Security News

<php
//------------------------------------------------------------------------------
//
// obfuscator v1.0 api usage example - Bartosz Wojcik (obfuscator@pelock.com)
//
//-------------------------------------------------------------------pelock.com-
 
$source = 'test proc dwParam:dword
 
label:  xor  eax,eax
label:xor edx,edx
label:
  push  dword ptr fs:[eax]
  pop  dword ptr fs:[eax]
 
  mov  edx,1024
  mov  eax,256
  mov  eax,0
 
  mov  edx,0ABCDEFh
  mov  ecx,123h
  mov  eax,123456789
  mov  eax,1
  mov  eax,-1
 
  mov  edx,2
  mov  edx,-2
 
  shl  eax,1
  shr  edx,16
 
  je  @f
  jmp  @f
@@:
  jz  @b
  jmp  @f
  je  @b
@@:
  jmp  @b
 
  jmp  @f
 
@@:
  mov  eax,0
  jmp  @b
  jne  @b
  jmp  @f
@@:
  mov  eax,dwParam
  xor  eax,eax
  sub  eax,eax
  mov  eax,100
  mov  edx,100
  mov  eax,0
  mov  edx,0
  mov  ecx,MB_ICONINFORMATION
  mov  edx,IDD_DIALOG1
  xor  eax,100h
  xor  edx,-100h
  add  eax,100h
  add  edx,-100h
  sub  eax,100h
  sub  eax,-100h
  and  eax,111b
  mov  eax,offset MessageBoxA
  mov  edx,offset MessageBoxA+1
 
  call  ExitProcess
 
  ret
test endp';
 
  $activation_code = "demo";
 
  // read number of credits left
  //$credits_left = obfuscator_get_credits($activation_code);
 
  // obfuscate source code
  $obfuscated_code = obfuscator_obfuscate($activation_code, $source);
 
  echo "&lt;pre&gt;";
  //echo "Number of credits left: {$credits_left}";
  echo $obfuscated_code;
  echo "&lt;/pre&gt;";
 
 
//
// obfuscate source code (use "demo" as the $activation_code to run in demo mode)
//
function obfuscator_obfuscate($activation_code, $source)
{
  // compress source code before sending it to the server
  $source = urlencode(@base64_encode(@gzcompress($source, 9)));
 
  // enable additional options (comment it out if you want to disable it)
  $options = "";
 
  $options .= "&p=1";  // Source code is compressed and result will be compressed too
 
  $options .= "&cm=1";  // Change code execution flow
  $options .= "&cl=1";  // Mutate original opcodes into series of other equivalent instructions
  $options .= "&ec=1";  // Hide procedure calls by replacing "call" instructions (WinApi etc.)
  $options .= "&as=1";  // Assume WinApi calling convention (EAX,ECX & EDX registers can be changed before call)
 
  $options .= "&fc=1";  // Insert fake commands (add reg32,1 sub reg32,1 etc.)
  $options .= "&f32=1"; // 32 bit fake commands
  $options .= "&f16=1"; // 16 bit fake commands
  $options .= "&f8=1";  // 8 bit fake commands
 
  $options .= "&if=1";  // Insert fake jumps (jx+jnx)
  $options .= "&ir=1";  // Insert reg jumps (jmp reg32)
  $options .= "&ic=1";  // Insert COM like jumps (jmp dword ptr[imm32+rnd])
 
  $options .= "&ij=1";  // Insert junk instructions between original instructions
  $options .= "&jmi=2"; // Min junks
  $options .= "&jma=4"; // Max junks
 
  $options .= "&rp=1";  // Prefix junk opcodes with "REP/REPxx"
  $options .= "&is=1";  // Invoke exceptions in code (insert SEH handlers)
 
  // send a request
  $result = post_request("http://www.pelock.com/obfuscator/login.php", "c={$activation_code}&a=o{$options}&s={$source}");
 
  // decompress obfuscated code (or the error message)
  if (!empty($result))
  {
    $result = @gzuncompress($result);
  }
 
  return $result;
}
 
 
//
// get number of credits left (use "demo" as the $activation_code to run in demo mode)
//
function obfuscator_get_credits($activation_code)
{
  return post_request("http://www.pelock.com/obfuscator/login.php", "c={$activation_code}&a=c");
}
 
//
// generic POST request function
//
function post_request($url, $data)
{
  $c = curl_init();
 
  curl_setopt($c, CURLOPT_URL, $url);
  curl_setopt($c, CURLOPT_POST, 1);
  curl_setopt($c, CURLOPT_POSTFIELDS, $data);
  curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($c, CURLOPT_FRESH_CONNECT, true);
  curl_setopt($c, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
 
  $response = curl_exec($c);
 
//  if(curl_errno($c))
//  {
//    $info = curl_getinfo($c);
//
//    print_r($info);
//
//    echo curl_error($c);
//  }
 
  curl_close($c);
 
  return $response;
}
 
?>