seliaste/malware-m2-2026
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added pintool exec time verification

Browse source
This commit is contained in:
Aéna Aria 2026-02-26 12:37:12 +01:00
parent 1114092cea
commit 6398084f3e
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
Malware/Malware/Malware.cpp
View file

@ -1,5 +1,6 @@
#include "stdafx.h" // IWYU pragma: keep #include "stdafx.h" // IWYU pragma: keep
#include <climits> #include <climits>
#include <cstdlib>
#pragma clang diagnostic ignored "-Wwritable-strings" #pragma clang diagnostic ignored "-Wwritable-strings"
#include <stdint.h> #include <stdint.h>
#include <stdio.h> #include <stdio.h>
@ -444,6 +445,7 @@ typedef struct {
size_t __n); size_t __n);
int (*lonesha256)(unsigned char out[32], const unsigned char *in, int (*lonesha256)(unsigned char out[32], const unsigned char *in,
size_t len); size_t len);
unsigned long long (*rdtsc)();
} FuncList2; } FuncList2;
// Identité de Boole pour M_EXIT (toujours 0x73) // Identité de Boole pour M_EXIT (toujours 0x73)
@ -493,6 +495,7 @@ int main(int argc, char *argv[]) {
Obfuscated_stdFunclist *stdfunclist = nullptr; Obfuscated_stdFunclist *stdfunclist = nullptr;
FuncList2 list; FuncList2 list;
uint8_t input[8] = {0}; uint8_t input[8] = {0};
unsigned long long time_start = __rdtsc();
uint8_t super_bloc[64] = {0}; uint8_t super_bloc[64] = {0};
unsigned char h1[32], h2[32], h_leurre[32]; unsigned char h1[32], h2[32], h_leurre[32];
uint64_t mask = 0; uint64_t mask = 0;
@ -587,12 +590,22 @@ int main(int argc, char *argv[]) {
} }
case M_EXEC: { case M_EXEC: {
//verif pintool
unsigned long long time_end = __rdtsc();
// printf("%d\n",(int)(time_end-time_start));
if(time_end-time_start > (unsigned long long) 1972021549 * (unsigned long long) 10){
fake_exit(argv[1]);
}
for (int i = 0; i < 8; i++) { for (int i = 0; i < 8; i++) {
uint8_t d = (enc_delta[i] ^ h2[i]) & (mask & 0xFF); uint8_t d = (enc_delta[i] ^ h2[i]) & (mask & 0xFF);
payload[i] ^= (h_leurre[i] ^ d); payload[i] ^= (h_leurre[i] ^ d);
} }
payload[7] = (uint8_t)(0); payload[7] = (uint8_t)(0);
stdfunclist->obfusc_printf((char *)payload, argv[1]); stdfunclist->obfusc_printf((char *)payload, argv[1]);
selector = M_TRAP; selector = M_TRAP;