nocturne

Named after one of my favorite games, "nocturne" is a bin2bin x86-64 PE code virtualizer and binary rewriter.

Features

• Native Call Bridge
• 30+ VM Handlers
• Built-in junk code obfuscation
• Thread-safe per-invocation VM state

Usage

To use the Nocturne virtualizer, copy and include "nocturne_sdk.hpp" from core/ into your project.

#include "nocturne_sdk.hpp"

VIRTUALIZE int secret(int x) {
	if (x % 2 == 0) {
		return x / 2;
	} else {
		return x * 3 + 1;
	}
}
VIRTUALIZE_MARK(secret);

Afterwards, run the virtualizer executable.

cli.exe <input.exe> <output.exe> auto

Example:

cli.exe example.exe example_protected.exe auto

Or, you if you want to virtualize specific segments of a binary without the SDK:

cli.exe <input.exe> <output.exe> <start_rva> <function_size>

Example:

cli.exe calc.exe calc_vmp.exe 0x1600 0x264

Screenshots

Before Virtualization:

After Virtualization:

Obfuscated dispatcher loop:

Dependencies

LIEF
Zydis

Disclaimer

First and foremost, this is mostly a POC project. Please don't expect it to be too stable. With that being said, I will be progressively adding more features/fixes to this as time goes on.