KO
|
EN
gitlite — search
Search
#ios
#swift
#react
#python
#javascript
#translation
#android
#laravel
#game
#php
#blog
#screenshot
DRMBinViaOrdinalImports
★ 73
Open GitHub ↗
Create Anti-Copy DRM Malware
Download README (.md)
Explore Similar Repositories
generative_pose
:
Code for our ICCV 19 paper : Monocular 3D Human Pose Estimation by Generation and Ordinal Ranking
bevel
:
Ordinal regression in Python
micro-ordinals
:
Minimal JS library for ordinals and inscriptions on top of scure-btc-signer
OrdinalCLIP
:
[NeurIP'22] OrdinalCLIP: Learning Rank Prompts for Language-Guided Ordinal Regression
ordinals-indexer
:
API server and index synchronizer for ordinals inscriptions
// repository documentation
Was this content helpful?
★ 0
(0 ratings)
Select Rating:
★
★
★
★
★
Submit Feedback
Recent Feedback
×
Download README
Do you want to download the
README.md
file for
DRMBinViaOrdinalImports
?
Download (.md)
# DRMBinViaOrdinalImports - Create Anti-Copy DRM Malware ### Quick Links [Maldev Academy Home](https://maldevacademy.com?ref=gh) [Maldev Academy Syllabus](https://maldevacademy.com/syllabus?ref=gh) [Maldev Academy Pricing](https://maldevacademy.com/pricing?ref=gh) ## Summary This repository uses a technique to modify a program's Import Address Table (IAT) by replacing the imported function names with their corresponding ordinals, resulting in a binary that exclusively imports functions through ordinals. This technique reduces the chances of the binary being successfully analyzed by sandbox systems due to the mismatch in ordinal values on the different systems. This contrast causes the Windows Loader to either fail to locate the correct function address or retrieve an incorrect function, leading to the binary being broken in the sandbox environment. Lastly, this technique makes it more challenging to reverse engineer the binary. This repository includes two projects: ### TechTestBuilder.exe Reads a PE file from disk and overwrites its name-imported functions with their ordinal values. The generated program will only run on a system where the imported functions have the same ordinal values as the system that generated it. * Using the `TechTestBuilder.exe` program to generate `mimikatzDRM.exe`, which is `mimikatz.exe` but with ordinals-imported functions.  </br> </br> * Running `mimikatzDRM.exe` on a different system than the one used to generate it, will throw the following error.  </br> </br> ### OrdinalDRMBin.exe This project utilizes the DRM technique itself when first executed. This means that this binary cannot be executed on other machines as easily. `OrdinalDRMBin.exe` applies the following steps: 1. Checks if the local program has any name-imported functions, if no, it will skip applying the IAT patch. 2. Read itself from the disk, and convert all of the name-imported functions to be ordinal-imported. 3. Delete itself from disk. 4. Write the new image where all the functions are imported by ordinal. * The image below shows `OrdinalDRMBin.exe` without being executed. Notice the functions are imported by name.  </br> </br> * The image below shows `OrdinalDRMBin.exe` after being executed. Notice the functions are now imported by their ordinals.  </br> ### Note As mentioned, systems with the exact ordinal values for all of the imported functions of the generated implementation will be able to run the protected binary. However, the chances of this happening can be reduced by importing functions from different DLLs. The same approach used in the [IAT Camouflage](https://maldevacademy.com/modules/80?view=blocks) module can be used for this purpose.
