librex 0.0.13 → 0.0.15

data/lib/rex/encoders/xor_dword_additive.rb

@@ -1,53 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/encoder/xor/dword_additive'
-
-##
-#
-# Jmp/Call Dword Additive Feedback Encoder
-# Author: skape
-# Arch:   x86
-#
-##
-module Rex
-module Encoders
-
-class XorDwordAdditive < Rex::Encoder::Xor::DwordAdditive
-	module Backend
-
-		def _unencoded_transform(data)
-			# check for any dword aligned zeros that would falsely terminate the decoder
-			idx = 0
-			while true
-				idx = data.index("\x00\x00\x00\x00", idx)
-				break if !idx
-				if idx & 3 == 0
-					raise RuntimeError, "Unencoded data cannot have a dword aligned 0 dword!", caller()
-				end
-				idx += 1
-			end
-
-			# pad to a dword boundary and append null dword for termination
-			data = data + ("\x00" * ((4 - data.length & 3) & 3)) + "\x00\x00\x00\x00"
-		end
-
-		def _prepend
-			"\xfc"                + # cld
-			"\xbb" + key          + # mov ebx, key
-			"\xeb\x0c"            + # jmp short 0x14
-			"\x5e"                + # pop esi
-			"\x56"                + # push esi
-			"\x31\x1e"            + # xor [esi], ebx
-			"\xad"                + # lodsd
-			"\x01\xc3"            + # add ebx, eax
-			"\x85\xc0"            + # test eax, eax
-			"\x75\xf7"            + # jnz 0xa
-			"\xc3"                + # ret
-			"\xe8\xef\xff\xff\xff"  # call 0x8
-		end
-	end
-
-	include Backend
-end
-
-end end

data/lib/rex/encoders/xor_dword_additive.rb.ut.rb

@@ -1,12 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'dev', 'machinetest'))
-
-require 'test/unit'
-require 'rex/encoders/xor_dword_additive'
-require 'rex/encoders/xor_dword.rb.ut'
-
-class Rex::Encoders::XorDwordAdditive::UnitTest < Rex::Encoders::XorDword::UnitTest
-	Klass = Rex::Encoders::XorDwordAdditive
-end

data/lib/rex/encoding/xor.rb

@@ -1,20 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# make sure the namespace is created
-#
-
-module Rex
-module Encoding
-module Xor
-end end end
-
-#
-# include the Xor encodings
-#
-
-require 'rex/encoding/xor/generic'
-require 'rex/encoding/xor/byte'
-require 'rex/encoding/xor/word'
-require 'rex/encoding/xor/dword'
-require 'rex/encoding/xor/qword'

data/lib/rex/encoding/xor.rb.ts.rb

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
-
-#
-# Xor Encoding Test Suite
-#
-
-require 'test/unit'
-require 'rex/encoding/xor/generic.rb.ut'
-require 'rex/encoding/xor/byte.rb.ut'
-require 'rex/encoding/xor/word.rb.ut'
-require 'rex/encoding/xor/dword.rb.ut'
-require 'rex/encoding/xor/dword_additive.rb.ut'

data/lib/rex/encoding/xor/byte.rb

@@ -1,15 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/encoding/xor/generic'
-
-module Rex
-module Encoding
-module Xor
-
-class Byte < Generic
-
-	def Byte.keysize
-		1
-	end
-
-end end end end # Byte/Xor/Encoding/Rex

data/lib/rex/encoding/xor/byte.rb.ut.rb

@@ -1,21 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
-
-require 'rex/encoding/xor/byte'
-require 'rex/encoding/xor/generic.rb.ut'
-
-#
-# I suck because I want to inherit a test case, but this will
-# also cause it to run the test case I'm inheriting, so this runs both the
-# Byte and Generic tests, oh well for now...
-#
-
-module Rex::Encoding::Xor
-class Byte::UnitTest < Generic::UnitTest
-
-	def enc
-		Byte
-	end
-end
-end

