Morphine is a PE File wrapper / Encrypter. It builds a small PE File
with which to wrap around your packed file, making identifying the packer very
difficult.
Also, each file is created with a great degree of randomness, so encrypting
the same file will yield very different files.
The resulting PE file will ONLY run on NT type versions of Windows (NT,
2000, XP, 2003 etc).
Originally a console program, only the Gui and a few changes are mine.
Morphine 2.7 is by Holy_Father & Ratter and was developed as part of the
Hacker Defender RootKit Copyright (c) 2000,forever
ExEwORx. See below for original info text.
Now Holy_Father has stopped updating it, I can make some proper additions..
:)
o Use Resources - This adds an icon (if present) and / or XP
Manifest (if present) from the original file, otherwise, it has no resource
section.
o Dynamic DLL - Don't process Export section.
o Required ImageBase - Set to a preferred Imagebase, can wrap same
file multiple times by setting this.
E.g. $1F000000 the first time, $1D000000 the
second..
o Version Resource type handling
o Own compression routine
o Debug protection
PEiD - http://PEiD.has.it
PEiD Forum - http://PEiDForums.has.it
Hippie's Hairy Bits - http://Go.To/Hairy_Bits
Neil's Plugins Page - http://www.SecretAsHell.Com/BobSoft/
Hacker Defender RootKit - http://rootkit.host.sk
[12/12/04]
o BETA test version 2, fixed the weird titlebar problem :)
Not sure why it happened, but it's fixed anyway..
[10/12/04]
o BETA test version, if it don't work quite right, re-read this
sentence before complaining to me..
o Altered to hide from Kav, again, and also PEiD... :)
[26/10/04]
o Instability introduced from making undetected by Kav addressed.
[11/10/04]
o Updated to reflect v23 - v27 changes (works with Delphi, Mew11SE,
FSG and others)
o Released source
[25/09/04]
o Checksum corrected after processing
o Slight randomness in the loader routine
o Changed TLS handler to cope with invalid tables & callback
arrays
[23/09/04]
o Changed for version 2.2 updates.
o Plugin can now be used from PE-Tools too, all credit to Jupiter
for the idea.. :)
[22/09/04]
o Updated plugin to reflect version 2.1
changes
Morphine v2.2
Morphine as a part of Hacker Defender rootkit (http://rootkit.host.sk)
by Holy_Father <holy_father@phreaker.net> && Ratter/29A
Copyright (c) 2000,forever ExEwORx
betatested by ch0pper <THEMASKDEMON@flashmail.com>
birthday: 22.09.2004
home: http://rootkit.host.sk
licence: this program is open source under GNU GPL
Morphine is very unique application for PE files encryption. Unlike
other PE encryptors and compressors Morphine includes own PE loader which
enables it to put whole source image to the .text section of new PE file. This
one is very powerful because you can compress source file with your favourite
compressor like UPX and then encrypt its output with Morphine. Another powerful
thing here is polymorphic engine which always creates absolutely different
decryptor for the new PE file. This mean if your favourite trojan horse is
detected by an antivirus you can encrypt it with Morphine. You will not get
the virus alert again.
What's more, Morphine allows you to encrypt one file several times!
But be sure you're using -b option (see usage) when doing this. Unlike others
Morphine enlarges your executable by not more than 5kb (this is not true for
morphined DLLs without using -d option, see below)! Morphine supports most
of PE files. Also one of the greatest things here is that it is an open source
project. In these days antivirus companies sniff around our site waiting for
new version of morphine to add new decoder into their databases. But you can
simply make your own undetectable version. Because new PE file has random
loader it is possible the loading will take more time than you want to
(especially when encrypting bigger files). If this occurs simply delete
the long time loading PE file and try to build it again. And be careful with
morphined DLLs. This can really slow down final execution.
Whole Morphine code is compatible with Delphi 6 and 7 compiler.
Morphined files can be executed on Windows with NT kernel only.
Usage
-----
Usage: morphine.exe [-q] [-d] [-b:ImageBase] [-o:OutputFile] InputFile
-q be quiet (no console output)
-d for dynamic DLLs only
-i save resource icon and XP manifest
-b:ImageBase specify image base in hexadecimal string
(it is rounded up to next 00010000 multiple)
-o:OutputFile specify file for output
(InputFile will be rewritten if no OutputFile given)
Examples:
1) morphine.exe -q c:\winnt\system32\cmd.exe
rewrite cmd.exe in system directory and write no info
2) morphine.exe -b:1F000000 -o:newcmd.exe c:\winnt\system32\cmd.exe
create new file called newcmd.exe based on cmd.exe in system dir
set its image base to 0x1F000000 and display info about processing
3) morphine.exe -d static.dll
rewrite static.dll which is loaded only dynamically
4) morphine.exe -i -o:cmdico.exe c:\winnt\system32\cmd.exe
create new file called cmdico.exe based on cmd.exe in system dir
save its icon and or XP manifest in resource section
Versions
--------
Version 2.2 supports Mew 11 SE 1.2 exe packer.
Version 2.1 supports FSG 2.0 exe packer.
Version 2.0 implements random secondary encryption routine and adds enables
saving resource for DLLs. Last improvement in this version is a fake loop
in DynLoader which protects morphine files against Norton AntiVirus.
Since 1.9 you can save first icon directory and XP manifest in resource
section using -i switch.
Polycode is now smaller then ever - only 16 instructions - in version 1.8.
Smaller polycode makes possible smaller final executable.
Version 1.7 implements variable key length for second encryption routine.
Version 1.6 is about fucking KAV :). Well, not only fucking KAV, also
second decrypting unit is before loader.
Version 1.5 is about improved polymorphic code. It's much more easier to
write own polycode now. Also it's hard to detect for AV.
Since 1.4 you can morphine DLL. There is a new option -d which isn't used by
default. There are two ways how to import functions from DLL. For static import
PE loader use import section in PE file. For dynamic import coder have to use
functions like LoadLibrary and GetProcAddress. Many of DLLs are loaded only
dynamically. But this can change in future because any program can load DLL
statically. If you know your morphined DLL will never be loaded statically
you can use (and it's better to use) -d option (morphined DLLs without -d
can be much bigger than original).
Since 1.3 we use smaller polymorphic loader. This is good for final executable
which is less than 5kb bigger than original file. Also source code is more
transparent.
Since 1.2b morphined file has no .data section and the whole PE file is
somewhere in .text section. Reason for this is that you could easily find
old PE signatures and then find a key for decoding.
Modifications by Jan Klaassen for 1.2a (cut&paste from mail):
Somewhere on a forum I read your solutions for getting around a pattern
recognition of AntiVirus in "Morphined" executables. The pattern "FF2534" was
mentioned, but I think the AV also used the ..0000 bytes in front of it, or
the code after it, since the AV was not triggered if the pattern mentioned was
somewhere else in the code.
I have made a small modification to the Morphine source code. I thought that
maybe you or someone you know might be interested in these changes to get
around AV recognition. I moved the jumps to the import section into the
initcode (at the end) and implemented several (random) variants for the jumps.
The jumps are coded seperately and are placed inside your rubbish. :)
The initcode changed in the following way:
- The addresses of the imported function in @DynLoaderCaller now get fixed-up
with the location of the import jmps at the end of the initcode
- The addresses of the import jmps get fixed-up with the location of the
thunks (hint and name) of the imported function in the import section.
The modified morphine and morphined exes seem to run fine on either Windows XP
SP1 and Windows 2000 Adv.Server. (All morphined exes crash on Windows 98
Second Edition.)