Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Hyperion - Paper about Windows PE run-time encryption
From: Christian Ammann <c.ammann () hs-osnabrueck de>
Date: Wed, 09 May 2012 11:25:19 +0200

Hash: SHA1

Hi Dimitris,

thanks for your reply. I just checked your slides and your approach
looks really good :)

Of course we are interested in AV evasion ;) We also observed that the
increased AES-128 encryption entropy is a problem and marked as
suspicious by AV heuristics. My idea was to experiment with different
encodings (e.g. convert the bytes to a string representation to make
the AV heuristic think its just a collection of strings used by the
execuatble for user interaction). The idea to use instructions which
load the encrypted binary into memory looks very promising to me, so
thanks for your advice.

Yes, you are right, the current implementation of Hyperion is very
signature friendly. Our idea was to encrypt the complete binary (also
the decrypter and pe loader) and generate a decrypter stub using
polymorphism. Again, the idea to use metamorphism instead is also a
good apprroach. So, there will be definitely an enhanced version of
Hyperion using the discussed concepts to avoid AV detection.

The motivation our paper was to present a detailled description and
implementation of a basic PE encrypter/packer to the public.
Therefore, people can modify the reference implementation (which will
be released soon under a BSD license) or just use the concepts to
build their own PE crypter/packer.

Best regards,

Version: GnuPG v1.4.11 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]