Code:
import random
reg32 = ["EAX", "EBX", "ECX", "EDX", "ESP", "EBP", "ESI" ,"EDI"]
reg16 = [['AL', 'AH'], ['BL', 'BH'], ['CL', 'CH'],[ 'DL', 'DH']]
BitWiseOps = ["And", "Or", "XOr", "Mov"]
StackOps = ["Push", "Pop"]
Xors = [["XOR {DREG}, {DREG}", "MOV {REG}, {DREG}"],
["SUB {REG}, {REG}"],
["OR {REG}, ffffffffh", "Push {DREG}", "MOV {DREG}, ffffffffh", "SUB {REG}, {DREG}", "Pop {DREG}"],
["OR {REG}, ffffffh", "AND {REG}, 55555555h", "AND {REG}, AAAAAAAAh"]]
Movs = [["OR {REG}, ffffffffh", "AND {REG}, {amount}"], ["XOR {REG}, {REG}", "ADD {REG}, {amount}"]]
def GhostWriter():
file = open(sys.argv[1], 'r')
fileLines = file.read()
fileLines = fileLines.splitlines()
for i in range(len(fileLines)):
l = fileLines[i]
if len(l) < 4:
print "invalid line is less than 5 characters long :" + l
#break;
elif l[:1] == "//":
print "comment line: " + l
else:
if l[:3] == 'Pop' or l[:4] == 'Push':
l = stack(l)
else :
l = bitWiseObfuscation(l)
fileLines[i] = l
newName = sys.argv[1]#.split('.')
if len(newName) > 1 : newName = newName.replace(".", "REMADE.", 1)
else: newName = sys.argv[1] + "REMADE"
newFile = open(newName, 'w')
for l in fileLines: newFile.write(l)
newFile.close()
print "file saved as: " + newName
def bitWiseObfuscation(l):
cmds = readCommand(l)
print cmds
if len(cmds) == 3:
if cmds[0].upper() == "XOR" and cmds[1].upper() == cmds[2].upper():
newRegister = getRandomRegister(cmds[1].upper())
newCommands = Xors[random.randint(0,3)]
finalCommand = ""
for c in newCommands: finalCommand += c + "\n"
finalCommand = finalCommand.replace('{DREG}', newRegister)
finalCommand = finalCommand.replace('{REG}', cmds[1].upper())
finalCommand = finalCommand.replace('{REG}', cmds[1].upper())
return finalCommand
elif cmds[0].upper() == "MOV":
newCommands = Movs[random.randint(0,1)]
finalCommand = ""
for c in newCommands: finalCommand += c + "\n"
finalCommand = finalCommand.replace('{REG}', cmds[1].upper())
finalCommand = finalCommand.replace('{amount}', cmds[2].upper())
return finalCommand
return l + "\n"
def getRandomRegister(register):
newRegister = reg32[random.randint(0,7)]
if newRegister != register.upper(): return newRegister
else: return getRandomRegister(register)
def stack(command):
return command
def readCommand(command):
commandParts = command.rsplit()
for i in range(len(commandParts)):
if len(commandParts[i]) == 3 and ',' in commandParts[i]:
commandParts[i] = commandParts[i].replace(',', '')
elif len(commandParts) == 2 and ',' in commandParts[i] and i == 1:
commandParts = [commandParts[0]] + commandParts[1].split(',')
return commandParts
if __name__ == "__main__":
import sys
if len(sys.argv) < 2:
print "please write a path to a file as the first parameter (after the script name)"
else:
GhostWriter()
This is one technique, albeit not the one I am using for my perl 
Re: [script] for AV evasion
Originally Posted by ShadowMaster
