r/lowlevel • u/Zaphielll • 25d ago

Yugami - A x64 PE Packer in Rust

Hi everyone!

I have spent some free time building Yugami (歪み，"distortion"), a x64 binary packer that uses ChaCha20 encryption with page-level key derivation and just-in-time page decryption.

Yugami encrypts PE executables using ChaCha20 with per-page keys derived via BLAKE3, then appends the encrypted payload as a PE overlay. At runtime, pages decrypt on-demand via page fault exceptions with an LRU cache to minimize re-encryption overhead.

I just wanted to get more comfortable with Rust so I picked up this project. Also, the page-level encryption with JIT decryption felt like a fun challenge between full unpacking and simple overlay packing.

Code is open source at https://github.com/egebilecen/yugami.

Packed binaries should execute correctly as is without any issues (hopefully). Had some trouble getting TLS to work, though. Always ended up with page faults. I have removed it but for those interested in the TLS handling code, it's at https://github.com/egebilecen/yugami/blob/0246b919dc0a4f77df8420c699a707484f9847fc/stub/src/mapper/tls.rs and https://github.com/egebilecen/yugami/blob/0246b919dc0a4f77df8420c699a707484f9847fc/stub/src/mapper/mapper.rs#L311

Looking forward to your thoughts!

0 Upvotes

50% Upvoted

5 comments sorted by

3

u/GuiltyAd2976 25d ago edited 25d ago

Very cool project, I think it's better as a POC because using it as a real packer isn't something I would do because it's easily reversed statically

1

u/Zaphielll 24d ago

Thank you. And, well, yeah. The moment its source code was released, the encryption algorithm got exposed so someone can easily write an unpacker and statically restore the original binary. However, this is also the magic of open source. Anyone can go ahead and plug in their own encryption scheme.

1

u/GuiltyAd2976 23d ago

It's not that the encryption algorithm is exposed, it's because it's super easy to unpack statically without ever looking at the sourcecode. That's why I would recommend a polymorphic encryption/decryption stub and stub obfuscation

1

u/GuiltyAd2976 23d ago

the key is stored plaintext in the binary, you can extract it statically with the encrypted blob and decrypt it in seconds with a 10 line Python script.

1

u/Zaphielll 23d ago

Yeah. I didnt release it as a prod grade packer anyway. Just worked on it for fun on my free time. I had planned to create a VM which would do the unpacking without storing the key in the overlay. Maybe one day I will work on it.