librex 0.0.1

data/lib/rex/encoders/xor_dword_additive.rb.ut.rb

@@ -0,0 +1,12 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'dev', 'machinetest'))
+
+require 'test/unit'
+require 'rex/encoders/xor_dword_additive'
+require 'rex/encoders/xor_dword.rb.ut'
+
+class Rex::Encoders::XorDwordAdditive::UnitTest < Rex::Encoders::XorDword::UnitTest
+	Klass = Rex::Encoders::XorDwordAdditive
+end

data/lib/rex/encoding/xor.rb

@@ -0,0 +1,20 @@
+#!/usr/bin/env ruby
+
+#
+# make sure the namespace is created
+#
+
+module Rex
+module Encoding
+module Xor
+end end end
+
+#
+# include the Xor encodings
+#
+
+require 'rex/encoding/xor/generic'
+require 'rex/encoding/xor/byte'
+require 'rex/encoding/xor/word'
+require 'rex/encoding/xor/dword'
+require 'rex/encoding/xor/qword'

data/lib/rex/encoding/xor.rb.ts.rb

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+
+#
+# Xor Encoding Test Suite
+#
+
+require 'test/unit'
+require 'rex/encoding/xor/generic.rb.ut'
+require 'rex/encoding/xor/byte.rb.ut'
+require 'rex/encoding/xor/word.rb.ut'
+require 'rex/encoding/xor/dword.rb.ut'
+require 'rex/encoding/xor/dword_additive.rb.ut'

data/lib/rex/encoding/xor/byte.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/generic'
+
+module Rex
+module Encoding
+module Xor
+
+class Byte < Generic
+
+	def Byte.keysize
+		1
+	end
+
+end end end end # Byte/Xor/Encoding/Rex

data/lib/rex/encoding/xor/byte.rb.ut.rb

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/byte'
+require 'rex/encoding/xor/generic.rb.ut'
+
+#
+# I suck because I want to inherit a test case, but this will
+# also cause it to run the test case I'm inheriting, so this runs both the
+# Byte and Generic tests, oh well for now...
+#
+
+module Rex::Encoding::Xor
+class Byte::UnitTest < Generic::UnitTest
+
+	def enc
+		Byte
+	end
+end
+end

data/lib/rex/encoding/xor/dword.rb

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/generic'
+
+#
+# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
+# version used to pad this buffer out to a 2-byte boundary, but I can't think
+# of a good reason to do that anymore, so this doesn't.
+#
+
+module Rex
+module Encoding
+module Xor
+
+class Dword < Generic
+
+	def Dword.keysize
+		4
+	end
+
+end end end end # Dword/Xor/Encoding/Rex

data/lib/rex/encoding/xor/dword.rb.ut.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/dword'
+require 'rex/encoding/xor/byte.rb.ut'
+
+module Rex::Encoding::Xor
+class Dword::UnitTest < Byte::UnitTest
+
+	def enc
+		Dword
+	end
+end
+end

data/lib/rex/encoding/xor/dword_additive.rb

@@ -0,0 +1,92 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/exceptions'
+require 'rex/encoding/xor/generic'
+
+#
+# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
+# version used to pad this buffer out to a 2-byte boundary, but I can't think
+# of a good reason to do that anymore, so this doesn't.
+#
+
+module Rex
+module Encoding
+module Xor
+
+class DwordAdditive < Generic
+
+	def DwordAdditive.keysize
+		4
+	end
+
+	def DwordAdditive._packspec
+		'V'
+	end
+
+	def DwordAdditive.pack_key(key)
+		return [ key ].pack(_packspec)
+	end
+	def DwordAdditive.unpack_key(key)
+		return key.unpack(_packspec)[0]
+	end
+
+	# hook in the key mutation routine of encode for the additive feedback
+	def DwordAdditive._encode_mutate_key(buf, key, pos, len)
+		if (pos + 1) % len == 0
+			# add the last len bytes (in this case 4) with the key,
+			# dropping off any overflow
+			key = pack_key(
+			  unpack_key(key) + unpack_key(buf[pos - (len - 1), len]) &
+			    (1 << (len << 3)) - 1
+			)
+		end
+
+		return key
+	end
+
+	#
+	# I realize this algorithm is broken.  We invalidate some keys
+	# in _find_bad_keys that could actually be perfectly fine.  However,
+	# it seems to work ok for now, and this is all just a lame adhoc method.
+	# Maybe someday we can revisit this and make it a bit less ghetto...
+	#
+
+	def DwordAdditive._find_good_key(data, badkeys, badchars)
+
+		ksize  = keysize
+		kstart = ""
+		ksize.times { kstart << rand(256) } # random key starting place
+
+		key = kstart.dup
+
+		#
+		# now for the ghettoness of an algorithm:
+		#  try the random key we picked
+		#  if the key failed, figure out which key byte corresponds
+		#  increment that key byte
+		#  if we wrapped a byte all the way around, fail :(
+		#
+
+		loop do
+			# ok, try to encode it, any bad chars present?
+			pos = _check(data, key, badchars)
+
+			# yay, no problems, we found a key!
+			break if !pos
+
+			strip = pos % ksize
+
+			# increment the offending key byte
+			key[strip] = key[strip] + 1 & 0xff
+
+			# We wrapped around!
+			if key[strip] == kstart[strip]
+				raise KeySearchError, "Key space exhausted on strip #{strip}!", caller
+			end
+		end
+
+		return key
+	end
+
+end end end end # DwordAdditive/Xor/Encoding/Rex
+

