Dokumentacja Techniczna API Silnika Polimorficznego Poly

function _poly(
  lpDecryptor : Pointer;          // output buffer for polymorphic code
  lpOutput : Pointer;             // output data buffer (can be the same as lpInput)
  lpInput : Pointer;              // input data buffer
  iSize : LongWord;               // input data size
  lpVA : Pointer;                 // virtual address of a data to be decrypted
  cMaxInstr : LongWord;           // max. number of real encryption instructions
  cMinInstr : LongWord;           // min. number of real encryption instructions
  iGarbage : LongWord;            // number of junks per instruction
  iForceSize : LongWord;          // force decryptor size (optional)
  lpRelativeAddr : Integer;       // relative output data offset (optional)
  var lpPolyOutRegs : TPOLY_REGS; // output registers (optional)
  iOptions : LongWord;            // flags
  lpWorkMem : Pointer;            // work memory
  iRandomSeed : Integer           // random seed for the internal randomizer
): LongWord;stdcall;external 'poly.dll';

  push    dwRandomSeed
  push    offset lpWorkMem
  push    iOptions
  push    lpPolyOutRegs
  push    lpRelativeAddr
  push    iForceSize
  push    iGarbage
  push    cMinInstr
  push    cMaxInstr
  push    lpVA
  push    iSize
  push    lpInput
  push    lpOutput
  push    lpDecryptor
  call    _poly

program poly_test;

{$APPTYPE CONSOLE}

uses StrUtils, Classes, SysUtils, Math, Windows;

// load library from the DLL file (by default .LIB file is used)
{$DEFINE USE_POLY_DLL}

// include additional Poly constants
{$I poly.inc}

const
  // number of test iterations
  POLY_TEST_ITERATIONS = 10000;

  // safe memory buffer size
  POLY_DECRYPTOR_SIZE = 1024 * 2048 * 10;

  // sample input data to encrypt
  cInputBuffer : Array [1..4] of Byte = ( $11, $22, $33, $44 );

var
  // output buffer
  cOutputBuffer : Array [1..4] of Byte;

  {$IFDEF USE_POLY_DLL}

  // library handle
  hDll : THandle;

  // function pointer (if loaded dynamically)
  fnPoly : TPolyProc;

  {$ENDIF}

  i : Integer;

  iMinEncryptionCommands, iMaxEncryptionCommands : LongWord;
  iGarbage : LongWord;
  iForceDecryptorSize : LongWord;
  iRelativeDataOutputOffset : Integer;
  iOptions : LongWord;
  dwResult : LongWord;
  dwOutputSize : LongWord;

  lpDecryptor : Pointer;
  lpWorkMem : Pointer;

  // output registers values (fill out only those marked to be returned)
  prPolyRegs : TPOLY_REGS;

  DecryptorFunction : TPolyDecryptorFunction;

//
// entrypoint
//
begin
  // initialize random number generator
  Randomize;

  // clean output array
  FillChar(cOutputBuffer, SizeOf(cOutputBuffer), 0);

  // load Poly engine from the DLL library
  {$IFDEF USE_POLY_DLL}

  hDll := LoadLibrary('poly.dll');

  if hDll = 0 Then
  begin
    WriteLn('Cannot load poly.dll library!');
    ReadLn;

    ExitCode := 1;
    Halt;
  end;

  @fnPoly := GetProcAddress(hDll, '_poly');

  if not Assigned(@fnPoly) Then
  begin
    WriteLn('Cannot find "_poly" function in poly.dll library!');
    ReadLn;

    ExitCode := 1;
    Halt;
  end;

  {$ENDIF}

  // allocate memory buffer for the encrypted block (it has to be executable)
  lpDecryptor := VirtualAlloc(nil, POLY_DECRYPTOR_SIZE, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);

  // work memory buffer (same size, also it has to be executable)
  lpWorkMem := VirtualAlloc(nil, POLY_DECRYPTOR_SIZE, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);

  for i := 0 to POLY_TEST_ITERATIONS do
  begin
    //
    // setup Poly engine parameters
    //

    // randomize parameters (remember, more means you need to increase
    // the size of the lpDecryptor & lpWorkMem buffers)

    // minimal number of encryption commands
    iMinEncryptionCommands := RandomRange(10, 50);

    // maximal number of encryption commands
    iMaxEncryptionCommands := RandomRange(iMinEncryptionCommands, iMinEncryptionCommands + 10);

    // number of junks per decryptor single command
    iGarbage := RandomRange(10, 50);

    // force decryptor size - if this value is set, Poly engine will try to generate
    // decryptor body that is exactly this size, it will modify other parameters on
    // the fly if the generated code is too small or too big and re-generate the code
    // again to meet your exact criteria (please make sure the working buffers
    // lpDecryptor and lpWorkMem are bigger than this value)
    iForceDecryptorSize := 0;

    // if this parameter is set, polymorphic decryption code will use it to calculate
    // the address of the encrypted data in memory, this pointer is relative to the
    // current position of the decryptor code in the memory (it can be positive or
    // negative)
    iRelativeDataOutputOffset := 0;

