Usr6 Posted February 12, 2012 Report Posted February 12, 2012 These next series of posts will focus on explaining a file infector/encrypter that I wrote a week ago or so. It works with any PE32 executable file, overcomes issues with randomized base addresses, and takes advantage of Visual Studio’s C++ compiler to generate the assembly code to inject into the target. This allows for large portions of the injected code to be written in C and greatly speeds up development time. Lastly, the target file is also encrypted by the infector and the decryption routine is written in to decrypt the file image at runtime. The series will be broken up into the four parts listed below:BackgroundOnline PDFPE file modification/section injectionOnline PDFWriting the compiled stubOnline PDFFull source code and remarksOnline PDFThe source code and compiled sample can be found here A Visual Studio 2010 project can be found here 1 Quote