data/lib/rex/encoding/xor/dword_additive.rb.ut.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/dword_additive'
+require 'rex/encoding/xor/byte.rb.ut'
+
+module Rex::Encoding::Xor
+class DwordAdditive::UnitTest < Byte::UnitTest
+
+	def enc
+		DwordAdditive
+	end
+end
+end

data/lib/rex/encoding/xor/exceptions.rb

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Encoding
+module Xor
+
+module Exception
+
+end
+
+class KeySearchError < ::Exception
+	include Exception
+	MSG = "Error finding a key."
+end
+
+end end end
+

data/lib/rex/encoding/xor/generic.rb

@@ -0,0 +1,146 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/exceptions'
+require 'rex/text'
+
+module Rex
+module Encoding
+module Xor
+
+class Generic
+
+	def Generic.keysize
+		# special case:
+		# 0 means we encode based on the length of the key
+		# we don't enforce any perticular key length
+		return 0
+	end
+
+	#
+	# Now for some internal check methods
+	#	
+
+	# hook stylies!
+	# return index of offending byte or nil
+	def Generic._check(data, key, badchars)
+		return _check_key(key, badchars) || _check_encode(data, key, badchars)
+	end
+	def Generic._check_key(key, badchars)
+		return Rex::Text.badchar_index(key, badchars)
+	end
+	def Generic._check_encode(data, key, badchars)
+		return Rex::Text.badchar_index(encode(data, key), badchars)
+	end
+
+	def Generic.find_key(data, badchars)
+		return _find_good_key(data, _find_bad_keys(data, badchars), badchars)
+	end
+
+	# !!! xxx MAKE THESE BITCHE PRIVATE
+
+	#
+	# Find a list of bytes that can't be valid xor keys, from the data and badchars.
+	# This returns a Array of hashes, length keysize
+	#
+	def Generic._find_bad_keys(data, badchars)
+
+		ksize = keysize
+
+		# array of hashes for the bad characters based
+		# on their position in the data
+		badkeys = [ ]
+		ksize.times { badkeys << { } }
+
+		badchars.each_byte { |badchar|
+			pos = 0
+			data.each_byte { |char|
+				badkeys[pos % ksize][char ^ badchar] = true
+				pos += 1
+			}
+		}
+
+		return badkeys
+	end
+
+	#
+	# (Hopefully) find a good key, from badkeys and badchars
+	#
+	def Generic._find_good_key(data, badkeys, badchars)
+
+		ksize = keysize
+		strip = 0
+		key   = ""
+
+		while strip < keysize
+
+			kbyte = rand(256)
+
+			catch(:found_kbyte) do
+				256.times {
+
+					if !badkeys[strip][kbyte] && !badchars[kbyte.chr]
+						throw :found_kbyte
+					end
+					
+					kbyte = (kbyte + 1) & 0xff
+				}
+
+				raise KeySearchError, "Exhausted byte space for strip #{strip}!", caller
+			end
+
+			key << kbyte
+			strip += 1
+		end
+
+		# ok, we should have a good key now, lets double check...
+		if _check(data, key, badchars)
+			raise KeySearchError, "Key found, but bad character check failed!", caller
+		end
+
+		return key
+	end
+
+	def Generic.encode(buf, key)
+
+		if !key.kind_of?(String)
+			raise ::ArgumentError, "Key must be a string!", caller
+		end
+
+		len = key.length
+
+		if len == 0
+			raise ::ArgumentError, "Zero key length!", caller
+		end
+
+		if keysize != 0 && keysize != len
+			raise ::ArgumentError, "Key length #{len}, expected #{keysize}", caller
+		end
+
+		encoded = ""
+		pos     = 0
+
+		while pos < buf.length
+			encoded += (buf[pos,1].unpack("C*")[0] ^ key[pos % len, 1].unpack("C*")[0]).chr
+			key = _encode_mutate_key(buf, key, pos, len)
+			pos += 1
+		end
+
+		return [ encoded, key ]
+
+	end
+
+	# kind of ghetto, but very convenient for mutating keys
+	# by default, do no key mutations
+	def Generic._encode_mutate_key(buf, key, pos, len)
+		return key
+	end
+
+	# maybe a bit a smaller of method name?
+	def Generic.find_key_and_encode(data, badchars)
+		key        = find_key(data, badchars)
+		enc, fkey  = encode(data, key)
+		return [ enc, key, fkey ]
+	end
+
+
+end end end end # Generic/Xor/Encoding/Rex

