xoreaxeaxeax/movfuscator

run on windows

dererror33 opened this issue · 10 comments

it is possible to windows?

turbo commented

Did you even try anything?

There are two solutions:

  1. Use self-modification of the code to insert CALL instructions to Windows code. First, SUB is obfuscated and run with MOV, arguments are filled using MOV instructions (straightforward, like gcc does) and a CALL instruction is inserted, then reverted.
  2. Use non-MOV instructions to call Windows code. First, to call, say WriteConsoleA, we first subtract 20 bytes from ESP using MOV instructions, we fill in the arguments and CALL the function.

It may be possible with something like mingw. Barring that, the calling conventions, exception handling, etc. would have to be replaced. For now, there is no plan to add this.

Sorry for bumping, I know this is an old issue but I would love to see it on Windows too.
I want to create a few "CrackMes" for a competition and the movfuscator would be ideal for this.

I hope that @xoreaxeaxeax will be able to make it one day, I'm looking forward to it ;)