From 23ca6833603230811c315e08285a68769ed6d670 Mon Sep 17 00:00:00 2001 From: Dobin Date: Tue, 20 Feb 2024 18:19:00 +0000 Subject: [PATCH] feature: xor encoding of payload with changeable key --- config.py | 1 + phases/assembler.py | 2 +- phases/templater.py | 1 + plugins/decoder/xor_1.c | 2 +- project.py | 2 +- 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/config.py b/config.py index 1bfecbc..de9668b 100644 --- a/config.py +++ b/config.py @@ -9,6 +9,7 @@ class Config(object): self.data = {} self.ShowCommandOutput: bool = False self.debug: bool = False + self.xor_key: int = 0x31 def getConfigPath(self): return CONFIG_FILE diff --git a/phases/assembler.py b/phases/assembler.py index f26f000..e53f3a9 100644 --- a/phases/assembler.py +++ b/phases/assembler.py @@ -44,7 +44,7 @@ def merge_loader_payload( # Nothing to do pass elif decoder_style == DecoderStyle.XOR_1: - xor_key = 0x42 + xor_key = config.xor_key logger.info("---[ XOR payload with key 0x{:x}".format(xor_key)) payload_data = bytes([byte ^ xor_key for byte in payload_data]) diff --git a/phases/templater.py b/phases/templater.py index 672c27c..a2b779e 100644 --- a/phases/templater.py +++ b/phases/templater.py @@ -45,6 +45,7 @@ def create_c_from_template( plugin_decoder = file.read() plugin_decoder = Template(plugin_decoder).render({ 'PAYLOAD_LEN': payload_len, + 'XOR_KEY': config.xor_key, }) filepath = "plugins/executor/{}.c".format(exec_style.value) diff --git a/plugins/decoder/xor_1.c b/plugins/decoder/xor_1.c index 7d9d207..6507998 100644 --- a/plugins/decoder/xor_1.c +++ b/plugins/decoder/xor_1.c @@ -1,4 +1,4 @@ for (int n=0; n<{{PAYLOAD_LEN}}; n++){ dest[n] = supermega_payload[n]; - dest[n] = dest[n] ^ 0x42; + dest[n] = dest[n] ^ {{XOR_KEY}}; } \ No newline at end of file diff --git a/project.py b/project.py index 008b3dc..30cd8c3 100644 --- a/project.py +++ b/project.py @@ -11,7 +11,7 @@ class Project(): self.source_style: SourceStyle = SourceStyle.peb_walk self.alloc_style: AllocStyle = AllocStyle.RWX self.exec_style: ExecStyle = ExecStyle.CALL - self.decoder_style: DecoderStyle = DecoderStyle.PLAIN_1 + self.decoder_style: DecoderStyle = DecoderStyle.XOR_1 self.dataref_style: DataRefStyle = DataRefStyle.APPEND self.short_call_patching: bool = False