Skip to content
This repository has been archived by the owner on Dec 29, 2022. It is now read-only.
/ furikuri Public archive

too busy for that all, furikuri is framework for code protection

License

Notifications You must be signed in to change notification settings

jnastarot/furikuri

Repository files navigation

Furikuri

License Build status Build Status

Furikuri is protection framework what targeting on shellcode and executable files 
Supported x32 and x64 archs
  1. Obfuscation techniques
  2. Examples
  3. Compile
  4. Third party

Obfuscation techniques

Instruction mutation

Mutation of original instruction into series of other equivalent instructions

example:

 mov rcx, rax
 mov rdx, [rsp + 38h]
 call SomeFunc

becomes to :

 mov rdx, rax
 mov rcx, [rsp + 38h]
 push rcx
 mov rcx, rdx
 pop rdx
 call SomeFunc


Junk generation

Inserting assembler instructions with out any payload between "original" instructions

example:

 mov rcx, rax
 mov rdx, [rsp + 38h]
 call SomeFunc

becomes to :

 mov rdx, rdx
 mov rdx, r8
 mov rcx, rax
 push r8
 mov r8, 12345678h
 pop r8
 mov rdx, [rsp + 38h]
 call SomeFunc

Spaghetti code

Dividing original basic block of code on several but more smaller, through insertion jmp in middle of block to start of second of "new" block

example:

mov r10, [rax+20h]
mov eax, [rsp+98h]
mov [rsp+40h], eax
mov rax, [rsp+90h]
mov [rsp+38h], rax
mov eax, [rsp+88h]
mov [rsp+30h], eax
mov rax, [rsp+80h]
mov [rsp+28h], rax
mov [rsp+20h], r9d

becomes to :

mov r10, [rax+20h]
mov eax, [rsp+98h]
mov [rsp+40h], eax
mov rax, [rsp+90h]
mov [rsp+38h], rax
jmp l1:
...
...
...

l1 :
mov eax, [rsp+88h]
mov [rsp+30h], eax
mov rax, [rsp+80h]
mov [rsp+28h], rax
mov [rsp+20h], r9d


Bytecode obfuscation

Changes bytecode of instruction to another bytecode

example:

 48 8B CA mov rcx,rdx

becomes to :

 48 89 D1 mov rcx,rdx

Examples

shellcode obfuscation
executable obfuscation


Compile

  • Windows

    1. Requirements

      • Git Bush
      • Visual Studio 2019 (for now, but u can change runtime version and compile in on below versions)
    2. Clone repo and initialize submodules

      git clone https://github.com/jnastarot/furikuri.git
      cd furikuri
      git submodule update --init
      
    3. Open furikuri.sln and build it in Visual Studio

  • Linux

    TODO

Third Party

capstone
enma pe
fukutasm

Releases

No releases published

Packages

No packages published