egg_xor.c File Reference

#include <rz_egg.h>

Go to the source code of this file.

Macros
#define	DEFAULT_XOR_KEY   "0xFF"
#define	STUBLEN   18

Functions
static RzBuffer *	build (RzEgg *egg)

Variables
RzEggPlugin	rz_egg_plugin_xor

Macro Definition Documentation

DEFAULT_XOR_KEY

#define DEFAULT_XOR_KEY   "0xFF"

Definition at line 7 of file egg_xor.c.

STUBLEN

#define STUBLEN   18

Function Documentation

build()

static RzBuffer* build ( RzEgg *  egg )

static

Definition at line 9 of file egg_xor.c.

                                   {
    RzBuffer *buf, *sc;
    ut8 aux[32], nkey;
    const char *default_key = DEFAULT_XOR_KEY;
    char *key = rz_egg_option_get(egg, "key");
 
    if (!key || !*key) {
        free(key);
        key = strdup(default_key);
        eprintf("XOR key not provided. Using (%s) as the key\n", key);
    }
    nkey = rz_num_math(NULL, key);
    if (nkey == 0) {
        eprintf("Invalid key (%s)\n", key);
        free(key);
        return false;
    }
    if (nkey != (nkey & 0xff)) {
        nkey &= 0xff;
        eprintf("xor key wrapped to (%d)\n", nkey);
    }
    if (rz_buf_size(egg->bin) > 240) { // XXX
        eprintf("shellcode is too long :(\n");
        free(key);
        return NULL;
    }
    sc = egg->bin; // hack
    if (!rz_buf_size(sc)) {
        eprintf("No shellcode found!\n");
        free(key);
        return NULL;
    }
 
    for (size_t i = 0; i < rz_buf_size(sc); i++) {
        // eprintf ("%02x -> %02x\n", sc->buf[i], sc->buf[i] ^nkey);
        ut8 tmp;
        if (!rz_buf_read8_at(sc, i, &tmp)) {
            free(key);
            return NULL;
        }
 
        if ((tmp ^ nkey) == 0) {
            eprintf("This xor key generates null bytes. Try again.\n");
            free(key);
            return NULL;
        }
    }
 
    buf = rz_buf_new_with_bytes(NULL, 0);
    sc = rz_buf_new_with_bytes(NULL, 0);
 
    // TODO: alphanumeric? :D
    // This is the x86-32/64 xor encoder
    rz_buf_append_buf(sc, egg->bin);
    if (egg->arch == RZ_SYS_ARCH_X86) {
#define STUBLEN 18
        ut8 stub[STUBLEN] =
            "\xe8\xff\xff\xff\xff" // call $$+4
            "\xc1" // ffc1 = inc ecx
            "\x5e" // pop esi
            "\x48\x83\xc6\x0d" // add rsi, xx ... 64bit
            // loop0:
            "\x30\x1e" // xor [esi], bl
            "\x48\xff\xc6" // inc rsi
            "\xe2\xf9"; // loop loop0
        // ecx = length
        aux[0] = 0x6a; // push length
        aux[1] = rz_buf_size(sc);
        aux[2] = 0x59; // pop ecx
        // ebx = key
        aux[3] = 0x6a; // push key
        aux[4] = nkey;
        aux[5] = 0x5b; // pop ebx
        rz_buf_set_bytes(buf, aux, 6);
 
        rz_buf_append_bytes(buf, stub, STUBLEN);
 
        for (size_t i = 0; i < rz_buf_size(sc); i++) {
            ut8 v;
            if (!rz_buf_read8_at(sc, i, &v)) {
                free(key);
                return NULL;
            }
 
            v ^= nkey;
            rz_buf_write_at(sc, i, &v, sizeof(v));
        }
        rz_buf_append_buf(buf, sc);
    }
    rz_buf_free(sc);
    free(key);
    return buf;
}

References rz_egg_t::arch, rz_egg_t::bin, DEFAULT_XOR_KEY, eprintf, free(), i, key, NULL, rz_buf_append_buf(), rz_buf_append_bytes(), rz_buf_free(), rz_buf_new_with_bytes(), rz_buf_read8_at(), rz_buf_set_bytes(), rz_buf_size(), rz_buf_write_at(), rz_egg_option_get(), rz_num_math(), RZ_SYS_ARCH_X86, sc, strdup(), STUBLEN, autogen_x86imm::tmp, and v.

Variable Documentation

rz_egg_plugin_xor

RzEggPlugin rz_egg_plugin_xor

Initial value:

= {
    .name = "xor",
    .type = RZ_EGG_PLUGIN_ENCODER,
    .desc = "xor encoder for shellcode",
    .build = (void *)build
}

Definition at line 104 of file egg_xor.c.