Polymorphic excecutable

Here is an example of what the NASM should look like after modifying the output from the objconv command. This was generated from the metamorphic code example. There are two layers of encryption for the mkpoly command to activate. The decrypt_1 function should be activated first with mkpoly because it is the inner layer. Then the decrypt_2 function should be activated to add a second layer of decryption. When the code runs it will first decrypt the outer layer by calling decrypt_2 which will decrypt the decrypt_1 function. Then decrypt_1 will be called to decrypt the inner layer.

Here is the encrypted version of the double layered polymorphic code. Notice the commands in the encryption area make no sense and some are just considered bad instructions. The mkpoly command inserts a randomly initialized decryption loop that decyrptes 16 bytes at a time with two 8 byte registers. The target area is encrypted with an inverse sequence of operations. This is why the encryption area must be aligned with 16 bytes. Using the mkpoly command it is possible to layer as many decryption functions as you like. Although the original code for this process was metamorphic, the encrypted code makes it impossible for the executable to find the junk areas where junk code is being inserted. If the metamorphic example is run before it is encrypted with mkpoly, it will generated another version of itself with randomized junk code which will make reverse engineering and signature based detection even harder.