commit
6e1b6e96a9
|
@ -1,35 +0,0 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
require 'rex/arch/x86'
|
||||
require 'rex/encoder/xor/dword'
|
||||
|
||||
module Rex
|
||||
module Encoders
|
||||
|
||||
###
|
||||
#
|
||||
# Spoon's smaller variable-length encoder (updated to use call $+4 by vlad902)
|
||||
#
|
||||
###
|
||||
class XorDword < Rex::Encoder::Xor::Dword
|
||||
module Backend
|
||||
def _prepend
|
||||
# set the counter to the rounded up number of dwords to decode
|
||||
Rex::Arch::X86.set(
|
||||
Rex::Arch::X86::ECX,
|
||||
(encoded.length - 1 >> 2) + 1,
|
||||
badchars
|
||||
) +
|
||||
"\xe8\xff\xff\xff" + # call $+4
|
||||
"\xff\xc0" + # inc eax
|
||||
"\x5e" + # pop esi
|
||||
"\x81\x76\x0e" + key + # xor_xor: xor [esi + 0x0e], $xorkey
|
||||
"\x83\xee\xfc" + # sub esi, -4
|
||||
"\xe2\xf4" # loop xor_xor
|
||||
end
|
||||
end
|
||||
|
||||
include Backend
|
||||
end
|
||||
|
||||
end end
|
|
@ -1,53 +0,0 @@
|
|||
# -*- coding: binary -*-
|
||||
|
||||
require 'rex/encoder/xor/dword_additive'
|
||||
|
||||
##
|
||||
#
|
||||
# Jmp/Call Dword Additive Feedback Encoder
|
||||
# Author: skape
|
||||
# Arch: x86
|
||||
#
|
||||
##
|
||||
module Rex
|
||||
module Encoders
|
||||
|
||||
class XorDwordAdditive < Rex::Encoder::Xor::DwordAdditive
|
||||
module Backend
|
||||
|
||||
def _unencoded_transform(data)
|
||||
# check for any dword aligned zeros that would falsely terminate the decoder
|
||||
idx = 0
|
||||
while true
|
||||
idx = data.index("\x00\x00\x00\x00", idx)
|
||||
break if !idx
|
||||
if idx & 3 == 0
|
||||
raise RuntimeError, "Unencoded data cannot have a dword aligned 0 dword!", caller()
|
||||
end
|
||||
idx += 1
|
||||
end
|
||||
|
||||
# pad to a dword boundary and append null dword for termination
|
||||
data = data + ("\x00" * ((4 - data.length & 3) & 3)) + "\x00\x00\x00\x00"
|
||||
end
|
||||
|
||||
def _prepend
|
||||
"\xfc" + # cld
|
||||
"\xbb" + key + # mov ebx, key
|
||||
"\xeb\x0c" + # jmp short 0x14
|
||||
"\x5e" + # pop esi
|
||||
"\x56" + # push esi
|
||||
"\x31\x1e" + # xor [esi], ebx
|
||||
"\xad" + # lodsd
|
||||
"\x01\xc3" + # add ebx, eax
|
||||
"\x85\xc0" + # test eax, eax
|
||||
"\x75\xf7" + # jnz 0xa
|
||||
"\xc3" + # ret
|
||||
"\xe8\xef\xff\xff\xff" # call 0x8
|
||||
end
|
||||
end
|
||||
|
||||
include Backend
|
||||
end
|
||||
|
||||
end end
|
Loading…
Reference in New Issue