librex 0.0.18 → 0.0.19

data/lib/rex/encoders/xor_dword_additive.rb

@@ -0,0 +1,53 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoder/xor/dword_additive'
+
+##
+#
+# Jmp/Call Dword Additive Feedback Encoder
+# Author: skape
+# Arch:   x86
+#
+##
+module Rex
+module Encoders
+
+class XorDwordAdditive < Rex::Encoder::Xor::DwordAdditive
+	module Backend
+
+		def _unencoded_transform(data)
+			# check for any dword aligned zeros that would falsely terminate the decoder
+			idx = 0
+			while true
+				idx = data.index("\x00\x00\x00\x00", idx)
+				break if !idx
+				if idx & 3 == 0
+					raise RuntimeError, "Unencoded data cannot have a dword aligned 0 dword!", caller()
+				end
+				idx += 1
+			end
+
+			# pad to a dword boundary and append null dword for termination
+			data = data + ("\x00" * ((4 - data.length & 3) & 3)) + "\x00\x00\x00\x00"
+		end
+
+		def _prepend
+			"\xfc"                + # cld
+			"\xbb" + key          + # mov ebx, key
+			"\xeb\x0c"            + # jmp short 0x14
+			"\x5e"                + # pop esi
+			"\x56"                + # push esi
+			"\x31\x1e"            + # xor [esi], ebx
+			"\xad"                + # lodsd
+			"\x01\xc3"            + # add ebx, eax
+			"\x85\xc0"            + # test eax, eax
+			"\x75\xf7"            + # jnz 0xa
+			"\xc3"                + # ret
+			"\xe8\xef\xff\xff\xff"  # call 0x8
+		end
+	end
+
+	include Backend
+end
+
+end end

data/lib/rex/encoders/xor_dword_additive.rb.ut.rb

@@ -0,0 +1,12 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'dev', 'machinetest'))
+
+require 'test/unit'
+require 'rex/encoders/xor_dword_additive'
+require 'rex/encoders/xor_dword.rb.ut'
+
+class Rex::Encoders::XorDwordAdditive::UnitTest < Rex::Encoders::XorDword::UnitTest
+	Klass = Rex::Encoders::XorDwordAdditive
+end

data/lib/rex/encoding/xor.rb

@@ -0,0 +1,20 @@
+#!/usr/bin/env ruby
+
+#
+# make sure the namespace is created
+#
+
+module Rex
+module Encoding
+module Xor
+end end end
+
+#
+# include the Xor encodings
+#
+
+require 'rex/encoding/xor/generic'
+require 'rex/encoding/xor/byte'
+require 'rex/encoding/xor/word'
+require 'rex/encoding/xor/dword'
+require 'rex/encoding/xor/qword'

data/lib/rex/encoding/xor.rb.ts.rb

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..'))
+
+#
+# Xor Encoding Test Suite
+#
+
+require 'test/unit'
+require 'rex/encoding/xor/generic.rb.ut'
+require 'rex/encoding/xor/byte.rb.ut'
+require 'rex/encoding/xor/word.rb.ut'
+require 'rex/encoding/xor/dword.rb.ut'
+require 'rex/encoding/xor/dword_additive.rb.ut'

data/lib/rex/encoding/xor/byte.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/generic'
+
+module Rex
+module Encoding
+module Xor
+
+class Byte < Generic
+
+	def Byte.keysize
+		1
+	end
+
+end end end end # Byte/Xor/Encoding/Rex

data/lib/rex/encoding/xor/byte.rb.ut.rb

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/byte'
+require 'rex/encoding/xor/generic.rb.ut'
+
+#
+# I suck because I want to inherit a test case, but this will
+# also cause it to run the test case I'm inheriting, so this runs both the
+# Byte and Generic tests, oh well for now...
+#
+
+module Rex::Encoding::Xor
+class Byte::UnitTest < Generic::UnitTest
+
+	def enc
+		Byte
+	end
+end
+end

