diff --git a/src/shellcode.rs b/src/shellcode.rs index 2411640..3e8fd1c 100644 --- a/src/shellcode.rs +++ b/src/shellcode.rs @@ -1,5 +1,5 @@ use byteorder::{ByteOrder, LittleEndian, ReadBytesExt}; -use std::io::prelude::*; +//use std::io::prelude::*; use std::{fs, path, process}; //some functions are not used now but we may want to use them later #[allow(dead_code)] //copilot added this based on above comment. (good job) @@ -64,6 +64,8 @@ pub fn shellcode_rdi(dll_path: &str, function_name: &str, user_data: String) -> convert_to_shellcode(dll, hash_function, user_data.into_bytes(), flags) } +//this function is not used now but we may want to use it later +/* pub fn shellcode_rdi_from_bytes( dll_bytes: Vec, function_name: String, @@ -83,7 +85,7 @@ pub fn shellcode_rdi_from_bytes( } convert_to_shellcode(dll_bytes, hash_function, user_data.into_bytes(), flags) } - +*/ pub fn convert_to_shellcode( dll_bytes: Vec, function_hash: [u8; 4], @@ -354,6 +356,9 @@ pub fn convert_to_shellcode( 0xC0, 0x48, 0x8B, 0x5C, 0x24, 0x20, 0x48, 0x8B, 0x74, 0x24, 0x28, 0x48, 0x83, 0xC4, 0x10, 0x5F, 0xC3, ]; + + + //print user data let user_data = if user_data_.is_empty() { "None".as_bytes().to_vec() } else { @@ -361,6 +366,13 @@ pub fn convert_to_shellcode( }; let mut final_shellcode: Vec = Vec::new(); + //print function hash + //println!("Converting to shellcode:"); + //println!("- Function hash: {:?}", function_hash); + //println!("- DLL size: {} bytes", dll_bytes.len()); + //println!("- User data size: {} bytes", &user_data.len()); + //println!("- Flags: {}", flags); + if is_64bit_dll(&dll_bytes) { // x64 let bootstrap_size = 64; @@ -371,18 +383,18 @@ pub fn convert_to_shellcode( // Set the offset to our DLL from pop result let dll_offset = bootstrap_size - bootstrap.len() + rdi_shellcode_64.len(); - //let dll_offset_bytes = dll_offset.to_le_bytes(); - + //println!("DLL offset: 0x{:X} ({} bytes)", dll_offset, dll_offset); + // pop rcx - Capture our current location in memory bootstrap.extend_from_slice(&[0x59]); - + // mov r8, rcx - copy our location in memory to r8 before we start modifying RCX bootstrap.extend_from_slice(&[0x49, 0x89, 0xc8]); // add rcx, bootstrap.extend_from_slice(&[0x48, 0x81, 0xc1]); bootstrap.extend_from_slice(&pack(dll_offset as u32)); - // println!("DLL Offset: {}", dll_offset); + // println!("DLL Offset: {}", dll_offset); // mov edx, bootstrap.extend_from_slice(&[0xba]); @@ -392,6 +404,7 @@ pub fn convert_to_shellcode( // add r8, + bootstrap.extend_from_slice(&[0x49, 0x81, 0xc0]); let user_data_location = dll_offset + dll_bytes.len(); + //println!("User data offset: 0x{:X} ({} bytes)", user_data_location, user_data_location); bootstrap.extend_from_slice(&pack(user_data_location as u32)); // mov r9d, @@ -444,9 +457,12 @@ pub fn convert_to_shellcode( //print!("DLL Size: {}", dll_bytes.len()); final_shellcode.extend_from_slice(&user_data); //println!("User Data Size: {}", user_data.len()); + //println!("Bootstrap size: {} bytes", bootstrap_size); + //println!("RDI shellcode size: {} bytes", rdi_shellcode_64.len()); + //println!("DLL size: {} bytes", dll_bytes.len()); + //println!("User data size: {} bytes", user_data.len()); //find the shellcode offset - } else { // x86 let bootstrap_size = 45; @@ -514,17 +530,6 @@ pub fn convert_to_shellcode( final_shellcode.extend_from_slice(&dll_bytes); final_shellcode.extend_from_slice(&user_data); } - //println!("Final Shellcode Size: {}", final_shellcode.len()); + final_shellcode - -} - -pub fn shellcode_rdi_to_file(dll_path: &str, function_name: &str) { - let shellcode = shellcode_rdi(dll_path, function_name, String::from("")); - // write shellcode to file - let mut shellcode_file = - fs::File::create("link.bin").expect("Error opening file to write shellcode"); - shellcode_file - .write_all(&shellcode) - .expect("Could not write contents to shellcode file"); } \ No newline at end of file