data/lib/rex/encoding/xor/dword.rb

@@ -1,21 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/encoding/xor/generic'
-
-#
-# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
-# version used to pad this buffer out to a 2-byte boundary, but I can't think
-# of a good reason to do that anymore, so this doesn't.
-#
-
-module Rex
-module Encoding
-module Xor
-
-class Dword < Generic
-
-	def Dword.keysize
-		4
-	end
-
-end end end end # Dword/Xor/Encoding/Rex

data/lib/rex/encoding/xor/dword.rb.ut.rb

@@ -1,15 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
-
-require 'rex/encoding/xor/dword'
-require 'rex/encoding/xor/byte.rb.ut'
-
-module Rex::Encoding::Xor
-class Dword::UnitTest < Byte::UnitTest
-
-	def enc
-		Dword
-	end
-end
-end

data/lib/rex/encoding/xor/dword_additive.rb

@@ -1,92 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/encoding/xor/exceptions'
-require 'rex/encoding/xor/generic'
-
-#
-# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
-# version used to pad this buffer out to a 2-byte boundary, but I can't think
-# of a good reason to do that anymore, so this doesn't.
-#
-
-module Rex
-module Encoding
-module Xor
-
-class DwordAdditive < Generic
-
-	def DwordAdditive.keysize
-		4
-	end
-
-	def DwordAdditive._packspec
-		'V'
-	end
-
-	def DwordAdditive.pack_key(key)
-		return [ key ].pack(_packspec)
-	end
-	def DwordAdditive.unpack_key(key)
-		return key.unpack(_packspec)[0]
-	end
-
-	# hook in the key mutation routine of encode for the additive feedback
-	def DwordAdditive._encode_mutate_key(buf, key, pos, len)
-		if (pos + 1) % len == 0
-			# add the last len bytes (in this case 4) with the key,
-			# dropping off any overflow
-			key = pack_key(
-			  unpack_key(key) + unpack_key(buf[pos - (len - 1), len]) &
-			    (1 << (len << 3)) - 1
-			)
-		end
-
-		return key
-	end
-
-	#
-	# I realize this algorithm is broken.  We invalidate some keys
-	# in _find_bad_keys that could actually be perfectly fine.  However,
-	# it seems to work ok for now, and this is all just a lame adhoc method.
-	# Maybe someday we can revisit this and make it a bit less ghetto...
-	#
-
-	def DwordAdditive._find_good_key(data, badkeys, badchars)
-
-		ksize  = keysize
-		kstart = ""
-		ksize.times { kstart << rand(256) } # random key starting place
-
-		key = kstart.dup
-
-		#
-		# now for the ghettoness of an algorithm:
-		#  try the random key we picked
-		#  if the key failed, figure out which key byte corresponds
-		#  increment that key byte
-		#  if we wrapped a byte all the way around, fail :(
-		#
-
-		loop do
-			# ok, try to encode it, any bad chars present?
-			pos = _check(data, key, badchars)
-
-			# yay, no problems, we found a key!
-			break if !pos
-
-			strip = pos % ksize
-
-			# increment the offending key byte
-			key[strip] = key[strip] + 1 & 0xff
-
-			# We wrapped around!
-			if key[strip] == kstart[strip]
-				raise KeySearchError, "Key space exhausted on strip #{strip}!", caller
-			end
-		end
-
-		return key
-	end
-
-end end end end # DwordAdditive/Xor/Encoding/Rex
-

data/lib/rex/encoding/xor/dword_additive.rb.ut.rb

@@ -1,15 +0,0 @@
-#!/usr/bin/env ruby
-
-$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
-
-require 'rex/encoding/xor/dword_additive'
-require 'rex/encoding/xor/byte.rb.ut'
-
-module Rex::Encoding::Xor
-class DwordAdditive::UnitTest < Byte::UnitTest
-
-	def enc
-		DwordAdditive
-	end
-end
-end

data/lib/rex/encoding/xor/exceptions.rb

@@ -1,17 +0,0 @@
-#!/usr/bin/env ruby
-
-module Rex
-module Encoding
-module Xor
-
-module Exception
-
-end
-
-class KeySearchError < ::Exception
-	include Exception
-	MSG = "Error finding a key."
-end
-
-end end end
-

