Skip to content

Commit 9d371c7

Browse files
committed
fixed false bolding
1 parent 4d53eae commit 9d371c7

File tree

1 file changed

+6
-8
lines changed

1 file changed

+6
-8
lines changed

README.md

+6-8
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,13 @@ gcc -no-pie example.o -o example
2626

2727
In order to use **mkpoly**, the target executable must contains a _DECRYPTOR_SECTION_ (see _mkpoly.inc_ and _example.asm_) that is a piece of code that contains the function used by the program to decrypt itself. Also, the section to encrypt must be aligned to 16 bytes and its size must be a multiple of 16. The macro _DECRYPTOR_SECTION_ defines two local labels: _.mkpoly_loop_ and _.mkpoly_func_ that are, respectively, the begin of the decryptor loop and the begin of the decryption function.
2828

29-
**mkpoly** takes 4 input parameters (all in hexadecimal):
29+
**mkpoly** takes 4 input parameters (all in the hexadecimal format):
3030
- The filename of the binary to make polymorphic
3131
- The offset in the binary file of the section to encrypt
3232
- The size of the section to encrypt
33-
- The offset in the binary file in which to place the decrypt function
33+
- The offset in the binary file where to place the decrypt function
3434

35-
Note: All the integer parameters must be passed in the hexadecimal format.
36-
37-
When executed, **makepoly** randomly generates the encryption and the decryption functions. The encryption function is used to encrypt the section specified by the user. The decryption function is placed in the _DECRYPTOR_SECTION_ at the offset specified by the user. So, when the output binary is executed, it will decrypt parts of itself executing the _DECRYPTOR_SECTION_.
35+
When executed, the polymorphic engine randomly generates the encryption and the decryption functions. The encryption function is used to encrypt the section specified by the user. The decryption function is placed in the _DECRYPTOR_SECTION_ at the offset specified by the user. So, when the output binary is executed, it will decrypt parts of itself executing the _DECRYPTOR_SECTION_.
3836

3937
## example
4038

@@ -49,9 +47,9 @@ $ objdump -h example | grep -E ".text"
4947
$ objdump -x example | grep -E "hello|decrypt"
5048
000000000040115e l .text 0000000000000000 decrypt
5149
00000000004011b0 l .text 0000000000000000 decrypt.mkpoly_loop
52-
0000000000**4011bb** l .text 0000000000000000 decrypt.mkpoly_func
53-
0000000000**4012f0** l .text 0000000000000000 hello
54-
0000000000**401300** l .text 0000000000000000 hello.end
50+
00000000004011bb l .text 0000000000000000 decrypt.mkpoly_func
51+
00000000004012f0 l .text 0000000000000000 hello
52+
0000000000401300 l .text 0000000000000000 hello.end
5553
```
5654

5755
This will create a random encrypted version of the program _example_ called _example.crypt_.

0 commit comments

Comments
 (0)