Re: Hyperion - Paper about Windows PE run-time encryption

[Christian Ammann <c.ammann () hs-osnabrueck de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Dimitris,

thanks for your reply. I just checked your slides and your approach
looks really good :)

Of course we are interested in AV evasion ;) We also observed that the
increased AES-128 encryption entropy is a problem and marked as
suspicious by AV heuristics. My idea was to experiment with different
encodings (e.g. convert the bytes to a string representation to make
the AV heuristic think its just a collection of strings used by the
execuatble for user interaction). The idea to use instructions which
load the encrypted binary into memory looks very promising to me, so
thanks for your advice.

Yes, you are right, the current implementation of Hyperion is very
signature friendly. Our idea was to encrypt the complete binary (also
the decrypter and pe loader) and generate a decrypter stub using
polymorphism. Again, the idea to use metamorphism instead is also a
good apprroach. So, there will be definitely an enhanced version of
Hyperion using the discussed concepts to avoid AV detection.

The motivation our paper was to present a detailled description and
implementation of a basic PE encrypter/packer to the public.
Therefore, people can modify the reference implementation (which will
be released soon under a BSD license) or just use the concepts to
build their own PE crypter/packer.

Best regards,

Christian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPqjf/AAoJENerUt+Ej3tqR3oH/is2KGDPqzaomzP10jD+fHCT
OhNxYT0gDZNnIwSPPldYAB2uGqymSatGntMFUCzfHFbckloul/vbNg7ajZHPRgh2
V4XpAskjwQE11/rSTSeg9uGXvTskWx3VcKIzkytOaJJ2cMIs358YNDJwblkY4uMI
NQfbRgk5mYod/K3iYx9uZvb9fqpB5EXbdxPATWTwbCrXdmx1/EN/TnHdDBwh7rkA
26JqfTfcYVfEN2Z19uEANs6wFiZefXi/veJR3U/dWyerEFDdgjytUekRJkx/NvUG
521dLitXcx6+1gcLKerEZfkDihKaGmbaX/Vp+3xHXdfD68oGuRHYh0Nmu5Oi6wM=
=1k20
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/