article submitted by Progressor

Universal method of tricking antivirus.

I won't explain every command, you'll have to learn Assembler fo this.

Tools:
Hex redactor - I used Hiew 6.75 (http://webhost.kemtel.ru/~sen)
Fearless PE Tool 0.1 - http://areyoufearless.com/modules.php?op=m...Downloads&file=

index&req=getit&lid=125
UPX packer - http://upx.sourceforge.net/
Brain - must have it, you can't download it.

I took for example well known trojan wollf v1.6 (www.xfocus.org)

Now, let start:

Wollf is already packed by an old version of UPX, so we unpack and pack it again by newest version

of UPX.
Now we are using PE tool and we will find this info about our trojan:

Entry Point: 00024FD0h
Image Base: 00400000h

Let us open wollf.exe in Hiew, go to disassemble mode (F4/Decode), go to address Entry Point +

Image Base = 00424FD0h, for doing this press Goto (F5) and type ".00424FD0" (you need this dot

before address, because it is a virtual address). Now we see something like this:

Nice..
Need to test for KAV!
And one thing more that the link to Fearless PE tool is broken
It gave,

Thanx for sharing this knowledge. Very interesting reading. I don't know any assambly but always eager to learn

I encounter a problem while trying to reproduce the above:

call .000425154
loop .000425147

In both cases hiew gives me an error "Invalid Operand". I CAN add the addresses without a dot but I guess that wont work

Any idea what I'm doing wrong?

TIA

Simple question: why don't u simply use a debugger like IDA or OllyDbg instead of an hex editor with asm reading feature + PE editor?

Nice tut thks.

Response: those tools dont allow to change PE entry point..

Sorry to ask

I usually trick antivirus software by packing (force method if already packed) with exe32pack (/F option if already packed)...lazy method.

u can get Fearless PE Tool 0.1 faceless master from this link
http://areyoufearless.com/modules.php?op=m...download&sid=10

If you use the free space between code size and virtual size to patch your server dont forget to update the VA in the PEheader.

If you are out of space you could add a new section and hook your EIP with a long jump (need Sice to avoid complex VA/RVA calculation).

/EDIT:

If you only want to hook the EIP you could use the simple command:

#newEIP : move eax, oldEIP
#nextofft: jmp eax

JMPS are too unpredictable, I.E., you have to always calcuate offsets and crap.

The best universal way to jump anywhere you want is to do this:

PUSH <address> (make sure this is the virtual address)
RET

With this you can go anywhere without pain in the butt calcuations.

-niko

thanks for this tip
i ask a noob question because i'm not really understanding what this code do but in some exe i test it it ran fine

only one thing i try to put it on a dll. the patch trick the AV for the dll but the dll don't run correctly. it's normal ? or need an otther code for a dll file
thank for your answer

The PUSH RET trick is kinda not too good for DLL's - DLL imagebase changes depending on the system it's on. In other words, its code is relocated at run time to different addresses, hence this trick wouldn't work. Its mainly for EXE's - it wil always work right in an EXE, but not for DLL.

In DLL's you will still have to do some offset calcs no matter what.

-niko