inPEct .EXE binder

inPEct screenshot

inPEct means "infect", applicable to PE ("Portable Executable") format. It is an executable binder, thus, it's able to join two .exe files in one. Now, why should anyone want to do that, is a question apart (screenshot is self-explanatory Smiling
At the time I've wrote inPEct, most executable binders were similar to SFX ("Self-Extract") stubs: they simply extracted their content to somewhere (commonly %TEMP% directory). inPEct is a bit different, as it expands the host executable and encrypts & inserts the hosted executable inside it. When someone executes the bound application, the host executable runs normally, and the hosted executable is extracted and then executed. inPEct also has a feature to execute the hosted executable only once ('smart feature'): if the bound program is executed by user again, hosted file won't be extracted anymore. And inPEct is very fast and small, as  it's written entirely in pure assembler (in fact, inPEct's loader has only 800 bytes!). It's encryption algorithm is very cheap, but still uses a random seed. Thus, I expect that inPEct is more stealthy than similar binders.
Please note that almost every AntiVirus program detects and quarantines inPEct (and files produced by it)! This shows it's popularity in the past, I guess Eye-wink

But today it's useful mostly as a pure assembler programming example... And for AntiVirus research, as this paper actually shows.


Share/Save/Bookmark

stas's picture
stas » January 1, 2007 » 23:00

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

BitShape PE Crypt

BitShape PE Crypt is a powerful polymorphic Win32 applications protector. Features includes SoftIce autodetection, anti-debug API, anti-dumping and some other advanced technologies.

http://www.easy-share.com/1905334293/pec15.zip

Anonymous (not verified) » May 23, 2009 » 17:56

Post new comment

*
*
The content of this field is kept private and will not be shown publicly.


*

  • Allowed HTML tags: <a> <i> <b> <u> <img> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <pre> <hr>
  • Lines and paragraphs break automatically.
  • Textual smileys will be replaced with graphical ones.