data/lib/rex/encoding/xor/generic.rb

@@ -1,146 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rex/encoding/xor/exceptions'
-require 'rex/text'
-
-module Rex
-module Encoding
-module Xor
-
-class Generic
-
-	def Generic.keysize
-		# special case:
-		# 0 means we encode based on the length of the key
-		# we don't enforce any perticular key length
-		return 0
-	end
-
-	#
-	# Now for some internal check methods
-	#	
-
-	# hook stylies!
-	# return index of offending byte or nil
-	def Generic._check(data, key, badchars)
-		return _check_key(key, badchars) || _check_encode(data, key, badchars)
-	end
-	def Generic._check_key(key, badchars)
-		return Rex::Text.badchar_index(key, badchars)
-	end
-	def Generic._check_encode(data, key, badchars)
-		return Rex::Text.badchar_index(encode(data, key), badchars)
-	end
-
-	def Generic.find_key(data, badchars)
-		return _find_good_key(data, _find_bad_keys(data, badchars), badchars)
-	end
-
-	# !!! xxx MAKE THESE BITCHE PRIVATE
-
-	#
-	# Find a list of bytes that can't be valid xor keys, from the data and badchars.
-	# This returns a Array of hashes, length keysize
-	#
-	def Generic._find_bad_keys(data, badchars)
-
-		ksize = keysize
-
-		# array of hashes for the bad characters based
-		# on their position in the data
-		badkeys = [ ]
-		ksize.times { badkeys << { } }
-
-		badchars.each_byte { |badchar|
-			pos = 0
-			data.each_byte { |char|
-				badkeys[pos % ksize][char ^ badchar] = true
-				pos += 1
-			}
-		}
-
-		return badkeys
-	end
-
-	#
-	# (Hopefully) find a good key, from badkeys and badchars
-	#
-	def Generic._find_good_key(data, badkeys, badchars)
-
-		ksize = keysize
-		strip = 0
-		key   = ""
-
-		while strip < keysize
-
-			kbyte = rand(256)
-
-			catch(:found_kbyte) do
-				256.times {
-
-					if !badkeys[strip][kbyte] && !badchars[kbyte.chr]
-						throw :found_kbyte
-					end
-					
-					kbyte = (kbyte + 1) & 0xff
-				}
-
-				raise KeySearchError, "Exhausted byte space for strip #{strip}!", caller
-			end
-
-			key << kbyte
-			strip += 1
-		end
-
-		# ok, we should have a good key now, lets double check...
-		if _check(data, key, badchars)
-			raise KeySearchError, "Key found, but bad character check failed!", caller
-		end
-
-		return key
-	end
-
-	def Generic.encode(buf, key)
-
-		if !key.kind_of?(String)
-			raise ::ArgumentError, "Key must be a string!", caller
-		end
-
-		len = key.length
-
-		if len == 0
-			raise ::ArgumentError, "Zero key length!", caller
-		end
-
-		if keysize != 0 && keysize != len
-			raise ::ArgumentError, "Key length #{len}, expected #{keysize}", caller
-		end
-
-		encoded = ""
-		pos     = 0
-
-		while pos < buf.length
-			encoded += (buf[pos,1].unpack("C*")[0] ^ key[pos % len, 1].unpack("C*")[0]).chr
-			key = _encode_mutate_key(buf, key, pos, len)
-			pos += 1
-		end
-
-		return [ encoded, key ]
-
-	end
-
-	# kind of ghetto, but very convenient for mutating keys
-	# by default, do no key mutations
-	def Generic._encode_mutate_key(buf, key, pos, len)
-		return key
-	end
-
-	# maybe a bit a smaller of method name?
-	def Generic.find_key_and_encode(data, badchars)
-		key        = find_key(data, badchars)
-		enc, fkey  = encode(data, key)
-		return [ enc, key, fkey ]
-	end
-
-
-end end end end # Generic/Xor/Encoding/Rex