data/lib/rex/encoding/xor/dword.rb

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/generic'
+
+#
+# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
+# version used to pad this buffer out to a 2-byte boundary, but I can't think
+# of a good reason to do that anymore, so this doesn't.
+#
+
+module Rex
+module Encoding
+module Xor
+
+class Dword < Generic
+
+	def Dword.keysize
+		4
+	end
+
+end end end end # Dword/Xor/Encoding/Rex

data/lib/rex/encoding/xor/dword.rb.ut.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/dword'
+require 'rex/encoding/xor/byte.rb.ut'
+
+module Rex::Encoding::Xor
+class Dword::UnitTest < Byte::UnitTest
+
+	def enc
+		Dword
+	end
+end
+end

data/lib/rex/encoding/xor/dword_additive.rb

@@ -0,0 +1,92 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/exceptions'
+require 'rex/encoding/xor/generic'
+
+#
+# Routine for xor encoding a buffer by a 2-byte (intel word) key.  The perl
+# version used to pad this buffer out to a 2-byte boundary, but I can't think
+# of a good reason to do that anymore, so this doesn't.
+#
+
+module Rex
+module Encoding
+module Xor
+
+class DwordAdditive < Generic
+
+	def DwordAdditive.keysize
+		4
+	end
+
+	def DwordAdditive._packspec
+		'V'
+	end
+
+	def DwordAdditive.pack_key(key)
+		return [ key ].pack(_packspec)
+	end
+	def DwordAdditive.unpack_key(key)
+		return key.unpack(_packspec)[0]
+	end
+
+	# hook in the key mutation routine of encode for the additive feedback
+	def DwordAdditive._encode_mutate_key(buf, key, pos, len)
+		if (pos + 1) % len == 0
+			# add the last len bytes (in this case 4) with the key,
+			# dropping off any overflow
+			key = pack_key(
+			  unpack_key(key) + unpack_key(buf[pos - (len - 1), len]) &
+			    (1 << (len << 3)) - 1
+			)
+		end
+
+		return key
+	end
+
+	#
+	# I realize this algorithm is broken.  We invalidate some keys
+	# in _find_bad_keys that could actually be perfectly fine.  However,
+	# it seems to work ok for now, and this is all just a lame adhoc method.
+	# Maybe someday we can revisit this and make it a bit less ghetto...
+	#
+
+	def DwordAdditive._find_good_key(data, badkeys, badchars)
+
+		ksize  = keysize
+		kstart = ""
+		ksize.times { kstart << rand(256) } # random key starting place
+
+		key = kstart.dup
+
+		#
+		# now for the ghettoness of an algorithm:
+		#  try the random key we picked
+		#  if the key failed, figure out which key byte corresponds
+		#  increment that key byte
+		#  if we wrapped a byte all the way around, fail :(
+		#
+
+		loop do
+			# ok, try to encode it, any bad chars present?
+			pos = _check(data, key, badchars)
+
+			# yay, no problems, we found a key!
+			break if !pos
+
+			strip = pos % ksize
+
+			# increment the offending key byte
+			key[strip] = key[strip] + 1 & 0xff
+
+			# We wrapped around!
+			if key[strip] == kstart[strip]
+				raise KeySearchError, "Key space exhausted on strip #{strip}!", caller
+			end
+		end
+
+		return key
+	end
+
+end end end end # DwordAdditive/Xor/Encoding/Rex
+

data/lib/rex/encoding/xor/dword_additive.rb.ut.rb

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..'))
+
+require 'rex/encoding/xor/dword_additive'
+require 'rex/encoding/xor/byte.rb.ut'
+
+module Rex::Encoding::Xor
+class DwordAdditive::UnitTest < Byte::UnitTest
+
+	def enc
+		DwordAdditive
+	end
+end
+end

data/lib/rex/encoding/xor/exceptions.rb

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+
+module Rex
+module Encoding
+module Xor
+
+module Exception
+
+end
+
+class KeySearchError < ::Exception
+	include Exception
+	MSG = "Error finding a key."
+end
+
+end end end
+

