{"id":17921532,"url":"https://github.com/theopolis/tpm-malcrypt","last_synced_at":"2025-10-24T10:35:00.414Z","repository":{"id":17559922,"uuid":"20363231","full_name":"theopolis/tpm-malcrypt","owner":"theopolis","description":"An example malicious payload controller and obfuscator assisted by TPM-protected keys","archived":false,"fork":false,"pushed_at":"2014-08-10T20:29:15.000Z","size":15922,"stargazers_count":39,"open_issues_count":0,"forks_count":7,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-19T01:06:56.092Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/theopolis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-05-31T19:17:45.000Z","updated_at":"2024-11-04T02:24:03.000Z","dependencies_parsed_at":"2022-08-26T12:34:01.579Z","dependency_job_id":null,"html_url":"https://github.com/theopolis/tpm-malcrypt","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/theopolis/tpm-malcrypt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Ftpm-malcrypt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Ftpm-malcrypt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Ftpm-malcrypt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Ftpm-malcrypt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/theopolis","download_url":"https://codeload.github.com/theopolis/tpm-malcrypt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Ftpm-malcrypt/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272988777,"owners_count":25026959,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-31T02:00:09.071Z","response_time":79,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T20:34:36.618Z","updated_at":"2025-10-24T10:35:00.356Z","avatar_url":"https://github.com/theopolis.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"tpm-malcrypt\n============\n\nAn example malicious payload controller and obfuscator assisted by TPM-protected keys.\n\n## malcrypter\n\nThis is the offline (server-side) component that generates the executed payload from the \ndecrypter stub and your choice of encrypted payload.\n\n### Installation:\n\n  1. Grab PyDbg from: http://www.lfd.uci.edu/~gohlke/pythonlibs/\n  2. Within CMD: `SET VS90COMNTOOLS=%VS120COMNTOOLS%`\n  3. `pip install pefile pycrypto`\n\n## malcrypt\n\nThis is a Windows VS2013 solution containing two projects. The logic can be rewritten on OSX \nor Linux, depending on the intended target.\n\n### Part 1: tpm-keyextract\n\nDetect a TPM on a client and create a new encryption keypair using standard protections.\nReturn the public key component to be transmitted back to a encrypted PE generator.\n\n### Part 2: malcrypt\n\nUsing an input public key and input malicious payload, generate and return a self-decrypting\nPE that decrypts and executes in-memory.\n\nAlthough the output PE can be executed on any machine, only a *target* machine will have\nthe private key pair in it's crypto-store. Thus only a *target* machine will decrypt and \nexecuted the original input payload. \n\nThe malcrypt application involves several components and processes:\n  * Target OS crypto-store accesses.\n  * An in-memory decryption/execution stub.\n  * An encryptor and PE section injector.\n\nFor the crypto-store access, malcrypt assumes the input public key was created with no or\nknown controls by `tpm-keyextract`. The security of the private key is not critical to\nmalcrypt if a TPM was used to generate the key pair. Malcrypt intends to limit the \nexecution of the input payload to a *target* system. There are trusted computing concerns\nrelated to proving a TPM was used to create the keypair, but they are outside the scope\nof the example PoC implementation.\n\nReferences\n----------\n\n  * The original TPM Malware: https://www.cs.utexas.edu/~adunn/pubs/malware-tpm.pdf\n  * DEF CON 22 WAGONBED: https://www.defcon.org/html/defcon-22/dc-22-speakers.html#Datko\n  * Windows PCP Tool: http://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/\n\nLicense\n-------\n\nMIT and Microsoft MSR-LA.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Ftpm-malcrypt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheopolis%2Ftpm-malcrypt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Ftpm-malcrypt/lists"}