Navigation
Advertising
Friends & relatives
Search site
Similar entries
Recent blog posts
my last del.icio.us links
- Цитата #417017 — Цитатник Рунета
- Build Your Own Bitcasa « Nerdland
- Why Nikola Tesla was the greatest geek who ever lived - The Oatmeal
- Making scripts run at boot time with Debian
- Цитата #416968 — Цитатник Рунета
- 9GAG - Being a lefty
- Russian Roulette Water Balloon
- Цитата #416940 — Цитатник Рунета
- Цитата #416938 — Цитатник Рунета
- Allan Sieber Talk to Himself Show
inPEct .EXE binder
inPEct means "infect", applicable to PE ("Portable Executable") format. It is an executable binder, thus, it's able to join two .exe files in one. Now, why should anyone want to do that, is a question apart (screenshot is self-explanatory 
At the time I've wrote inPEct, most executable binders were similar to
SFX ("Self-Extract") stubs: they simply extracted their content to
somewhere (commonly %TEMP% directory). inPEct is a bit
different, as it expands the host executable and encrypts & inserts
the hosted executable inside it. When someone executes the bound
application, the host executable runs normally, and the hosted
executable is extracted and then executed. inPEct also has a feature to
execute the hosted executable only once ('smart feature'):
if the bound program is executed by user again, hosted file won't be
extracted anymore. And inPEct is very fast and small, as it's
written entirely in pure assembler (in fact, inPEct's loader has only
800 bytes!). It's encryption algorithm is very cheap, but still uses a
random seed. Thus, I expect that inPEct is more stealthy than similar
binders.
Please note that almost every AntiVirus program detects and
quarantines inPEct (and files produced by it)! This shows it's popularity in the past, I guess 
But today it's useful mostly as a pure assembler programming example... And for AntiVirus research, as this paper actually shows.
 |
stas » January 1, 2007 » 23:00
19761 reads
|