About

This repository is a sample of binary code obfuscation methods.

Contents

• Call Stack Tampering
• Non Returning Calls
• Overlapping Functions and Basic Blocks

Environment

• OS
  • Windows7 professional SP1
• Assembelr
  • NASM version 2.11.08
• Linker
  • Microsoft Incremental Linker Version 14.00.23026.0
  • (Bundled with Visual Studio 2015)

How to use

There are two ways to use.

• Use already assembled and linked binaries in /bin directory.
• Assemble and link from source by yourself.

How to assemble and link

• $ nasm -fwin32 <source_file>
• $ link <object file generated by nasm> /ENTRY:start /SUBSYSTEM:CONSOLE /defaultlib:kernel32.lib

Notice

Some code requires additional modification to a genereted binary. When you generate a binary by yourself, please read a head of source code.