Overview • Features • Usage • Architecture • Obfuscation • Testing • Contributing

OrgaNULL is an advanced binary packer that leverages cellular automaton-based obfuscation combined with modern cryptographic techniques to create heavily protected executables.

OrgaNULL:

1. LOADS the target binary and extracts its payload
2. ENCRYPTS using ChaCha20 stream cipher with 256-bit keys
3. OBFUSCATES with Cellular Automaton (Rule 30) masking
4. EMBEDS pure x86-64 assembly unpacking stub
5. OUTPUTS a heavily obfuscated, ready-to-execute binary

The core of OrgaNULL is a dual-layer protection system combining cryptographic strength with algorithmic complexity, making analysis exceptionally difficult.

• Python 3.7 or higher
• GCC toolchain for assembly compilation
• Linux system with memfd_create and fexecve support
• LIEF library for binary manipulation
• Cryptography library for ChaCha20

Install Python dependencies:

pip install -r requirements.txt

1. PACK A BINARY

python3 organull/organull.py <input_binary> <output_packed_binary>

2. EXECUTE THE PACKED BINARY

./<output_packed_binary>

The unpacking stub automatically decrypts and executes the original binary in memory.

CUSTOM CA EVOLUTION STEPS:

python3 organull/organull.py <input_binary> <output_packed_binary> --ca-steps 200

ENABLE DEBUG STUB:

python3 organull/organull.py <input_binary> <output_packed_binary> --debug-stub

PARAMETERS:

• --ca-steps N - Number of cellular automaton evolution steps (default: 100)
• --debug-stub - Compile unpacking stub with debug messages

EXAMPLE:

python3 organull/organull.py ./my_binary ./my_binary_packed --ca-steps 200 --debug-stub

OrgaNULL can be used as a library:

from organull import pack_binary
# Pack a binary with default settings
pack_binary("input_binary", "packed_binary")
# Pack with custom settings
pack_binary("input_binary", "packed_binary", debug_stub=True)

OrgaNULL features a clean separation between high-level logic and low-level operations:

OrgaNULL employs a sophisticated multi-layer protection system:

Run all tests:

# Main integration test
python3 tests/run_packer_test.py
# Unit tests
python3 tests/test_ca_engine.py
python3 tests/test_crypto_engine.py
# All tests
python -m unittest discover tests/

• ✓ CA engine correctness
• ✓ Crypto engine functionality
• ✓ Assembly stub compilation
• ✓ End-to-end packing/unpacking
• ✓ Binary format compatibility

The obfuscation process is sophisticated yet systematic:

The input binary is loaded and analyzed using LIEF. The payload is extracted while preserving necessary metadata.

ChaCha20 stream cipher encrypts the entire payload using a randomly generated 256-bit key and 96-bit nonce.

Each 32-byte block of encrypted data is masked with a unique pattern generated by evolving a Rule 30 cellular automaton.

The assembly unpacking stub is compiled with embedded configuration parameters (key, nonce, CA steps, payload size).

The encrypted and masked payload is embedded into a new binary along with the compiled stub. The entry point is adjusted to execute the stub first.

When executed, the stub:

• Performs anti-debugging checks (ACTIVE - ptrace detection)
• Regenerates CA masks and removes them
• Decrypts the payload with ChaCha20
• Creates an in-memory file descriptor
• Executes the original binary from memory

⚠️ ANTI-DEBUGGING ACTIVE: The unpacking stub now performs ptrace-based debugger detection. If a debugger is detected, the binary exits silently with code 4, preventing runtime analysis.

OrgaNULL is a powerful research tool with important considerations:

• ✅ Strong cryptographic foundation (ChaCha20)
• ✅ Additional CA-based obfuscation layer
• ✅ Assembly unpacking increases analysis difficulty
• ✅ In-memory execution avoids disk artifacts
• ✅ Anti-debugging protections

• ⚠️ x86-64 Linux systems only
• ⚠️ Not suitable for production security applications
• ⚠️ Assembly complexity may cause compatibility issues
• ⚠️ Significant increase in packed binary size
• ⚠️ Requires memfd_create and fexecve support

• 🔄 Multi-architecture support (ARM, x86)
• 📚 Additional obfuscation techniques
• 🎯 Enhanced anti-analysis features
• ⚡ Optimized stub size and performance
• 🧪 Extended compatibility testing

Bug Fixes & Improvements:

• ✅ Anti-debugging protection now ACTIVE - Enabled ptrace-based debugger detection in unpacking stub
• ✅ Fixed duplicate code blocks in main packer module
• ✅ Added missing cryptography dependency to requirements.txt
• ✅ Corrected test suite key material lengths (all tests now pass)
• ✅ Fixed import statements in integration test suite
• ✅ Enhanced test runner with automatic executable permissions
• ✅ Created comprehensive CLAUDE.md for AI-assisted development

Security Enhancements:

• 🛡️ Packed binaries now resist debugger attachment via ptrace checks
• 🛡️ Silent exit on debugger detection (exit code 4)
• 🛡️ No error messages or hints provided to reverse engineers

Testing:

• ✓ All unit tests passing (CA engine: 5/5, Crypto engine: functional)
• ✓ Integration tests verified on x86-64 Linux
• ✓ Assembly stub compilation tested in both debug and release modes

Contributions are welcome!

OrgaNULL / OrgaNULL is available in the public domain. See UNLICENSE.md for details.