    // flags
    iOptions := 0;

    // POLY_SAVE_REGS - save all registers before the call and restore them after the call
    iOptions := iOptions or POLY_SAVE_REGS;

    // POLY_SAVE_FLAGS - save all CPU flags before the call and restore them after the call
    iOptions := iOptions or POLY_SAVE_FLAGS;

    // POLY_ATTACH_DATA - attach data to the decryptor body, decryption will overwrite
    // decryptor body and after decryption lpDecryptor will also be a pointer to the
    // decrypted buffer
    //
    // if this flag is not used, encrypted data has to be located on static VA address
    // declared in lpVA parameter or declared via relative address in iRelativeDataOutputOffset
    // parameter
    iOptions := iOptions or POLY_ATTACH_DATA;

    // POLY_RETURN - put a return instruction (RET) at the end of the decryption function,
    // so the decryptor returns to the caller, polymorphic decryptor can be inlined
    // between other code or some other code can be added after its body so it may or
    // may not return to the caller
    iOptions := iOptions or POLY_RETURN;

    // POLY_SET_REGS - return exact values in CPU registers after decryption (it must be
    // defined in POLY_REGS structure)
    iOptions := iOptions or POLY_SET_REGS;

    // return value in EAX register
    iOptions := iOptions or POLY_SET_EAX;

    // and lets say it should return some other value in EDX register after the call
    iOptions := iOptions or POLY_SET_EDX;

    // output registers values (fill out only those marked to be returned)

    // fill out the EAX register with a value that should be returned after
    // the decryption, in this example lets set it to the size of the decrypted
    // buffer (you can set anything)
    prPolyRegs.regEax := Length(cInputBuffer);

    // sample value to be returned in EDX register after the call (view it
    // with a debugger)
    prPolyRegs.regEdx := $DEADBEEF;

    // encrypt data & generate polymorphic decryptor
    {$IFDEF USE_POLY_DLL}
    dwOutputSize := fnPoly(
      lpDecryptor,                 // output buffer for polymorphic code
      @cOutputBuffer,              // output data buffer (can be the same as lpInput)
      @cInputBuffer,               // input data buffer
      Length(cInputBuffer),        // input data size
      @cOutputBuffer,              // virtual address of a data to be decrypted
      iMaxEncryptionCommands,      // max. number of real encryption instructions
      iMinEncryptionCommands,      // min. number of real encryption instructions
      iGarbage,                    // number of junks per instruction
      iForceDecryptorSize,         // force decryptor size (optional)
      iRelativeDataOutputOffset,   // relative output data offset (optional)
      prPolyRegs,                  // output registers (optional)
      iOptions,                    // additional options
      lpWorkMem,                   // work memory
      Random(65536)                // random seed for the internal randomizer
    );
    {$ELSE}
    dwOutputSize := _poly(
      lpDecryptor,                 // output buffer for polymorphic code
      @cOutputBuffer,              // output data buffer (can be the same as lpInput)
      @cInputBuffer,               // input data buffer
      Length(cInputBuffer),        // input data size
      @cOutputBuffer,              // virtual address of a data to be decrypted
      iMaxEncryptionCommands,      // max. number of real encryption instructions
      iMinEncryptionCommands,      // min. number of real encryption instructions
      iGarbage,                    // number of junks per instruction
      iForceDecryptorSize,         // force decryptor size (optional)
      iRelativeDataOutputOffset,   // relative output data offset (optional)
      prPolyRegs,                  // output registers (optional)
      iOptions,                    // additional options
      lpWorkMem,                   // work memory
      Random(65536)                // random seed for the internal randomizer
    );
    {$ENDIF}

    // validate output size (decryptor size in bytes)
    if dwOutputSize <> 0 then
    begin

      DecryptorFunction := lpDecryptor;

      // decrypt data
      dwResult := DecryptorFunction;

      // another way to invoke decryptor function (inline assembly)
      {
      asm
        int  3
        mov  eax, lpDecryptor;
        call  eax
        int 3
      end;
      }

      // validate decrypted data (if POLY_ATTACH_DATA flag was set - lpDecryptor
      // points to the decrypted data)
      if CompareMem(lpDecryptor, @cInputBuffer, Length(cInputBuffer)) <> True then
      begin
        WriteLn('Polymorphic engine failed (decrypted data is invalid)!');
        ReadLn;

        ExitCode := 2;
        Halt;
      end;
    end
    else
    begin
      WriteLn('Polymorphic engine failed!\n');
      ReadLn;

      ExitCode := 1;
      Halt;
    end;
  end;

  WriteLn(format('Polymorphic engine test success (%d iterations)', [ POLY_TEST_ITERATIONS ]));

  // zwolnij pamięć
  VirtualFree(lpDecryptor, 0, MEM_RELEASE);
  VirtualFree(lpWorkMem, 0, MEM_RELEASE);

  ReadLn;
end.

Wymagania