dobin-ShellcodeObfuscationLab/lab_results/random_shellcode/xor_multibyte_work.c

#include <windows.h>
#include <stdio.h>


void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
	// Defender will detect this function
	// Somehow, opening the null device and closing it again is enough to avoid detection
	FILE* outfile = fopen("nul", "w");
	
	int myByte = 0;
	int k_minus_one = key_len - 1;
	for (int idx = 0;  idx < ciphertext_len; idx++) {
		if (myByte == k_minus_one)
		{ 
			myByte = 0;
		}
		
		ciphertext[idx] = ciphertext[idx] ^ key[myByte];
		myByte++;

	}
	// Close our decoy
	fclose(outfile);
}


int main(void)
{
	
	char shellcode[42] = {0xa7,0xb1,0x26,0x4b,0x20,0x59,0x2b,0x4f,0x26,0x4b,0x20,0x59,0x31,0x4f,0x3c,0x4b,0x36,0x59,0x22,0x4f,0x25,0x4b,0x2a,0x59,0x3d,0x4f,0x3b,0x4b,0x2b,0x59,0x2b,0x4f,0x28,0x4b,0x32,0x59,0x37,0x4f,0x60,0x4b,0x77,0x59};
	char xorkey[] = "XORKEY";

	
	// XOR our shellcode with the key to decode it
	XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey));
	
	int idx = 0;
	while ( idx < sizeof(shellcode))
	{
		if (idx == (sizeof(shellcode) - 1) )
		{
			printf("0x%02x ", (unsigned char)shellcode[idx]);
		}
		else
		{
			printf("0x%02x, ", (unsigned char)shellcode[idx]);
		}
		idx++;
	}

	
	return 0;
}