Metame : Metamorphic Code Engine For Arbitrary Executables

Metame is a simple metamorphic code engine for arbitrary executable. Metamorphic code is code that when run outputs a logically equivalent version of its own code under some interpretation.

This is used by computer viruses to avoid the pattern recognition of anti-virus software. It implementation works this way:

  • Open a given binary and analyze the code
  • Randomly replace instructions with equivalences in logic and size
  • Copy and patch the original binary to generate a mutated variant

It currently supports the following architectures:

  • x86 32 bits
  • x86 64 bits

Also, it supports a variety of file formats, as radare2 is used for file parsing and code analysis.

Example of code before and after mutation:

Also Read – PingCastle : Get Active Directory Security At 80% In 20% Of The Time

Installation

pip install metame

This should also install the requirements.

You will also need radare2. Refer to the official website for installation instructions.

simplejson is also a “nice to have” for a small performance boost:

pip install simplejson

Usage

metame -i original.exe -o mutation.exe -d

Use metame -h for help.

R K

Recent Posts

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

1 week ago

git cherry-pick Command: Apply Commits from Another Branch

Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…

1 week ago

Best Email APIs for Secure Business Email: Why Developers Are Moving Beyond SMTP

Email is still one of the most important communication channels inside modern applications. Password resets,…

1 week ago

Nginx Commands in Linux: Start, Stop, Reload, Test, and Log

Nginx is a high-performance web server and reverse proxy trusted by some of the largest…

2 weeks ago

ufw Command in Linux: Manage Firewall Rules with Examples

ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…

2 weeks ago

who Command in Linux: Show All Logged-In Users and Sessions

When you share a server with a team or investigate unexpected activity, the first question…

2 weeks ago