor and encrypted code
|
||
|
||
In this register you must put the distance that will be
|
||
between the decryptor and the encrypted code. If the
|
||
encrypted code will be right after the decryptor (this
|
||
is the normal case) you must set this value to 0.
|
||
|
||
AX = Bit field
|
||
|
||
In this register you can provide some options about the
|
||
way the decryptor must be.
|
||
|
||
bit 0: DS will not always be equal to CS
|
||
|
||
If you are not sure that DS will be equal to CS when
|
||
the decryptor takes control, you must set this bit
|
||
high. This is the case when the decryptor is in an
|
||
EXE file.
|
||
|
||
bit 1: Insert random non-functional instructions in
|
||
decryptor
|
||
|
||
If this bit is high, the decryption routine will
|
||
contain several non-functional instructions. Since
|
||
these instructions are non-functional, they don't
|
||
disturb the decryptor.
|
||
|
||
bit 2: Put random instructions before decryptor
|
||
|
||
If this bit is high, several random instructions
|
||
are put before the decryption routine. These
|
||
instructions may affect the registers, but they
|
||
won't disturb the decryptor.
|
||
|
||
bit 3: Preserve AX with decryptor
|
||
|
||
If you want to preserve the original value of AX
|
||
after decryption, you must set this bit high.
|
||
|
||
|
||
|
||
Output parameters of the crypt routine:
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
ES = Work segment (preserved)
|
||
|
||
ES will still point to the work segment.
|
||
|
||
DS:DX => Decryptor + encrypted code
|
||
|
||
This will now point to the decryptor, immediatly followed
|
||
by the encrypted code. DS:DX will be the same as ES:0000.
|
||
If SI was set to 0 before the TPE was called, the code
|
||
is now ready to be put in a file.
|
||
|
||
CX = Length of decryptor + encrypted code
|
||
|
||
CX now has the summary length of both the decryptor and
|
||
the encrypted code. You can use this value to write the
|
||
decryptor plus the encrypted code to a file (in case SI
|
||
was set to 0 before the TPE was called).
|
||
|
||
DI = Length of decryptor
|
||
|
||
If SI was not set to 0 before the TPE was called, you
|
||
will need this value when you want to write the decryptor
|
||
to a file. This value can also be used as an offset of
|
||
the encrypted code. This will be at DS:DI (because DX
|
||
will be 0). If SI was 0, you can ignore this value.
|
||
|
||
AX = length of encrypted code
|
||
|
||
This value will be the same as the value of CX before
|
||
the TPE was called. If SI was not set to 0 before the
|
||
TPE was called, you will need this value when you want
|
||
to write the encrypted code to a file. If SI was 0, you
|
||
can ignore this value.
|
||
|
||
|
||
|
||
Final notes.
|
||
~~~~~~~~~~~~
|
||
|
||
First, I want to thank the Dark Avenger from Bulgaria for his
|
||
nice 'Mutation Engine' program. This fine program has been a
|
||
great source of inspiration for the TPE!
|
||
|
||
Check out the source of TPE-GEN to learn more about the TPE
|
||
and how it works.
|
||
|
||
Please, remember that the author of the TPE and the TridenT
|
||
virus research group are not responsible if you use the TPE
|
||
in an illegal or naughty way.
|
||
|
||
Good luck.
|
||
|