nodiuus/nocturneA bin2bin code virtualizer for x86-64 PE's
Named after one of my favorite games, "nocturne" is a bin2bin x86-64 PE code virtualizer and binary rewriter.
To use the Nocturne virtualizer, copy and include "nocturne_sdk.hpp" from core/ into your project.
#include "nocturne_sdk.hpp"
VIRTUALIZE int secret(int x) {
if (x % 2 == 0) {
return x / 2;
} else {
return x * 3 + 1;
}
}
VIRTUALIZE_MARK(secret);
Afterwards, run the cli executable.
cli.exe -i <input.exe> -o <output.exe>
Example:
cli.exe -i example.exe -o example_protected.exe
By default, the CLI uses auto mode.
Or, explicitly:
cli.exe -i <input.exe> -o <output.exe> --mode auto
Example:
cli.exe -i example.exe -o example_protected.exe --mode auto
To scan for markers:
cli.exe -i <input.exe> -o <output.exe> --mode markers
Example:
cli.exe -i example.exe -o example_protected.exe --mode markers
Or, if you want to virtualize specific segments of a binary without the SDK:
cli.exe -i <input.exe> -o <output.exe> --mode rva <start_rva> <end_rva>
Example:
cli.exe -i calc.exe -o calc_vmp.exe --mode rva 0x1600 0x1864
Before Virtualization:
After Virtualization:
Obfuscated dispatcher loop:
LIEF
Zydis
argparse
First and foremost, this is mostly a POC project. Please don't expect it to be too stable. With that being said, I will be progressively adding more features/fixes to this as time goes on.
If there are any features / handlers you want implemented, I implore you to open an issue. I welcome any and all contributions.
This project is source-available, not open source.
The source code is available under the PolyForm Noncommercial License 1.0.0.
You may use, study, modify, and share this software for noncommercial purposes, subject to the license terms.
Commercial use, enterprise use, internal company use, production business use, hosted services, paid products, client work, consulting work, or organizational deployment is not permitted without a separate written license.
For commercial or enterprise licensing, contact: [email protected] / @nodiuus