From 466cf11d823094a0ae180d494d0fe0d69c73b146 Mon Sep 17 00:00:00 2001
From: Dobin <dobin.rutishauser@gmail.com>
Date: Sat, 3 Feb 2024 20:33:50 +0000
Subject: [PATCH] feature: dynamic payload size

---
 helper.py     | 20 ++++++++++++--------
 source/main.c |  4 +++-
 supermega.py  |  5 ++++-
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/helper.py b/helper.py
index e8f0e90..7ba6748 100644
--- a/helper.py
+++ b/helper.py
@@ -7,11 +7,11 @@ import shutil
 SHC_VERIFY_SLEEP = 0.1
 
 path_cl = r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\cl.exe'
-path_masmshc =  r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\masm_shc\masm_shc.exe'
 path_ml64 =  r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\ml64.exe'
 
+path_masmshc =  r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\masm_shc\masm_shc.exe'
 path_runshc = r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\runshc\runshc.exe'
-path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe'
+#path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe'
 
 verify_filename = r'C:\Temp\a'
 
@@ -28,7 +28,7 @@ def clean_files():
         pass
 
 
-def make_c_to_asm(c_file, asm_file, asm_clean_file):
+def make_c_to_asm(c_file, asm_file, asm_clean_file, payload_len):
     print("--[ Compile C source to ASM: {} -> {} ]".format(c_file, asm_file))
     subprocess.run([
         path_cl,
@@ -56,10 +56,10 @@ def make_c_to_asm(c_file, asm_file, asm_clean_file):
         print("    > Generated {}".format(asm_clean_file))
 
     print("--[ Fixup ASM: {} ]".format(asm_clean_file))
-    fixup_asm_file(asm_clean_file)
+    fixup_asm_file(asm_clean_file, payload_len)
 
 
-def fixup_asm_file(filename):
+def fixup_asm_file(filename, payload_len):
     with open(filename, 'r') as asmfile:
         lines = asmfile.readlines()
 
@@ -71,6 +71,12 @@ def fixup_asm_file(filename):
                 "mov	r8, QWORD PTR dobin",
                 "lea	r8, [shcstart]"
             )
+
+    # replace payload length
+    for idx, line in enumerate(lines): 
+        if "11223344" in lines[idx]:
+            lines[idx] = lines[idx].replace("11223344", str(payload_len+1))
+            break
             
     # add label at end of code
     for idx, line in enumerate(lines): 
@@ -162,7 +168,7 @@ def obfuscate_shc_loader(file_shc_in, file_shc_out):
 def test_shellcode(shc_name):
     print("---[ Test shellcode: {} ]".format(shc_name))
     subprocess.run([
-        path_shexec,
+        path_runshc,
         "{}".format(shc_name),
     ])  # , check=True
 
@@ -175,8 +181,6 @@ def verify_shellcode(shc_name):
         print("Error, directory does not exist for: {}".format(verify_filename))
         return
 
-    # path_runshc
-    # path_shexec
     subprocess.run([
         path_runshc,
         "{}".format(shc_name),
diff --git a/source/main.c b/source/main.c
index d09f5fc..aa69bb3 100644
--- a/source/main.c
+++ b/source/main.c
@@ -85,7 +85,9 @@ int main()
 			_In_ DWORD  flProtect)) _GetProcAddress((HMODULE)base, VirtualAlloc_str);
 	if (_VirtualAlloc == NULL) return 4;
 	char *dest = _VirtualAlloc(NULL, 4096, 0x3000, 0x40);
-	for(int n=0; n<347+1; n++) {
+	// 11223344 is a magic number which will be replaced in the asm source
+	// with the payload length.
+	for(int n=0; n<11223344; n++) {
 		dest[n] = dobin[n];
 	}
 
diff --git a/supermega.py b/supermega.py
index 74696fe..fe374ba 100644
--- a/supermega.py
+++ b/supermega.py
@@ -76,7 +76,10 @@ def main():
         clean_files()
 
     if options["generate_asm_from_c"]:
-        make_c_to_asm("source/main.c", "main.asm", "main-clean.asm")
+        with open(options["payload"], 'rb') as input2:
+            data_payload = input2.read()
+            l = len(data_payload)
+        make_c_to_asm("source/main.c", "main.asm", "main-clean.asm", l)
 
     if options["generate_asm_from_c"]:
         make_shc_from_asm("main-clean.asm", "main-clean.exe", "main-clean.bin")