data/lib/rex/encoding/xor/generic.rb

@@ -0,0 +1,146 @@
+#!/usr/bin/env ruby
+
+require 'rex/encoding/xor/exceptions'
+require 'rex/text'
+
+module Rex
+module Encoding
+module Xor
+
+class Generic
+
+	def Generic.keysize
+		# special case:
+		# 0 means we encode based on the length of the key
+		# we don't enforce any perticular key length
+		return 0
+	end
+
+	#
+	# Now for some internal check methods
+	#	
+
+	# hook stylies!
+	# return index of offending byte or nil
+	def Generic._check(data, key, badchars)
+		return _check_key(key, badchars) || _check_encode(data, key, badchars)
+	end
+	def Generic._check_key(key, badchars)
+		return Rex::Text.badchar_index(key, badchars)
+	end
+	def Generic._check_encode(data, key, badchars)
+		return Rex::Text.badchar_index(encode(data, key), badchars)
+	end
+
+	def Generic.find_key(data, badchars)
+		return _find_good_key(data, _find_bad_keys(data, badchars), badchars)
+	end
+
+	# !!! xxx MAKE THESE BITCHE PRIVATE
+
+	#
+	# Find a list of bytes that can't be valid xor keys, from the data and badchars.
+	# This returns a Array of hashes, length keysize
+	#
+	def Generic._find_bad_keys(data, badchars)
+
+		ksize = keysize
+
+		# array of hashes for the bad characters based
+		# on their position in the data
+		badkeys = [ ]
+		ksize.times { badkeys << { } }
+
+		badchars.each_byte { |badchar|
+			pos = 0
+			data.each_byte { |char|
+				badkeys[pos % ksize][char ^ badchar] = true
+				pos += 1
+			}
+		}
+
+		return badkeys
+	end
+
+	#
+	# (Hopefully) find a good key, from badkeys and badchars
+	#
+	def Generic._find_good_key(data, badkeys, badchars)
+
+		ksize = keysize
+		strip = 0
+		key   = ""
+
+		while strip < keysize
+
+			kbyte = rand(256)
+
+			catch(:found_kbyte) do
+				256.times {
+
+					if !badkeys[strip][kbyte] && !badchars[kbyte.chr]
+						throw :found_kbyte
+					end
+					
+					kbyte = (kbyte + 1) & 0xff
+				}
+
+				raise KeySearchError, "Exhausted byte space for strip #{strip}!", caller
+			end
+
+			key << kbyte
+			strip += 1
+		end
+
+		# ok, we should have a good key now, lets double check...
+		if _check(data, key, badchars)
+			raise KeySearchError, "Key found, but bad character check failed!", caller
+		end
+
+		return key
+	end
+
+	def Generic.encode(buf, key)
+
+		if !key.kind_of?(String)
+			raise ::ArgumentError, "Key must be a string!", caller
+		end
+
+		len = key.length
+
+		if len == 0
+			raise ::ArgumentError, "Zero key length!", caller
+		end
+
+		if keysize != 0 && keysize != len
+			raise ::ArgumentError, "Key length #{len}, expected #{keysize}", caller
+		end
+
+		encoded = ""
+		pos     = 0
+
+		while pos < buf.length
+			encoded += (buf[pos,1].unpack("C*")[0] ^ key[pos % len, 1].unpack("C*")[0]).chr
+			key = _encode_mutate_key(buf, key, pos, len)
+			pos += 1
+		end
+
+		return [ encoded, key ]
+
+	end
+
+	# kind of ghetto, but very convenient for mutating keys
+	# by default, do no key mutations
+	def Generic._encode_mutate_key(buf, key, pos, len)
+		return key
+	end
+
+	# maybe a bit a smaller of method name?
+	def Generic.find_key_and_encode(data, badchars)
+		key        = find_key(data, badchars)
+		enc, fkey  = encode(data, key)
+		return [ enc, key, fkey ]
+	end
+
+
+end end end end # Generic/Xor/Encoding/Rex