mailing list archives
Re: Hyperion - Paper about Windows PE run-time encryption
From: Dimitris Glynos <dimitris () census-labs com>
Date: Wed, 09 May 2012 11:18:25 +0300
On 05/09/2012 02:15 AM, Levent Kayan wrote:
few minutes ago, we released a paper about windows PE runtime crypters.
A short description:
Hyperion: Implementation of a PE crypter - This paper reveals the
theoretic aspects behind run-time crypters and describes a reference
implementation for Portable Executables.
You can find the paper, here: http://nullsecurity.net/papers.html
We will release the source code (hyperion) during our berlinsides talk
(http://berlinsides.org/ - Thank you aluc). Also, our talk is based on
On a related note, you might want to check this out:
In our AthCon 2012 presentation, entitled "Packing Heat" we've presented
the design of a fully metamorphic packer. It's quite elegant, in the
sense that the packer:
- is a cross-platform ruby script
- it fully controls the assembly and linking process of the
resulting binary thru METASM
- it comes with its own library of metamorphic instructions
(no fixed code for memory allocator, decryptor and loader)
Our goal was to achieve AV evasion during pentests. So there's no
anti-RE / anti-debugging code there.
I see that Hyperion uses AES128 encryption and the output is placed
in a byte array in the executable (please correct me if I'm wrong).
There's a problem with this (if you are interested in AV evasion).
Appart from the fixed decryption code (which is signature friendly), you
have section data of increased entropy. We've found that increased
entropy "raises alerts" in the AV world; the file will be flagged
as suspicious and more thorough checks will be performed. If you're
still interested in AES encryption you might want to generate
instructions that load these bytes (rather than just place them in the
executable). This will considerably decrease information entropy.
We will not be releasing the source code to our packer, but we've put
a step by step guide in our slides, so you can build one from scratch.
Our prototype implementation is only 1700 lines of code :-)
http://census-labs.com -- IT security research, development and services
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/