Source code
Options
test proc dwParam:dword label: xor eax,eax label:xor edx,edx label: push dword ptr fs:[eax] pop dword ptr fs:[eax] mov edx,1024 mov eax,256 mov eax,0 mov edx,0ABCDEFh mov ecx,123h mov eax,123456789 mov eax,1 mov eax,-1 mov edx,2 mov edx,-2 shl eax,1 shr edx,16 je @f jmp @f @@: jz @b jmp @f je @b @@: jmp @b jmp @f @@: mov eax,0 jmp @b jne @b jmp @f @@: mov eax,dwParam xor eax,eax sub eax,eax mov eax,100 mov edx,100 mov eax,0 mov edx,0 mov ecx,MB_ICONINFORMATION mov edx,IDD_DIALOG1 xor eax,100h xor edx,-100h add eax,100h add edx,-100h sub eax,100h sub eax,-100h and eax,111b mov eax,offset MessageBoxA mov edx,offset MessageBoxA+1 call ExitProcess ret test endp
Change code execution flow
Mutate original opcodes into series of other equivalent instructions
Hide procedure calls by replacing "call" instructions (WinApi etc.)
Assume WinApi calling convention (EAX,ECX & EDX registers can be changed before call)
Insert fake commands (add reg32,1 sub reg32,1 etc.)
32 bit
16 bit
8 bit
Insert fake jumps (jx+jnx)
Insert reg jumps (jmp reg32)
Insert COM like jumps (jmp dword ptr[imm32+rnd])
Min.
Max.
Insert junk instructions between original instructions
Min.
Max.
Prefix junk opcodes with "REP/REPxx"
Invoke exceptions in code (insert SEH handlers)
Obfuscator has been used 2261 times already.
Activation code:
Quick info:
only MASM syntax is supported
you need to provide at least one procedure
if you have any questions regarding obfuscator
mail me
In demo mode only "Change code excution flow" option is working (it's enabled by default), and obfuscator will process only one procedure (1 kB max.)
You can enter your activation code and obfuscator will work without restrictions.