mirror of
https://github.com/rad9800/misc
synced 2026-06-08 16:56:08 +00:00
rad9800
89 lines
2.1 KiB
C++
89 lines
2.1 KiB
C++
#include <stdio.h>
|
|
|
|
/*++
|
|
*
|
|
* Packed malware has high entropy. It is not uncommon for EDRs to
|
|
* use the entropy of a PE as a measure of its potential malicious
|
|
* activity. Entropy is just the measure of randomness.
|
|
*
|
|
* One common way to fix entropy was to concatenate Windows System
|
|
* DLLs or the first chapter of Harry Potter and the Philosopher's
|
|
* Stone. This works when the bytes are similar and the entropy of
|
|
* the concatenated are lower than that of the PE file.
|
|
*
|
|
* A simple solution is to just define a array populated with zero
|
|
* or another character/value. This will allow us to fundamentally
|
|
* get lower entropy values for the overall PE file and the .rdata
|
|
* section.
|
|
*
|
|
--*/
|
|
|
|
|
|
template<unsigned int N, typename T, T value>
|
|
struct E {
|
|
constexpr E() : array() {
|
|
for (unsigned int i = 0; i < N; i++) {
|
|
array[i] = (T)value;
|
|
}
|
|
}
|
|
T array[N];
|
|
};
|
|
|
|
// https://docs.microsoft.com/en-us/cpp/build/reference/section-specify-section-attributes?view=msvc-170
|
|
// allows us to the fix the entropy of any section
|
|
#pragma code_seg(".text")
|
|
__declspec(allocate(".text"))
|
|
constexpr auto e = E<2500, long long, 1>();
|
|
|
|
#pragma code_seg(".data")
|
|
__declspec(allocate(".data"))
|
|
constexpr auto e2 = E<2500, long long, 1>();
|
|
|
|
|
|
/*++
|
|
*
|
|
* Before:
|
|
* // E<4, long long, 0>();
|
|
*
|
|
* - Total Entropy : 4.658898546328656
|
|
* - Size : 10.8 KB
|
|
*
|
|
* - Name .text
|
|
* - Size 3584 bytes
|
|
* - Entropy 5.757317522100548
|
|
*
|
|
* - Name .rdata
|
|
* - Size 4096 bytes
|
|
* - Entropy 3.950817412562706
|
|
*
|
|
*
|
|
* After:
|
|
* // E<4000, long long, 0>();
|
|
* - Total Entropy : 1.4966239940876724
|
|
* - Size : 42.5 KB
|
|
* - Sections :
|
|
*
|
|
* - Name .text
|
|
* - Size 3584 bytes
|
|
* - Entropy 5.783502669099978
|
|
* - Name .rdata
|
|
* - Size 35840 bytes
|
|
* - Entropy 0.6449460947480491
|
|
* This large low entropy section biases our total entropy
|
|
*
|
|
--*/
|
|
|
|
int main() {
|
|
int total = 0;
|
|
|
|
// Use it, pointlessly, or for a reason but don't let it
|
|
// get optimized out by the compiler
|
|
for (auto x : e.array)
|
|
total += x;
|
|
|
|
for (auto x : e2.array)
|
|
total += x;
|
|
|
|
return total;
|
|
}
|