Question

TASK:

I’m building a set of x86 assembly reverse engineering challenges, of which I have twenty or so already completed. They’re just for fun / education.

The current challenge is one of the more advanced ones, and involves some trickery that makes it look like the EP is actually in the normal program, but it’s actually packed away in another PE section.

Heres’ the basic flow:

• Starts out as if it were a normal MSVC++ application.
• Injected a sneaky call away to a bunch of anti-debugger tricks.
• If they pass, a DWORD in memory is set to 1.
• Later in the program flow, it checks for that value being 1, and if it works it decrypts a small call table. If it fails, it sends them off on a wild goose chase of fake anti-debug tricks and eventually just crashes.
• The call table points to the real decryption routines that decrypt the actual program code section.
• The decryption routines are called, and they decrypt using a basic looped xor (C^k^n where C is ciphertext, k is a 32-bit key and n is the current data offset)
• VirtualProtect is used to switch the section’s protection flags from RW to RX.
• Control flow is redirected to OEP, program runs.

The idea is that since they think they’re in normal program flow, it makes them miss the anti-debug call and later checks. Anyway, that all works fine.

PROBLEM:

The current problem is that OllyDbg and a few other tools look at the packed section and see that it has high entropy, and throw up a warning that it’s packed. The code section pointer in the PE header is correctly set, so it doesn’t get this from having EP outside code – it’s purely an entropy analysis thing.

QUESTION:

Is there an encryption method I can use that preserves low entropy, but is still easy to implement in x86 asm? I don’t want to use a plain xor, since it’s too easy, but I also don’t want it to catch it as packed and give the game away.

I thought of something like a shuffler (somehow produce a keystream and use it to swap 4-byte blocks of code around), but I’m not sure that this is going to work, or even be simple.

Anyone got any ideas?

Answer 1

Actually, OllyDbg works like this pseudocode:

useful_bytes = number_of_bytes_in_section - count_bytes_with_values(0x00, 0x90, 0xCC)
warn about compression if useful_bytes > 0x2000 and count_bytes_with_values(0xFF, 0xE8, 0x8B, 0x89, 0x83) / useful_bytes < 0.075

So, the way to avoid that warning is to use enough bytes with the values 0xFF 0xE8 0x8B 0x89 0x83 in the compressed section.