Jul 22, 2017 01:40 PM
(This post was last modified: Jul 22, 2017 01:42 PM by movsx.)
Introduction
This is the first of a several part tutorial series which will teach you how to write a metamorphic engine / real unique stub generator which will take a subset of the C source language and output unique assembly code. This tutorial is the easiest in the series, each tutorial will be significantly harder than the last. So if you're having difficult following now, I recommend you go back and study some basic computer science and C coding. If this tutorial is popular, I'll release the second one. After releasing all tutorials, I'll release the full source code on github. This tutorial isn't meant to spoonfeed you, only guide you. Don't know what an abstract syntax tree is? Google it and find out, then come back.
Please note that the purpose of these tutorials aren't for malware, nor for you to copy paste and use in your own projects. The purpose of this series is to demonstrate that metamorphic engines are a real threat to computer security, and hopefully motivate individuals to try and find ways to stop them.
This series is not for the faint of heart, as this simple C subset metamorpic engine spans over 15,000 lines of C code and requires a deep understanding of the C language to follow, as well as you being willing to learn the compiler theory concepts mentioned here and study them well. 15,000 lines of C code is a tiny project, in all reality, but some of you may not be used to projects of this size, nor the actual complexity of the code involved, as each phase of the engine is drastically different from the last, and will begin to use some complex algorithms and data structures.
Drawing from Compiler Theory
A metamorphic engine is essentially a compiler, except its goal is not to compile efficient or small code, but to compile code that is unique and well-functioning. Consequently, there is a significant overlap with writing compilers and metamorphic engines, so the front-end of our engine will essentially be the same as writing a front-end for a compiler. The backend is where metamorphic engines differ from compilers, as you will see in later tutorials.
Brief Discussion of Compiler Frontends
Let's get started! Front end: Stage 1; Lexing
Honestly there's not much to say. The lexer is incredibly easy to implement. I won't even bother discussing it. Play around with lexers, write your own, and understand why they're important.
Here's the code for the lexer:
linkedlist.h https://pastebin.com/x556r8DL
linkedlist.c https://pastebin.com/DV058wt3
lexer.h https://pastebin.com/cdxwAdmL
lexer.c https://pastebin.com/Emu3rpzx
Here's an example C block
And here's the output of the lexer
The next tutorial (if this ones popular) will be on recursive descent parsing and will cover generating parse trees -> abstract syntax trees
This is the first of a several part tutorial series which will teach you how to write a metamorphic engine / real unique stub generator which will take a subset of the C source language and output unique assembly code. This tutorial is the easiest in the series, each tutorial will be significantly harder than the last. So if you're having difficult following now, I recommend you go back and study some basic computer science and C coding. If this tutorial is popular, I'll release the second one. After releasing all tutorials, I'll release the full source code on github. This tutorial isn't meant to spoonfeed you, only guide you. Don't know what an abstract syntax tree is? Google it and find out, then come back.
Please note that the purpose of these tutorials aren't for malware, nor for you to copy paste and use in your own projects. The purpose of this series is to demonstrate that metamorphic engines are a real threat to computer security, and hopefully motivate individuals to try and find ways to stop them.
This series is not for the faint of heart, as this simple C subset metamorpic engine spans over 15,000 lines of C code and requires a deep understanding of the C language to follow, as well as you being willing to learn the compiler theory concepts mentioned here and study them well. 15,000 lines of C code is a tiny project, in all reality, but some of you may not be used to projects of this size, nor the actual complexity of the code involved, as each phase of the engine is drastically different from the last, and will begin to use some complex algorithms and data structures.
Drawing from Compiler Theory
A metamorphic engine is essentially a compiler, except its goal is not to compile efficient or small code, but to compile code that is unique and well-functioning. Consequently, there is a significant overlap with writing compilers and metamorphic engines, so the front-end of our engine will essentially be the same as writing a front-end for a compiler. The backend is where metamorphic engines differ from compilers, as you will see in later tutorials.
Brief Discussion of Compiler Frontends
- A source language is input to the front end
- First the front end breaks this input into a sequence of tokens.
- Second the front end generates a parse tree from these tokens
- Third the front end uses syntax directed translation to convert the parse tree into an abstract syntax tree
- Fourth the front end creates a symbol table from the AST
- Fifth the front end runs the AST through the semantic analysis stage to determine if the grammar is semantically valid: proper use of types, not using vars out of scope, not using undeclared vars, etc, etc
- Sixth the front end runs the AST through another syntax directed translator to generate an intermediate representation language, which is then fed into the back end to have code mutation applied to it. This is where the majority of effort/code is at: Control flow modifications, junk code generation, instruction selection, instruction scheduling, register allocation, and function inlining / outlining occur here.
Let's get started! Front end: Stage 1; Lexing
Honestly there's not much to say. The lexer is incredibly easy to implement. I won't even bother discussing it. Play around with lexers, write your own, and understand why they're important.
Here's the code for the lexer:
linkedlist.h https://pastebin.com/x556r8DL
linkedlist.c https://pastebin.com/DV058wt3
lexer.h https://pastebin.com/cdxwAdmL
lexer.c https://pastebin.com/Emu3rpzx
Here's an example C block
Code
{
int x;
x = 0;
while (x < 10) {
x = x + 1;
}
}And here's the output of the lexer
Code
[{] [INT] [Identifier x] [;] [Identifier x] [=] [Int Literal=0] [;] [WHILE ] [(] [Identifier x] [<] [Int Literal=10] [)] [{] [Identifier x] [=] [Identifier x] [+] [Int Literal=1] [;] [}] [}]The next tutorial (if this ones popular) will be on recursive descent parsing and will cover generating parse trees -> abstract syntax trees
![[Image: V9Gredc.png]](https://i.imgur.com/V9Gredc.png)