Theme: Simple algorithms of cipher strings in delphi (for virus)
Author: Falckon/DCA [DArk C0derZ Alliance]

-Introduction
-Simple algorithm in XOR
-Simple algorithm with * (MULT) and / (DIV) operands
-Algorithm simple and complex with + (ADD) and - (SUB) operands
-Make Difficult things to Averz 


Introduction:

In this informatic times is very important the privacy
and the cryptography use to hide the sensible data, yeah
but in this text the cryptography we will apply it to the virus, to hide strings 
from shit averz ;). (i think that this text is only for newbies...and is stupid :P)

but
why it serves the string crypting of our species?

Answer: Simple like everything, hide strings/dats to the averz..
like P2P Folders, that is sensitive to AntiViral Heuristic :(
really i dont see other use, in addition when the viral specie is debugged the crypted string
is showed in memory... and the aver can see the decrypted string....

-Simple algorithm in Xor

Really little or maybe nothing I've seen virii exemplary (in delphi) with crypted strings...
and the only thing which I have seen in my pure life really is VBS/VB virus that have his crypted strings
with the simple algorithm XOR,that of course it is easy to break and easy to make,
since the xor is reversible and we did not need a routine to crypt and other to decrypt,
the xor is two in one! ;)


Let us begin seeing this simple Xor algorithm (commented previously)
that us can be quite useful to crypt virus strings:


Function encrypt(text:string):string ;             //funcion encrypt
var lp1,p:integer;                                 //variables
fuck:string; 
begin 
lp1 := strlen(pchar(text));                        // lenght of string
For p := 1 to lp1 do begin                         // For 1 to lenght of string
fuck := fuck + chr(ord(text[p]) Xor 25)            // encrypts one string with xor 25 (25 the key)
end;                                               // end for
encrypt := fuck                                    // ret the crypted/decrypted string
end;                                               // end function

This simple algorithm that i writted maybe is useful ;)
it will be enough with changing the key (25) by another one to your pleasure,
really this algorithm is very used by many C0derz (or kiddies ;) that coding in VBS/VB. hehe
to be called from any procedure, will be of this form:

example:

begin
//code
ShowMessage(Encrypt('String to crypt'));  // this show a msg with the text "String to crypt" crypted!
end;

-Simple algorithm with MULT and DIv Operands
In this ocation will use an algorithm based on the previously explained, the only diferency
will be that need of tw0 functions, the fist to Crypt strings and the second to decrypt the strings:


Function encrypt(text:string):string ;             //funcion encrypt
var lp1,p:integer;                                 //variables
fuck:string;        
begin                                              //start code
lp1 := strlen(pchar(text));                        //lenght of string
For p := 1 to lp1 do begin                         // For 1 to string lenght
fuck := fuck + chr(ord(text[p]) * 2)               // Multiply by the key ( in this case the number 2)
end;                                               // End of for
encrypt := fuck                                    // Ret the crypted string
end;

This function turns each character to its corresponding value in Ascii and multiply by the key (number 2)
and ret a new ascii value, this is very simple...  u probably think "what the fuck..." ;)



Function decrypt(text:string):string ;             //funcion encrypt
var lp1,p:integer;                                 //variables
fuck:string; 
begin                                              //start code
lp1 := strlen(pchar(text));                        //"lenght of string"
For p := 1 to lp1 do begin                         // For 1 to ""
fuck := fuck + chr(ord(text[p]) DIV 2)             // DIV the char
end;
decrypt := fuck                                    // ret the decrypted char
end;

This function makes the opposite, divides the character between 2 
and gives back corresponding value ASCII, this would be then the inverse algorithm
to the previous one. 


-Algorithm simple and complex with + and - operands

This algorithm is made by Xpy-xt (In Visual Basic.. but i re-writted in delphi :P)


Function Encrypt(text:string):string ;           
var lp1,p,counter:integer;              // Variables                        
fuck:string;       
begin                                   // Start Code
counter := 0;                           // Counter = 0
lp1 := strlen(pchar(text));             // Len of string        
For p := 1 to lp1 do begin              // for 1 to lenght of string
if counter = 0 then                     // ...
begin
fuck := fuck + chr(ord(text[p]) + 1);   // x char + 1
counter := 1;
end
else if counter = 1 then
begin
fuck := fuck + chr(ord(text[p]) - 1);   // x char - 1  
counter := 2;
end
else if counter = 2 then
begin
fuck := fuck + chr(ord(text[p]) + 3);   // x char + 3
counter := 3;
end
elseif counter =3 then
begin
fuck := fuck + chr(ord(text[p]) - 2);   // x char - 2
counter := 4;
end
else if counter = 4 then
begin
fuck := fuck + chr(ord(text[p]) + 5);   // x char + 5
counter := 0;                           // counter = 10
end;         
end;
Encrypt := fuck                         // ret the crypted string
end;

This algorithm is a little complex being done with sum and subtractions,
to be able to decrypt the strings are enough to make a routine that invests
the mathematical operations.
if to this algorithm we modified it and we combined with XOR algorithm 
it will not be necessary of two functions one to encrypt and the other to decrypt
and will be more complex since when adding a letter to a word will totally change to
the encryption, f.e.: exe will not be just as: .exe 
one could be: "paa" (crypted) and other: "plza"
unfortunately this form I do not expose it here since for some reason profit of not reproducing 
it in delphi, only VB :(



-Make Difficult things to Averz 

Normally when the AVers are analysing our viral code and wants to check
our algorithm of crypting, only is enough to see the operations to know how work the engine,
but who it says that we cannot confuse them and there am the previous algorithm with mathematical 
operations that will serve to confuse:


Function Encrypt(text:string):string ;           
var lp1,p,counter:integer;                             
fuck:string; 
begin 
counter := 0;
lp1 := strlen(pchar(text));                       
For p := 1 to lp1 do begin                        
if counter = 0 then
begin
fuck := fuck + chr(ord(text[p]) + (50 - 25 - 24)); // X ASCII char + 50 -25-24  (= X + 1)
counter := 1;
end
else if counter = 1 then
begin
fuck := fuck + chr(ord(text[p]) - (5 * 9 - 44));   // X ASCII char - 5 * 9 - 44 ( = x - 1)
counter := 2;
end
else if counter = 2 then
begin
fuck := fuck + chr(ord(text[p]) + (8 + 5 - 10));   // X ASCII char + 8 + 5 - 10 ( = X + 3)
counter := 3;
end
elseif counter =3 then
begin
fuck := fuck + chr(ord(text[p]) - (89 * 8 - 710)); // X ASCII char - 89 * 8 - 710 (= X - 2)
counter := 4;
end
else if counter = 4 then
begin
fuck := fuck + chr(ord(text[p]) + (5 Xor 4) + 4);  // X ASCII Char + 5 Xor 4 + 4 (= X + 5)
counter := 0;
end;         
end;
Encrypt := fuck                                    // Ret the string crypted :)
end;

is very cool no? (Sss u are thinking now:"very shit article and engine ;)" hehe)
yeah
and.. is all,
Simple Algorithms to crypt strings for ours virus to try evade the antivirus heuristic and hide 
strings (for delphi :D)
and now u can play with the algorithms and test it!

Thx to All DCA Members and my friends, oh yeah i need more coffe!!!
[EOF]