Class shellcode

include/shellcode.hpp:29–254

Utility class represents the shellcode builder.

// Utility class represents the shellcode builder.
class shellcode
{
    // To access the internals.
    friend class cobf;
private:

    // Union of the symbol hash and ordinal.
    typedef union {
        DWORD   sym_hash;   /*!< The symbol hash used to query it. */
        WORD    sym_ord;    /*!< The symbol ordinal used to query it. */
    } u_sym_info;

    // Struct of an obfuscated API.
    typedef struct {
        DWORD       dll_name;   /*!< Offset to the dll name. */
        BOOL        by_name;    /*!< True if the symbol is imported by name. */
        u_sym_info  sym_info;   /*!< The information . */
        DWORD       sym_thnk;   /*!< Offset to the first thunk that represents the symbol. */
    } obfuscated_sym, * p_obfuscated_sym;

    // Api set schema version 3.
    typedef struct _ApiSetHeader63 {
        DWORD Version;          /*!< The version of the api set schema (6,3). */
        DWORD Size;             /*!< Size of the whole table. */
        DWORD Sealed;           /*!< Unknown (undocumented). */
        DWORD NumberOfApisets;  /*!< Number of entries at the table. */
        DWORD NamesOffset;      /*!< Offset to the names table. */
        DWORD TableOffset;      /*!< Unknown (undocumented). */
        DWORD Multiplier;       /*!< Unknown (undocumented). */
    } ApiSetHeader63, * PApiSetHeader63;

    // Api set schema name entry.
    typedef struct _ApisetNameEntry {
        DWORD Sealed;           /*!< Unknown (undocumented). */
        DWORD Offset;           /*!< Offset to the virtual dll name. */
        DWORD Ignored;          /*!< Unknown (undocumented). */
        DWORD Size;             /*!< Size of the virtual dll name. */
        DWORD HostOffset;       /*!< Offset to the real dll name. */
        DWORD NumberOfHosts;    /*!< Number of resolved dlls. */
    } ApisetNameEntry, * PApisetNameEntry;

    // Api set schema value entry.
    typedef struct _ApisetValueEntry {
        DWORD Ignored;          /*!< Unknown (undocumented). */
        DWORD NameOffset;       /*!< Offset to the name. */
        DWORD NameLength;       /*!< Length of the name. */
        DWORD ValueOffset;      /*!< Offset to the value. */
        DWORD ValueLength;      /*!< Loength of the value. */
    } ApisetValueEntry, * PApisetValueEntry;

    // Api set schema version 6.
    typedef struct _ApiSetHeader6 {
        DWORD Version;          /*!< Version of the api set schema. */
        DWORD Count;            /*!< Number of entries. */
    } ApiSetHeader6, * PApiSetHeader6;

    // Api set schema another version name entry.
    typedef struct _ApisetNameEntry2 {