static RBuffer *build (REgg *egg) {
RBuffer *buf = r_buf_new ();
char *key = r_egg_option_get (egg, "key");
char *seed = r_egg_option_get (egg, "seed");
eprintf ("TODO: shoorisu yagana shellcode encoder\n");
free (key);
free (seed);
return buf;
}
static RBuffer *build (REgg *egg) {
RBuffer *buf = r_buf_new ();
const ut8 *sc = NULL;
int cd = 0;
char *port = r_egg_option_get (egg, "port");
//TODO: char *udp = r_egg_option_get (egg, "udp");
switch (egg->os) {
case R_EGG_OS_OSX:
case R_EGG_OS_DARWIN:
switch (egg->arch) {
case R_SYS_ARCH_X86:
if (suid) {
sc = x86_osx_suid_binsh;
cd = 7+36;
} else {
sc = x86_osx_binsh;
cd = 36;
}
case R_SYS_ARCH_ARM:
// TODO
break;
}
break;
case R_EGG_OS_LINUX:
if (suid) eprintf ("no suid for this platform\n");
suid = 0;
switch (egg->arch) {
case R_SYS_ARCH_X86:
switch (egg->bits) {
case 32: sc = x86_linux_binsh; break;
case 64: sc = x86_64_linux_binsh; break;
default: eprintf ("Unsupportted\n");
}
break;
case R_SYS_ARCH_ARM:
sc = arm_linux_binsh;
break;
}
break;
default:
eprintf ("unsupported os %x\n", egg->os);
break;
}
if (sc) {
r_buf_set_bytes (buf, sc, strlen ((const char *)sc));
if (shell && *shell) {
if (cd) r_buf_write_at (buf, cd, (const ut8*)shell, strlen (shell)+1);
else eprintf ("Cannot set shell\n");
}
}
free (suid);
free (shell);
return buf;
}
static RBuffer *build (REgg *egg) {
RBuffer *buf, *sc;
ut8 aux[32], nkey;
const char *default_key = DEFAULT_XOR_KEY;
char *key = r_egg_option_get (egg, "key");
int i;
if (!key || !*key) {
free (key);
key = strdup (default_key);
eprintf ("XOR key not provided. Using (%s) as the key\n", key);
}
nkey = r_num_math (NULL, key);
if (nkey == 0) {
eprintf ("Invalid key (%s)\n", key);
free (key);
return false;
}
if (nkey != (nkey & 0xff)) {
nkey &= 0xff;
eprintf ("xor key wrapped to (%d)\n", nkey);
}
if (r_buf_size (egg->bin) > 240) { // XXX
eprintf ("shellcode is too long :(\n");
free (key);
return NULL;
}
sc = egg->bin; // hack
if (!r_buf_size (sc)) {
eprintf ("No shellcode found!\n");
free (key);
return NULL;
}
for (i = 0; i<r_buf_size (sc); i++) {
// eprintf ("%02x -> %02x\n", sc->buf[i], sc->buf[i] ^nkey);
if ((r_buf_read8_at (sc, i) ^ nkey)==0) {
eprintf ("This xor key generates null bytes. Try again.\n");
free (key);
return NULL;
}
}
buf = r_buf_new ();
sc = r_buf_new ();
// TODO: alphanumeric? :D
// This is the x86-32/64 xor encoder
r_buf_append_buf (sc, egg->bin);
if (egg->arch == R_SYS_ARCH_X86) {
#define STUBLEN 18
ut8 stub[STUBLEN] =
"\xe8\xff\xff\xff\xff" // call $$+4
"\xc1" // ffc1 = inc ecx
"\x5e" // pop esi
"\x48\x83\xc6\x0d" // add rsi, xx ... 64bit
// loop0:
"\x30\x1e" // xor [esi], bl
"\x48\xff\xc6" // inc rsi
"\xe2\xf9"; // loop loop0
// ecx = length
aux[0] = 0x6a; // push length
aux[1] = r_buf_size (sc);
aux[2] = 0x59; // pop ecx
// ebx = key
aux[3] = 0x6a; // push key
aux[4] = nkey;
aux[5] = 0x5b; // pop ebx
r_buf_set_bytes (buf, aux, 6);
r_buf_append_bytes (buf, stub, STUBLEN);
for (i = 0; i<r_buf_size (sc); i++) {
ut8 v = r_buf_read8_at (sc, i) ^ nkey;
r_buf_write_at (sc, i, &v, sizeof (v));
}
r_buf_append_buf (buf, sc);
}
r_buf_free (sc);
free (key);
return buf;
}
static RBuffer *build (REgg *egg) {
RBuffer *buf, *sc;
ut8 aux[32], nkey;
int i;
char *key = r_egg_option_get (egg, "key");
if (!key || !*key) {
eprintf ("Invalid key (null)\n");
return R_FALSE;
}
nkey = r_num_math (NULL, key);
if (nkey == 0) {
eprintf ("Invalid key (%s)\n", key);
return R_FALSE;
}
if (nkey != (nkey & 0xff)) {
nkey &= 0xff;
eprintf ("xor key wrapped to (%d)\n", nkey);
}
if (egg->bin->length > 240) { // XXX
eprintf ("shellcode is too long :(\n");
return NULL;
}
sc = egg->bin; // hack
for (i = 0; i<sc->length; i++) {
// eprintf ("%02x -> %02x\n", sc->buf[i], sc->buf[i] ^nkey);
if ((sc->buf[i]^nkey)==0) {
eprintf ("This xor key generates null bytes. Try again.\n");
return NULL;
}
}
buf = r_buf_new ();
sc = r_buf_new ();
// TODO: alphanumeric? :D
// This is the x86-32/64 xor encoder
r_buf_append_buf (sc, egg->bin);
if (egg->arch == R_SYS_ARCH_X86) {
#define STUBLEN 18
ut8 stub[STUBLEN] =
"\xe8\xff\xff\xff\xff" // call $$+4
"\xc1" // ffc1 = inc ecx
"\x5e" // pop esi
"\x48\x83\xc6\x0d" // add rsi, xx ... 64bit
// loop0:
"\x30\x1e" // xor [esi], bl
"\x48\xff\xc6" // inc rsi
"\xe2\xf9"; // loop loop0
// ecx = length
aux[0] = 0x6a; // push length
aux[1] = sc->length;
aux[2] = 0x59; // pop ecx
// ebx = key
aux[3] = 0x6a; // push key
aux[4] = nkey;
aux[5] = 0x5b; // pop ebx
r_buf_set_bytes (buf, aux, 6);
r_buf_append_bytes (buf, stub, STUBLEN);
for (i = 0; i<sc->length; i++) {
// eprintf ("%02x -> %02x\n", sc->buf[i], sc->buf[i] ^nkey);
sc->buf[i]^=nkey;
}
r_buf_append_buf (buf, sc);
}
r_buf_free (sc);
return buf;
}
