Linchakin

Huan - Encrypted PE Loader Generator

 August 28, 2021     No comments   

Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files.

How It Works?

First, Huan reads the given PE file and encrypts it with CBC mode AES-128 encryption algorithm. For the encryption, I used Tiny AES in C and prepared a padding code for the requirement of this library. When the encryption is complete, it compiles the loader using the Visual Studio compiler (MsBuild.exe) and creates an executable. After that, it creates a section (called .huan) on that executable, and embed the encrypted content, size information, IV and symmetric key. Both keys are created randomly for each copy of the loader. The layout of this section can be seen below.

When the loader is executed, it first takes the image base of itself by reading the Process Environment Block. After learning the image base, it parses the loaded copy of itself to find .huansection. Then, it decrypts the whole content, buffers it, and loads the binary which relies on the memory.


Quick Demo


TO-DO List
  • 32 Bit support
  • Improvements on PE loader
  • Blog post about PE loading process
  • Reducing the detection rate of the loader

References

Disclaimer

I shared this tool only for showing the code snippets of well known TTPs. I'm not responsible for the use of this tool for malicious activities.

Adblock test (Why?)


You may be interested in:
>> Is a Chromebook worth replacing a Windows laptop?
>> Find out in detail the outstanding features of Google Pixel 4a
>> Top 7 best earbuds you should not miss

Related Posts:
>> Recognizing 12 Basic Body Shapes To Choose Better Clothes
>>Ranking the 10 most used smart technology devices
>> Top 5+ Best E-readers: Compact & Convenient Pen
  • Share This:  
  •  Facebook
  •  Twitter
  •  Google+
  •  Stumble
  •  Digg
Email ThisBlogThis!Share to XShare to Facebook

Related Posts:

  • Luminar AI 1.5.0 – AI photo editing softwareby NMac The first image editor fully powered by artificial intelligence. More Possibilities. Innovative technologies give a whole new world of possib… Read More
  • Coca-Cola tweaks brand with magical new logo - and it's geniusByAmelia Bamsey NewsCan you spot the invisible bottle?It isn't every day that we see a company as big as Coca-Cola tweak its brand, but the soft drink giant has just revealed its magical new logo. Featuri… Read More
  • Squid Game's mesmerising staircase has an equally trippy origin storyByAmelia Bamsey NewsWe can totally see the similarities.If you've been living under a rock, you may have missed the Netflix show Squid Game taking over the internet. But if you did catch up on the Korean dr… Read More
  • Coming Soon 3.1 – Information about future movie releasesby NMac Coming soon is a simple OS X app that will enable you to get the latest information on upcoming movie releases on themoviedb.org. S… Read More
  • Surface Pro Black Friday deals 2021: grab early savings on Surface Pro 7, 6 and XByBeren Neale HardwareOur guide to Surface Pro Black Friday deals, an...Surface Pro Black Friday deals are the perfect chance to get your hands on Microsoft's hybrid tablet at a discount price. And with Black Friday 2021 f… Read More
Newer Post Older Post Home

0 Comments:

Post a Comment


Copyright © 2025 Linchakin | Powered by Blogger
Design by Hardeep Asrani | Blogger Theme by NewBloggerThemes.com | Distributed By Gooyaabi Templates