feature: createfile shellcode verification

helper.py

@@ -1,21 +1,32 @@
 import subprocess
 import os
 import pefile
+import time
 
 
-def clean_files():
-    os.remove("main.asm")       # generated from compiling source/main.c
-    os.remove("main-clean.asm") # cleaned for being a shellcode
-    os.remove("main-clean.exe") # assembled
-    os.remove("main-clean.bin")
-    os.remove("main-clean-append.bin")
+SHC_VERIFY_SLEEP = 0.1
 
 path_cl = r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\cl.exe'
 path_masmshc =  r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\masm_shc\masm_shc.exe'
+path_ml64 =  r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\ml64.exe'
 
 path_runshc = r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\runshc\runshc.exe'
 path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe'
 
+verify_filename = r'C:\Temp\a'
+
+
+def clean_files():
+    try:
+        os.remove("main.asm")       # generated from compiling source/main.c
+        os.remove("main-clean.asm") # cleaned for being a shellcode
+        os.remove("main-clean.exe") # assembled
+        os.remove("main-clean.bin")
+        os.remove("main-clean-append.bin")
+        os.remove(verify_filename)
+    except OSError:
+        pass
+
 
 def make_c_to_asm(c_file, asm_file, asm_clean_file):
     print("--[ Compile C source to ASM: {} -> {} ]".format(c_file, asm_file))
@@ -25,24 +36,24 @@ def make_c_to_asm(c_file, asm_file, asm_clean_file):
         "/FA",
         "/GS-",
         c_file,
-    ], check=True)
+    ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     if not os.path.isfile(asm_file):
         print("Error")
         return
     else:
-        print("  Generated {}".format(asm_file))
+        print("    > Generated {}".format(asm_file))
 
     print("--[ Cleanup ASM: {} -> {} ]".format(asm_file, asm_clean_file))
     subprocess.run([
         path_masmshc,
         asm_file,
         asm_clean_file,
-    ], check=True)
+    ], check=True, stdout=subprocess.DEVNULL)
     if not os.path.isfile(asm_clean_file):
         print("Error")
         return
     else:
-        print("  Generated {}".format(asm_clean_file))
+        print("    > Generated {}".format(asm_clean_file))
 
     print("--[ Fixup ASM: {} ]".format(asm_clean_file))
     fixup_asm_file(asm_clean_file)
@@ -55,7 +66,7 @@ def fixup_asm_file(filename):
     # replace external reference with shellcode reference
     for idx, line in enumerate(lines): 
         if "dobin" in lines[idx]:
-            print("--( Replace external reference at: {})".format(idx))
+            print("    > Replace external reference at: {})".format(idx))
             lines[idx] = lines[idx].replace(
                 "mov	r8, QWORD PTR dobin",
                 "lea	r8, [shcstart]"
@@ -64,7 +75,7 @@ def fixup_asm_file(filename):
     # add label at end of code
     for idx, line in enumerate(lines): 
         if lines[idx].startswith("END"):
-            print("--( Add end of code label at: {})".format(idx))
+            print("    > Add end of code label at: {})".format(idx))
             lines.insert(idx-1, "shcstart:\r\n")
             lines.insert(idx, "\tnop\r\n")
             break
@@ -75,18 +86,17 @@ def fixup_asm_file(filename):
 
 def make_shc_from_asm(asm_clean_file, exe_file, shc_file):
     print("--[ Assemble to exe ]")
-    path_ml64 =  r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\ml64.exe'
     subprocess.run([
         path_ml64,
         asm_clean_file,
         "/link",
         "/entry:AlignRSP"
-    ], check=True)
+    ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     if not os.path.isfile(exe_file):
         print("Error")
         return
     else:
-        print("  Generated {}".format(exe_file))
+        print("    > Generated {}".format(exe_file))
 
     print("--[ Get code section from exe ]")
     code = get_code_section(exe_file)
@@ -104,9 +114,10 @@ def get_code_section(pe_file):
         for section in pe.sections:
             # Check if this is the code section
             if '.text' in section.Name.decode().rstrip('\x00'):
-                print("--> Size: {}".format(section.SizeOfRawData))
                 data = section.get_data()
                 data = remove_trailing_null_bytes(data)
+                print("    > Code Size Raw: {}  Size me: {}".format(
+                    section.SizeOfRawData, len(data)))
                 return data
         else:
             print("Code section not found.")
@@ -145,7 +156,7 @@ def obfuscate_shc_loader(file_shc_in, file_shc_out):
         print("Error")
         return
     else:
-        print("  Generated main-clean-sgn.bin")
+        print("   > Generated main-clean-sgn.bin")
 
 
 def test_shellcode(shc_name):
@@ -155,3 +166,26 @@ def test_shellcode(shc_name):
         "{}".format(shc_name),
     ])  # , check=True
 
+
+def verify_shellcode(shc_name):
+    print("--[ Test shellcode: {} ]".format(shc_name))
+
+    # check if directory exists
+    if not os.path.exists(os.path.dirname(verify_filename)):
+        print("Error, directory does not exist for: {}".format(verify_filename))
+        return
+
+    # path_runshc
+    # path_shexec
+    subprocess.run([
+        path_runshc,
+        "{}".format(shc_name),
+    ])  # , check=True
+    time.sleep(SHC_VERIFY_SLEEP)
+    if os.path.isfile(verify_filename):
+        print("--> OK. File creation test shellcode payload verified")
+        # better to remove it immediately. If cleanup on start is not performed, 
+        # there may be false positives
+        os.remove(verify_filename)
+    else:
+        print("--> FAIL. Payload did not create file.")