Module: Rex::Encoders::XorDwordAdditive::Backend

Included in:
Rex::Encoders::XorDwordAdditive
Defined in:
lib/rex/encoders/xor_dword_additive.rb

Instance Method Summary collapse

Instance Method Details

#_prepend ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/rex/encoders/xor_dword_additive.rb', line 34

def _prepend
  "\xfc"                + # cld
  "\xbb" + key          + # mov ebx, key
  "\xeb\x0c"            + # jmp short 0x14
  "\x5e"                + # pop esi
  "\x56"                + # push esi
  "\x31\x1e"            + # xor [esi], ebx
  "\xad"                + # lodsd
  "\x01\xc3"            + # add ebx, eax
  "\x85\xc0"            + # test eax, eax
  "\x75\xf7"            + # jnz 0xa
  "\xc3"                + # ret
  "\xe8\xef\xff\xff\xff"  # call 0x8
end

#_unencoded_transform(data) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/rex/encoders/xor_dword_additive.rb', line 18

def _unencoded_transform(data)
  # check for any dword aligned zeros that would falsely terminate the decoder
  idx = 0
  while true
    idx = data.index("\x00\x00\x00\x00", idx)
    break if !idx
    if idx & 3 == 0
      raise RuntimeError, "Unencoded data cannot have a dword aligned 0 dword!", caller()
    end
    idx += 1
  end

  # pad to a dword boundary and append null dword for termination
  data = data + ("\x00" * ((4 - data.length & 3) & 3)) + "\x00\x00\x00\x00"
end