Metamorphing

Hey,
so I read about polymorphism and metamorphism. Now I want to create a tiny program that morphs executables and dlls. I thought about just reading the bytes of the target file and disassamble it. After that I want to insert some junk code and change a few commands so it will do something different but get the same result.
But how does a real morpher exactly work?

MazzMan

http://www.mpgh.net/forum/31-c-c-pro...assembler.html

This might help you out

Oh, thanks! I already saw that thread but it says polymorphic in the Title so I thought it's not what I want (polymorphic =! metamorphic). Now I took another look at it and it may be what I am looking for.

"But how does a real morpher exactly work?"

Do you understand basic assembly?

inc eax;
------------------
add eax,1;
------------------
add eax, 3;
sub eax, 2;
------------------
add eax, 10;
sub eax, 9;
------------------
sub eax, 5;
add eax, 6;
------------------

all are equivelent to myAge +=1;

So you get the same final result (eax increases by 1), but the code is different. If an anti-cheat is finding your hack because it scans for it in memory, you can use this to "change the code", but the "new code" does the same things as the old.
It's more complex than that, but that's the basic idea.

Originally Posted by abuckau907

"But how does a real morpher exactly work?"

Do you understand basic assembly?

inc eax;
------------------
add eax,1;
------------------
add eax, 3;
sub eax, 2;
------------------
add eax, 10;
sub eax, 9;
------------------
sub eax, 5;
add eax, 6;
------------------

all are equivelent to myAge +=1;

So you get the same final result (eax increases by 1), but the code is different. If an anti-cheat is finding your hack because it scans for it in memory, you can use this to "change the code", but the "new code" does the same things as the old.
It's more complex than that, but that's the basic idea.

Yes I understand basic assembly.
Does the anti-cheat also scan for already detected hacks by looking for specific code patterns? As I know PunkBuster looks for any changes in the memory (hooks, etc.), so a morpher woulnd be very effective I gues

.
But I understand that morphing is being used for chaning the identity of a program or pice of code.

Originally Posted by MazzMan

Yes I understand basic assembly.
Does the anti-cheat also scan for already detected hacks by looking for specific code patterns? As I know PunkBuster looks for any changes in the memory (hooks, etc.), so a morpher woulnd be very effective I gues

.
But I understand that morphing is being used for chaning the identity of a program or pice of code.

Depends on the anti-cheat software...id imagine they do both, but I have zero experience with any particular anticheat, sry.

edit: "As I know PunkBuster looks for any changes in the memory (hooks, etc.), so a morpher woulnd be very effective I gues"

wouldn't* ?

If I understand you correctly (and what any anti-cheat could do): it checks it's OWN code and verifies that it hasn't been modified (probably using a hash/checksum for each 'critical' sections of code). So if you modify any 'critical' section, the program will trigger a warning or whatnot - at that point, you have to start 'messing with' the game code that deals with calculating the checksums. Maybe.

Metamorphing

Post a Reply

Similar Threads

Tags for this Thread