data/lib/rex/encoding/xor/generic.rb.ut.rb

@@ -0,0 +1,120 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'test/unit'
+require 'rex/encoding/xor/generic'
+
+module Rex::Encoding::Xor
+
+class Generic::UnitTest < ::Test::Unit::TestCase
+
+	def enc
+		Generic
+	end
+
+	def hook_static_encode(data, key, expected)
+		if enc.keysize != 0 && key.length != enc.keysize
+			assert_raise(::ArgumentError) { enc.encode(data,key) }
+		else
+			assert_equal(enc.encode(data, key), [ expected, key ])
+		end
+	end
+
+	def test_static_encode
+		# Test key of zero length
+		assert_raise(::ArgumentError) { enc.encode("\x00", "") }
+
+		# Test non-string key
+		assert_raise(::ArgumentError) { enc.encode("\x00\x01", 1) }
+
+		# some simple single byte tests with 0x00
+		30.times {
+			byte = rand(256).chr
+			hook_static_encode("\x00" * 3, byte, byte * 3)
+		}
+
+		# misc tests, see below
+		misc_tests.each { |test|
+			hook_static_encode(test[0], test[1], test[2])
+		}
+
+	end
+
+	#
+	# Misc (mostly) autogenerated tests, we need more with
+	# different keysizes!
+	#
+
+	def misc_tests
+		[
+
+		# a 3 byte key test
+		[
+		  "\x54\x9a\x04\x02\x8f",
+		  "\x6d\x4b\x3c",
+		  "9\3218o\304"
+		],
+
+		# a 4 byte key test
+		[
+		  "\312/\216e\265\301\323\026Y\315",
+		  "m2{b",
+		  "\247\035\365\a\330\363\250t4\377"
+		],
+
+		# randomly generated 2 byte key tests...
+		[
+		  "\x82\x3f\xb4\x77\x55\x16\x4a\x56\x87\xad\x5b\xf5",
+		  "\x33\xdb",
+		  "\xb1\xe4\x87\xac\x66\xcd\x79\x8d\xb4\x76\x68\x2e"
+		],
+		[
+		  "\x9c\xbd\xaa\x83\x8d\x7e\x76\xd9\x4b\xb2\x04\xd5\x2b\x58\x66",
+		  "\xda\x10",
+		  "\x46\xad\x70\x93\x57\x6e\xac\xc9\x91\xa2\xde\xc5\xf1\x48\xbc"
+		],
+		[
+		  "\x7f\x3b\xfb\x3b\xce\x8c\xe8\x3d\x65\x40\x2d\x5a\x19",
+		  "\x62\x28",
+		  "\x1d\x13\x99\x13\xac\xa4\x8a\x15\x07\x68\x4f\x72\x7b"
+		],
+		[
+		  "\xc8\xab\xa4\x56\xd5\xf0",
+		  "\x1a\xd0",
+		  "\xd2\x7b\xbe\x86\xcf\x20"
+		],
+		[
+		  "\xcc\x5a\x84\xe0\x6c\x00\x7a\x20\xa0\xc9",
+		  "\xe6\xb6",
+		  "\x2a\xec\x62\x56\x8a\xb6\x9c\x96\x46\x7f"
+		],
+		[
+		  "\x46\x96\x83\x1f\x6a\x79\xfe\xec\x24\xe0\xc3\x20\xe9\xa5\x3a\x76",
+		  "\x36\x5e",
+		  "\x70\xc8\xb5\x41\x5c\x27\xc8\xb2\x12\xbe\xf5\x7e\xdf\xfb\x0c\x28"
+		],
+		[
+		  "\x74\x7c\xe9\x21\x30\x33\xb3\xe6\x77\x9e\x07\xbc\x6c\xee\xc5\x06",
+		  "\x02\xa0",
+		  "\x76\xdc\xeb\x81\x32\x93\xb1\x46\x75\x3e\x05\x1c\x6e\x4e\xc7\xa6"
+		],
+		[
+		  "\x64\x8c\xc3\x41\x5d\xe5\x18\x36\xda\xc4\x86",
+		  "\xe3\xb9",
+		  "\x87\x35\x20\xf8\xbe\x5c\xfb\x8f\x39\x7d\x65"
+		],
+		[
+		  "\xdb\xbb\xb2\x7c\xda\x1f\xd6\xa5\x34\x00\xad",
+		  "\x20\xfc",
+		  "\xfb\x47\x92\x80\xfa\xe3\xf6\x59\x14\xfc\x8d"
+		],
+		[
+		  "\xc1\x2e\xfc\x7b\x98\x41\xec\xe3\x40\x98\x0b\xfd\x2c",
+		  "\x4a\xd7",
+		  "\x8b\xf9\xb6\xac\xd2\x96\xa6\x34\x0a\x4f\x41\x2a\x66"
+		]
+		]
+	end
+end
+end