creating a polymorphic excecutable on linux with objectconv, nasm, gcc and mkpoly 1. generate object file with gcc -c 2. objectconv -fnasm 3. in the generated .asm file remove 'function' from the global statements 4. global variables should be removed from the global statement and moved to .bss section variablename: resb <#ofbytes> 4. remove the alight=# execute at the begining of each section 5. remove the .eh_frame section 6. insert '%include "mkpoly.inc"' at the begining of the file 7. insert DECRYPTOR_SECTION start,end-start where start is a variable that is located at the begining of section you want to encrypt and end is at the end. This section should be aligned by 16 bytes with the line 'align 16' at the begining and end. keep note of the start and end variables you use for later 8. push rsi register at the begining of the decrypt function and pop after return (the mkpoly.inc file includes instructions that change the rsi register) 9.use the nasm command to generate an object file from the nasm code nasm -felf64 10.link the object file with gcc and use to -no-pie flag to ignore position independent excecutables. without this you will have a segmentation fault 11. find the locations of the start and end of the decrypt area using grep ex: objdump -x | grep -E "start|end|decrypt" for mkpoly us need the offset of where the encrypted area starts, the size of the encrypted area (end - start) and the offset of the decryption function 12. call the mkpoly mkpoly the arguments must be hexidecimal format the funciton will create an excecutable with .crypt appended to the end change the permissions to run