sgn v2.0.1 releases: polymorphic binary encoder for offensive security purposes
SGN
SGN is a polymorphic binary encoder for offensive security purposes such as generating statically undetectable binary payloads. It uses an additive feedback loop to encode given binary instructions similar to LSFR. This project is the reimplementation of the original Shikata ga nai in golang with many improvements.
How? & Why?
For the offensive security community, the original implementation of shikata ga nai encoder is considered to be the best shellcode encoder(until now). But over the years security researchers found several pitfalls for statically detecting the encoder(related work FireEye article). The main motive for this project was to create a better encoder that encodes the given binary to the point it is identical with totally random data and not possible to detect the presence of a decoder. With the help of keystone assembler library following improvments are implemented.
- 64-bit support. Finally properly encoded x64 shellcodes!
- New smaller decoder stub. LFSR key reduced to 1 byte
- Encoded stub with a pseudo-random schema. Decoder stub is also encoded with a psudo random schema
- No visible loop condition Stub decodes itself WITHOUT using any loop conditions !!
- Decoder stub obfuscation. Random garbage instruction generator added with keystone
- Safe register option. Non of the registers are clobbered (optional preable, may reduce polymorphism)
Execution Flow
The following image is a basic workflow diagram for the encoder. But keep in mind that the sizes, locations, and orders will change for garbage instructions, decoders, and schema decoders on each iteration.
LFSR itself is pretty powerful in terms of probability space. For even more polymorphism garbage instructions are appended at the beginning of the unencoded raw payload. The below image shows the companion matrix of the characteristic polynomial of the LFSR and denoting the seed as a column vector, the state of the register in the Fibonacci configuration after k steps.
Changelog v2.0.1
- Register value preserving (-safe option) related bug fixes
- Random register selection bug fixed
- Better argument parsing
- Major code refactoring
Install
go get github.com/egebalci/sgn
Use
Copyright (c) 2019 Ege Balcı
Source: https://github.com/EgeBalci/
