Hacking
Do not touch

tro.cohol was a surveillance trojan I wrote in VB.NET around 2011, as a teenager. Scantime and runtime FUD: fully undetectable. One of my first real programs. It set out to answer one thing. How much can a program learn about the person at the keyboard, and how long can it stay hidden while it does?

Almost everything. And far longer than it should.

I built it to understand attack well enough to build defence. You can’t protect against what you’ve never built.

I designed the whole thing myself. Years ago I filmed a walkthrough of how it works, in Turkish:

Three programs, one organism

tro.cohol wasn’t one program. It was three, each a separate executable with its own job. In the talk I explained it with a television:

ComponentThe TV analogyWhat it really was
starterthe remote that turns the set on and sets it upthe installer / dropper
keyloggerthe television itself, the main event; runs even without the remotethe surveillance payload
supporterthe power cable, the oxygen; nothing works without itthe watchdog / persistence layer

These three kept each other alive.

The starter

the remote 🕹ī¸

The starter was a dropper. It ran once. On that run it:

  • unpacked the supporter and the keylogger from inside itself;
  • scattered each into tens of random folders. Redundancy by brute force.
  • launched both, then killed itself.

It lived a few seconds. Then the other two took over, and no single file was left to delete.

The keylogger

the television đŸ“ē

The payload. The part that actually watched. It built a portrait of the machine and its owner:

  • Every keystroke, caught before it reached the screen.
  • Every window title, stamped with the date and time it held focus. A timeline of what someone did, and when.
  • A full hardware and software inventory of the machine.

Two choices made it hard to kill.

  • It moved. Every few minutes, on a random timer, it renamed and relocated itself on disk. No fixed target, no easy way to trace it, delete it, or shut it down.
  • It phoned home. On that same random timer it emailed the log. Offline, it queued everything and waited. The second a connection appeared, it flushed the backlog.

The supporter

the power cable 🔌

Its one job: keep the other two breathing. It was the aggressive one.

  • Persistence. It wrote the keylogger and itself into startup, so both returned on every boot.
  • Resurrection. Shut it down and it relaunched from a random folder under a random name.
  • Redundancy repair. It kept a random number of copies of each program scattered across the disk, checked they were all still there, and rebuilt any that vanished from a surviving copy.
  • Self-defense. It had, in my words back then, a survival instinct. It fought anything that threatened it: anti-virus tools, debuggers, whatever tried to look inside.
  • Propagation. It infected USB drives with the starter. Plug that stick into a clean machine and the whole system rode across.

The feedback system

This is the part I’m still proud of. The three were wired into a mutual-support loop, with nobody in charge. Each one watched the others.

  • The supporter checked, several times a minute, that all three programs and every scattered copy were alive, and restored whatever was missing. It stayed in constant touch with the keylogger. Close it, or even try, and the supporter reopened a fresh copy elsewhere under a new name and pinned it back into startup.
  • The keylogger watched the supporter the same way. If it died, the keylogger started a new one from a random place under a random name.

Kill any single process and another rebuilt it within seconds, from a different file, under a different name. To get rid of tro.cohol you had to kill all of it at once. I built it so you couldn’t. And I bet you still can’t ;)

FUD

Fully undetectable is two problems:

  • Scantime. The antivirus reads a file at rest and matches it against known signatures. Beat it by encrypting the payload and hiding it in a small stub that only decrypts in memory. On disk, the bytes match nothing.
  • Runtime. The antivirus watches behaviour as the program runs. Beat that by staying boring: no obvious hooks, no loud persistence, nothing that trips a heuristic.

“Fully undetectable” never lasts. Once a stub gets popular, vendors sign it, and you’re back to re-encrypting and re-shaping the same program by hand. That treadmill nagged at me. If the tedious part is making code look different while it does the same thing, why not make the code rewrite itself? That question turned into something much bigger: the metamorphic engine.

Artificial Intelligence

tro.cohol was an artificial intelligence. The classical kind: an intelligent agent  that sensed its world and acted toward a goal.

Is my partner alive? Is a copy missing? Is an anti-virus hunting me? Is there a connection yet? From the answers it chose its next move, at random, inside a fixed rule-set. That randomness kept it unpredictable and hard to fingerprint.

Three agents, one goal: stay alive and keep reporting. A multi-agent system . And it behaved like an immune system: a distributed defence with no one in charge. It tells self (its own copies) from non-self (the anti-virus trying to kill it), keeps spares in reserve, spots damage, heals. The intelligence isn’t in any one line. It’s in the architecture: small reflexes, wired so the whole thing refuses to die.

What it led to

What I learned here let me build a career in security, and projects like:

My latest articles on #security: