extern getpagesize extern mprotect ; protection mode flags %define PROT_NONE 0x0 %define PROT_READ 0x1 %define PROT_WRITE 0x2 %define PROT_EXEC 0x4 ; no operation x86 opcode %define OPCODE_NOP 0x90 ; the size of the encryption/decryption functions %define MKPOLY_FUNC_SIZE 0x100 ; %1 the label of the section to decrypt ; %2 the size of the section to decrypt %macro DECRYPTOR_SECTION 2 push r12 push r13 call getpagesize mov rcx, rax sub rcx, 1 mov rdi, %1 mov rsi, %2 mov rax, rdi add rsi, rcx not rcx and rdi, rcx sub rax, rdi add rsi, rax and rsi, rcx mov r12, rdi mov r13, rsi mov edx, (PROT_READ | PROT_WRITE | PROT_EXEC) call mprotect mov rdi, %1 lea rsi, [rdi+%2] .mkpoly_loop: mov eax, [rdi ] mov ecx, [rdi+0x4] mov edx, [rdi+0x8] mov ebx, [rdi+0xC] .mkpoly_func: times MKPOLY_FUNC_SIZE db OPCODE_NOP mov [rdi ], eax mov [rdi+0x4], ecx mov [rdi+0x8], edx mov [rdi+0xC], ebx add rdi, 0x10 cmp rdi, rsi jne .mkpoly_loop mov rdi, r12 mov rsi, r13 mov edx, (PROT_READ | PROT_EXEC) call mprotect pop r13 pop r12 %endmacro