Wie vercryptet man einen hack???

int _tmain(int argc, _TCHAR* argv[])
{
	CHAR szPath[MAX_PATH] = "";
	memset(szPath, 0x00, MAX_PATH);

	GetCurrentDirectoryA(MAX_PATH, szPath);
	strcat(szPath, "\\input.exe");

	LPBYTE pBuffer;

	printf(":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::\n");
	printf(":::::::::::::::PE Crypter by Killswitch 2010:::::::::::::::\n");
	printf(":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::\n");

	char* szNig = "http://an0nym0.us\n";
		printf(szNig);


	//Benötigte Informationen aus dem PE-Header entnehmen

	DWORD dwSize = LoadFile(szPath, &pBuffer);
	printf("Size of source-file: %d\n", dwSize);

	DWORD dwEP = Find_EP(pBuffer);
	printf("Original Entrypoint: 0x%x\n", dwEP);

	WORD wCount = Find_NumberOfSections(pBuffer);
	printf("Count of sections: %d\n", wCount);

	DWORD dwIB = Find_ImageBase(pBuffer);
	printf("Imagebase: 0x%x\n");

	DWORD dwSizeOfImage = Find_SizeOfImage(pBuffer);
	printf("Size of Image: 0x%.08x\n", dwSizeOfImage);

	_IMAGE_SECTION_HEADER ISH = GetISH(pBuffer, wCount);
	//{
				printf("Virtual Size: 0x%.08x\n", ISH.Misc.VirtualSize);
				printf("RawOffset   : 0x%.08x\n", ISH.PointerToRawData);
				printf("Virtual Addr: 0x%.08x\n\n", ISH.VirtualAddress);

	DWORD dwCCSize	 =	ISH.SizeOfRawData - ISH.Misc.VirtualSize;

	printf("CodeCave space: 0x%.08x		[%s]\n", dwCCSize, (dwCCSize > 24) ? "OK":"ERROR");

	if (dwCCSize <= 24)
	{
		printf("CodeCave is too small. Aborting...\n");
		goto bad;
	}

	DWORD dwCodeCave = ISH.PointerToRawData + ISH.Misc.VirtualSize;

		printf("CodeCave Location  : 0x%.08x\n", dwCodeCave);

		BYTE DecryptionRoutine[] = { 0xb9, 0x90, 0x90, 0x90, 0x90, /*inc [ecx etc]*/0x36, 0xFE, 0x09, 0x36, 0xF6, 0x11, 0x36, 0x80, 0x31, /*xor byte*/0x88, 0x41, 0x81, 0xf9,
		0x90, 0x90, 0x90, 0x90, 0x75, 0xED, 0xE9, 0x90, 0x90, 0x90, 0x90 };

	DWORD dwRealEP = dwIB + dwEP;
	DWORD dwLastCom = dwIB + ISH.VirtualAddress + ISH.Misc.VirtualSize;

	*(DWORD*)&DecryptionRoutine[1] = dwIB + ISH.VirtualAddress;
	*(DWORD*)&DecryptionRoutine[18] = ISH.VirtualAddress + ISH.Misc.VirtualSize + dwIB;
	*(DWORD*)&DecryptionRoutine[25] = 0 - ((dwLastCom+24) - dwRealEP) + 1 - 3 + 1 - 4;


	if (Manipulate_Text_VirtualSize(pBuffer, wCount, ISH.Misc.VirtualSize + 24));
		printf("Successfully changed VirtualSize\n");

	if (Manipulate_Text_Characteristics(pBuffer, wCount))
		printf("Successfully set 'writable' characteristic\n");

	Manipulate_Checksum(pBuffer);
		printf("Successfully changed checksum\n");

	Manipulate_File_Characteristics(pBuffer);
		printf("Successfully set 'Relocation stripped' flag at _IMAGE_FILE_HEADER characteristics\n");

	memcpy(pBuffer + dwCodeCave, DecryptionRoutine, sizeof(DecryptionRoutine));

	Set_EP(pBuffer, ISH.VirtualAddress + ISH.Misc.VirtualSize);

	//cryption :P
		
	for (int i = 0; i < ISH.Misc.VirtualSize; i++)
	{
		pBuffer[ISH.PointerToRawData + i] = ~pBuffer[ISH.PointerToRawData + i];
		pBuffer[ISH.PointerToRawData + i] ^= 0x88;
		pBuffer[ISH.PointerToRawData + i] += 1;
	}
	
	memset(szPath, 0x00, MAX_PATH);
	GetCurrentDirectoryA(MAX_PATH, szPath);
	strcat(szPath, "\\output.exe");

	SaveFile(szPath, pBuffer, dwSize);

	
bad:
	system("pause");
	return 0;
}

PUSH EAX (Oder als Opcode: 0x50)

SCAS DWORD PTR ES:[EDI] (Scan string -> durchsucht einen String nach einer bestimmten Zeichenfolge)