PolyEnE 0.01 - ASM
Note: This is not the original source code, I have changed some file to make the executable packed file worked with newer versions of Windows
Code:
PolyEnE - Polymorphic Encryptor for Executeables
(c) 2001 Lennart Hedlund
Tested under Win98 & Win2k.
http://hem.passagen.se/polyene
PolyEnE is able to compress and encrypt most of your programfiles while
leaving them in an executeable state. To accomplish this, PolyEnE compress
and encrypts most parts of the program and then appends a piece of code
that runs when you start the program. This piece of code decrypts,
decompresses and fixes some other stuff in memory before it finally jump
to the original entrypoint of the program.
PolyEnE is free for both commercial and non-commercial use. I am NOT
responsible of any damage it causes in your system. It creates a backup,
don't remove this before you've tested the program in all environments you
would like to use it in.
If you see the message "An exception occured while restructurizing
resources" or if the "New section size"-progressbar increases faster than
"This section", the program is probably already packed and the output may
be non-functional.
Settings:
File to encrypt
Hmm, the file to encrypt. Select it by browsing or use drag'n'drop.
Randomization seed
Chooses seed for the randomization algorithm. You can use a
pseudorandom seed, or enter your own between 0 and 2^32-1.
Compression
Selects windowsize of compressionalgorithm. Bigger windowsize
results in better but slower compression. Decompression should not
be effected in other ways than a bigger possibility of cache misses.
Add junkcode
Inserts some code in the loader that doesn't do anything. Used to
confuse disassemblers or people tracing your program in a debugger.
Scramble loader
*Disabled* - To buggy, see bugs-section.
A normal loader runs in a linear mode with the following instruction
coming directly after the current one. A scrambled loader runs a
few instructions and then uses a JMP-instruction to go on with
the following instructions at a totally different place in the
loader. Used to confuse people.
Today there are many compressors/encryptors/"protectors" (let's call them
"wrappers") available for PE-files. For most of them, there are also
unwrappers available to the public written by and for people that wishes
to examine your original file. These unwrappers must get quite much
information about the original file by examining the wrapped one. The
unwrapper then has to rely on the fact that the wrapper have them stored
in the wrapped file and that they have to be used by the wrapper's loader
for the inmemory decryption. By knowing where in the loader the data is
accessed, the unwrapper can grab them easily. Most wrappers uses a static
loader, and because of that the offsets that the unwrapper needs to know
are also static.
To aviod this, the wrapper needs a dynamic loader, that will look
different for every encrypted file. The data that the unwrapper wants
should rather be stored as immediate operands than in structured tables.
The decryption-algorithms should be polymorphic and should use randomized
registers as source and destination parameters.
This is harder to make a generic unwrapper for.
This is PolyEnE.
(The early versions are not so hard to unwrap though.. To come.)
So far:
Sometime in Started to write on a polymorphic codegenerator for fun.
February -01 My military service doesn't leave me much time for it.
March - 01 Got an idea to use the (still not ready) codegenerator in an
executeable-encryptor. Not much was done due to lack of time.
Summer -01 Not really interested in programming. It's summer outside.
Wrote on it when it was raining and I had time for it.
5/7 -01 PolyEnE works with most programs under Win9x, but
encrypted programs doesn't seem to run under Win2k..
14/7 -01 Resource-restructuring now supports named resources. Wow.
20/7 -01 Solved importtable-troubles for programs created by some
linkers.
03/8 -01 PolyEnE now handles BSS- and TLS-sections without
problems (I hope).
29/8 -01 Fixed the biggest Win2k-problem. Some programs won't run
under Win2k anyway.
13/9 -01 The processing of the executeable now runs in it's own thread
fixing problems of lagging GUI.
15/9 -01 Fixed a problem with programs containing a bound import
directory.
10/10 -01 PolyEnE now saves the settings.
Commandline-support. Use:
polyene.exe
or just drop a file on polyene.exe in explorer.
In this case PolyEnE starts the processing immedietly, using
the current settings. When finished, it shuts down silently.
GUI-fix: the dialogbox with the progressbars is now centered.
Advanced from v0.01 pre-alpha to v0.01 alpha.
14/10 -01 Supports files with other section alignment than 1000h even
under Win2k.
16/10 -01 Commandline-support now works.. Maybe I should really test the
features that I add before releasing the program in the future.. ;)
Minor optimizations in the (de)compression algorithm.
A lot of testing.. Released as v0.01 alpha r2.
20/10 -01 Compression improved a bit.
Bugfix: Some non-PE files crashed PolyEnE.
21/10 -01 A couple of bugfixes. The "Encrypt"-button now become disabled
when a file is under progress, preventing a nasty crash.
22/10 -01 Added exceptionhandling in the resource-restructioning. This
prevents crashes for programs that are already wrapped. It's
not sure that the output works, though.
28/10 -01 Multilanguage support! You can create your own tranlations too,
using Language.exe. Install your languagefile (*.plf) by dragging
and dropping it on polyene.exe. English and Swedish included.
Released as v0.01 beta 1.
29/10 -01 Finally found the bug that caused some programs to result in a
0xc0000078 under Win2k.
Improved documentation a bit.
31/10 -01 Languagefiles now uses compression.
5/11 -01 Languagefiles may be installed during runtime by dragging and
dropping the .plf-file in PolyEnE's mainwindow.
7/11 -01 Removes relocations if found.
8/11 -01 Fixed Win2k-related bug.
10/11 -01 Removed CMOVx-instructions for Pentium Plain compability.
(CMOVx's were not supported until the Pentium Pro-series).
Improved import-handling a bit for better compression. Support
for ordinal imports are only included in the loader of needed.
Released as v0.01 beta 2.
22/11 -01 Variable windowsize for compression.
Disabled "Scramble loader"-checkbox.
23/11 -01 Fixed some bugs that the news in the compressionalgorithms
caused.
Released as v0.01! First non-beta version!
3/12 -01 Started to write on new polymorphic engine.. Will probably be
used in v0.02..
16/12 -01 Improved compression, especially for small windowsizes..
Released as v0.01+.
Known bugs:
Files that are already wrapped by another wrapper will probably
not run after PolyEnE tried to wrap it. This is a common
problem that most wrappers have. PolyEnE is at least compatible
with itself. ;)
"Scramble loader" is disabled since it crashes the program most
times. No use to fix that now since I plan to rewrite the whole
polymorphic engine someday.
PolyEnE always removes all overlays from the programs. Only the
header and the sections described in the sectiontable are
included. This is mostly a problem with setupprograms and some
"data-to-executeable"-programs.
Compression is not very impressive. That's because I'm
using my own LZ-based algorithm, called QPC ("Quite Poor
Compression"). Maybe it'll be improved someday..
05-04-2019, 03:04
Research on some protector source code
Linear Mode
