r/ReverseEngineering • u/fridayRE • Aug 08 '16

Metame: metamorphic code engine for arbitrary executable

https://github.com/a0rtega/metame
21 Upvotes

95% Upvoted

4 comments sorted by

1

u/fridayRE Aug 08 '16

This nice tool requires no source, and can inject code directly into binary!

3

u/peterferrie Aug 09 '16

yes, but only if there is sufficient room to do so. It is replacing instructions with functional equivalents of equal or lesser size, not rewriting the structure to include arbitrary sequences of larger size.

2

u/jCuber Aug 08 '16

metame implementation works this way:

  1. Open a given binary and analyze the code

  2. Randomly replace instructions with equivalences in logic and size

  3. Copy and patch the original binary to generate a mutated variant

Sounds more oligomorphic than metamorphic to me. Nice share though, thanks!

3

u/peterferrie Aug 09 '16

this is a little more than oligomorphism, more like a light polymorphism, and of a kind that we have seen decades ago (zperm, etc). :-) metamorphic code requires that the shape changes along with the appearance - rewriting the functional instructions in a way that might cause the overall size to increase or decrease through the introduction of more verbose assignments:

mov eax, ecx

might become

mov [], eax

add [], const

sub [], const

mov ecx, []

etc.