CODE MIXER is an utility (subroutine, library, engine, include file, ...) to mix 2 code buffers.
The destination buffer will contain all instructions of the source buffers mixed between each other in random order.

  src buf #1        src buf #2      dest buf
     ------------      ------------    -------------
     imul eax, ebx     add edi,1       add edi,1
  q: cdq               add edi,2       imul eax, ebx
     xor ecx, ecx      add edi,3     q:cdq
     jz  q             loop $-2        add edi,2
     nop                               xor ecx,ecx  ; next cmd is jxx
                                       jz q         ; jxx-expanded to near,fixed
                                       add edi,3
                                       loop $-2     ; loop/z/nz/jecxz-ignored

CODEMIXER uses two external subroutines, rnd() and disasm(), both should be written in C calling convention (i.e. return control with RET).

DWORD rnd(DWORD) returns random number,
DWORD disasm(BYTE* cmd) returns length of the command and -1 if error.

In the example used simple randomer and external disassembler (LDE32). But you are always able to use your own randomer and/or disassembler.



pusho offset disasm ; DWORD disasm(BYTE*)
pusho offset rnd      ; DWORD rnd(DWORD range)
push offset srcbuf1  ; source buffer #1 -- offset
push size srcbuf1     ; ... size
push offset srcbuf2  ; source buffer #2 -- offset
push size srcbuf2     ; ... size
push offset destbuf  ; destination buffer -- offset
push size destbuf     ; ... maximal size
push offset destsize  ; ... pointer to new size (DWORD PTR)
push maxcmd          ; max  # of commands (in both buffers)
call codemixer

Return values:
EAX==0 if success, destsize=size of the destination buffer
EAX!=0 if error, error codes (CM_ERR_xxx) see in the CMIX.INC


- code is offset-independent, so it can be displaced or permutated
- no external data used, only own stack vars
- jmps/calls (E8,E9,7x,0F 8x) are fixed
(to point correctly to the new addresses)
- external jmps/calls (i.e. out of the source buffers) are fixed correctly
- short jmps (7x,EB) are expanded into near jmps
- if next command is jxx (short or near), it will be stored after current
command, without inserting other buffer commands before jxx
- commands jecxz,loop,loopz,loopnz (E0/E1/E2/E3) are ignored


- to create polymorphic decryptors
1. generate simple decryptor (as in crypt-virus)
2. generate some trash (easy with ETG engine)
3. mix buffers

- to mix some commands from host 's startup and from virus's startup

- to generate some hash-alike functions
for example:
dst-reg-set = [REG_EAX],
src-reg-set = [REG_EBX],
so generated function will return EAX=f(EBX)