[rspower]

Hey,

free crypter written in C (no .NET, no C++ bloat). Goal is keeping
payloads clean vs AV/ML, every build produces a different binary, so static
signatures and hash DBs don't stick.

updates 2026-09-20
- payload is deflate-compressed before AES -> noticeably smaller output
- stub body now decodes out-of-place into a private scratch buffer:
the image's own code section is never made writable at runtime
(no RW->RX transition on the image section)
- stub body is XOR-encoded + opcode-varianted per build, not just the blob
- import table reduced to 6 kernel32 entries, the rest resolved via
GetProcAddress at runtime
- scantime hardening: entry point in .text, plausible section names,
randomized magics + PE header fields, random section padding
- anti-analysis: added PEB module-count sandbox heuristic (soft score)
- tempfile fallback now delete-on-close, minimal on-disk window
- build survives local AV quarantine (unique output names per run, retry)

features
- x86 + x64, and the 64-bit CLI can protect 32-bit targets (cross-arch)
- polymorphic: random section names, random AES-256 key/IV, junk-code +
opcode/register shuffling -> output is unique every run (diff two builds)
- AES-256-CBC on the payload (deflate-compressed first), high entropy,
no plaintext strings in the section
- zero runtime deps: static, only 6 kernel32 imports in the IAT,
no VCRUNTIME/MSVCP/UCRT — the protected EXE only needs the OS
- RWX split: code section [R,X] + data section [R,W], no single RWX block to flag
- runs the payload in-memory through the real Windows loader,
tempfile fallback if that path fails
- IAT + base-relocation fixup at runtime
- basic anti-analysis (debugger / hypervisor / module-count heuristics)
- GUI + CLI, no config, no license, no backdoors

🔐 loading encrypted image…

https://antiscan.me/scans/ead5ed35-44f7-...18d389e29c
Never upload the stub to VirusTotal!

usage
- cli: prot.exe [-no-anti] <input.exe> [output.exe]
- gui.exe: drop the EXE, hit protect


feedback / bug reports welcome, PM me if something's off


  dl.txt (Cost: 100 βytes / Size: 43 bytes / Purchases: 7)

[ryryh4ck]

100 bytes dont Is free

[rspower]

100 bytes dont Is free

skid protection

[missionstatements]

Willing to try it out. I am interested

[seuq]

gonna try it out. ty

[cybervirus]

Good Thanks a lot

---

How do I download it?

[HaykHaykHayk]

this is really interesting

[rspower]

Update:

Changelog (2026-09-14)

AV-Evasion Hardening, Deflate Payload, Build Resilience

Deflate Payload

New raw DEFLATE (RFC 1951) without zlib/GZIP wrapper.

Payload gets compressed before AES if it saves space; stub decompresses after AES.

Scan-Time Hardening

Plausible section names instead of random ones.

Entry point stays in .text; blob section is named .text.

Random padding, randomized magic, varied PE header per build.

Per-build instruction variants in stub body; smaller BSS path buffer.

Scattered API Resolution

Blob and stub resolve several APIs via LoadLibraryA + GetProcAddress.

IAT fallback remains if needed.

Anti-Debug (Soft)

PEB module count adds sandbox score if too few modules. No hard bail.

Tempfile Trace

Windows loader path deletes the file right after CreateProcessW.

[CyberXero]

Quite Interesting !
My laptop isn't at my fingertips right now so I am gonna bookmark this for now 😄

[rspower]

atm I am working on an auto-spreading worm (Discord, Telegram, LAN, USB, and email spreader) based on the Stuxnet source code. I will release an alpha version soon

[CyberXero]

atm I am working on an auto-spreading worm (Discord, Telegram, LAN, USB, and email spreader) based on the Stuxnet source code. I will release an alpha version soon

That's cool !
Keep us posted, will check back here laterrr

[Unknown2027]

Thank you

[drugsandmoney]

thanks will check out.

[rimpk901]

thx i try this

[rspower]

Changes:
- The stub body no longer decodes in place. At runtime the polymorphic blob now
copies the encoded body out of the image's .text into a private VirtualAlloc
scratch buffer (code RX, data RW), decodes it there, and jumps into it.
In-place decode remains as fallback if the alloc fails.
=> The image's own code section is never set writable at runtime again
no more RW->RX transition on the image section (WriteWatch /
ProcessWriteCache heuristics).
- All stub data (API resolution, strings, hoisted globals, kernel32/
GetProcAddress refs) is now routed through a single g_ctx structure in .data,
reached via one anchor pointer. The decoded body no longer touches the IAT,
.rdata or .data directly.
=> Import table shrunk to 6 kernel32 entries.
- The g_ctx magic and its string literals are randomized per build (same
scheme as the skeleton-table magic), so cross-build pattern matching
against the context block no longer works.
- AES/deflate lookup tables (sbox/rsbox/rcon, huffman tables) moved behind

UD for Windows Defender atm runtime and scantime