{

char Character;

State* NextState;

{

string Data = "";

bool Process = false;

vector<Transform> Transforms;

string Name;

void(*ProcessStateData)(string);

{

string Name;

string DLL;

{

DeclaredFunction Function;

Function.Name = p_sFunctionName;

AllDeclaredFunctions.push_back(Function);

{

AllDeclaredFunctions[AllDeclaredFunctionsNr].DLL = p_sDLLName;

AllDeclaredFunctionsNr++;

{

size_t Type;

size_t IntValue;

string StringValue;

{

string Name;

vector<Parameter> Parameters;

{

FunctionCall Function;

Function.Name = p_sFunctionName;

AllFunctionCalls.push_back(Function);

if (FirstFunctionCall) FirstFunctionCall = false;

else AllFunctionCallsNr++;

{

Parameter Param;

Param.Type = PARAMETER_TYPE_INT;

Param.IntValue = (size_t)stoll(p_sIntParameter);

AllFunctionCalls[AllFunctionCallsNr].Parameters.push_back(Param);

{

Parameter Param;

Param.Type = PARAMETER_TYPE_STRING;

Param.StringValue = p_sStringParameter;

AllFunctionCalls[AllFunctionCallsNr].Parameters.push_back(Param);

{

for (size_t i = 0; i < AllDeclaredFunctions.size(); i++)

if (AllDeclaredFunctions[i].Name.compare(p_sFunctionName) == 0) return true;

return false;

{

cout << endl;

for (size_t i = 0; i < AllDeclaredFunctions.size(); i++)

{

cout << "Declared:" << AllDeclaredFunctions[i].Name << " @ " << AllDeclaredFunctions[i].DLL << endl;

}

cout << endl;

for (size_t i = 0; i < AllFunctionCalls.size(); i++)

{

cout << "Call function: " << AllFunctionCalls[i].Name << endl;

for (size_t j = 0; j < AllFunctionCalls[i].Parameters.size(); j++)

{

cout << ((AllFunctionCalls[i].Parameters[j].Type == PARAMETER_TYPE_STRING) ? "String" : "Int") << " parameter: ";

if (AllFunctionCalls[i].Parameters[j].Type == PARAMETER_TYPE_STRING) cout << AllFunctionCalls[i].Parameters[j].StringValue << endl;

else cout << AllFunctionCalls[i].Parameters[j].IntValue << endl;

}

}

cout << endl;

{

FILE* f = fopen(p_sOutputFile.c_str(), "ab");

// Write

fwrite(p_sData.c_str(), p_sData.length(), sizeof(char), f);

// Close

fclose(f);

{

stringstream ss;

ss << hex << (int)p_cChar;

string mystr = ss.str();

return mystr;

{

string sContent =

"; Shellcode generated using Shellcode Compiler \r\n"

"; https://github.com/NytroRST/ShellcodeCompiler \r\n\r\n"

"BITS 32 \r\n"

"SECTION .text \r\n"

"global main \r\n"

"main: \r\n\r\n"

"xor ecx, ecx \r\n"

"mov eax, [fs:ecx + 0x30] ; EAX = PEB \r\n"

"mov eax, [eax + 0xc] ; EAX = PEB->Ldr \r\n"

"mov esi, [eax + 0x14] ; ESI = PEB->Ldr.InMemOrder \r\n"

"lodsd ; EAX = Second module \r\n"

"xchg eax, esi ; EAX = ESI, ESI = EAX \r\n"

"lodsd ; EAX = Third(kernel32) \r\n"

"mov ebx, [eax + 0x10] ; EBX = Base address \r\n"

"mov edx, [ebx + 0x3c] ; EDX = DOS->e_lfanew \r\n"

"add edx, ebx ; EDX = PE Header \r\n"

"mov edx, [edx + 0x78] ; EDX = Offset export table \r\n"

"add edx, ebx ; EDX = Export table \r\n"

"mov esi, [edx + 0x20] ; ESI = Offset namestable \r\n"

"add esi, ebx ; ESI = Names table \r\n"

"xor ecx, ecx ; EXC = 0 \r\n\r\n"

"Get_Function: \r\n\r\n"

"inc ecx ; Increment the ordinal \r\n"

"lodsd ; Get name offset \r\n"

"add eax, ebx ; Get function name \r\n"

"cmp dword [eax], 0x50746547 ; GetP \r\n"

"jnz Get_Function \r\n"

"cmp dword [eax + 0x4], 0x41636f72 ; rocA \r\n"

"jnz Get_Function \r\n"

"cmp dword [eax + 0x8], 0x65726464 ; ddre \r\n"

"jnz Get_Function \r\n"

"mov esi, [edx + 0x24] ; ESI = Offset ordinals \r\n"

"add esi, ebx ; ESI = Ordinals table \r\n"

"mov cx, [esi + ecx * 2] ; Number of function \r\n"

"dec ecx \r\n"

"mov esi, [edx + 0x1c] ; Offset address table \r\n"

"add esi, ebx ; ESI = Address table \r\n"

"mov edx, [esi + ecx * 4] ; EDX = Pointer(offset) \r\n"

"add edx, ebx ; EDX = GetProcAddress \r\n\r\n"

"xor ecx, ecx ; ECX = 0 \r\n"

"push ebx ; Kernel32 base address \r\n"

"push edx ; GetProcAddress \r\n"

"push ecx ; 0 \r\n"

"push 0x41797261 ; aryA \r\n"

"push 0x7262694c ; Libr \r\n"

"push 0x64616f4c ; Load \r\n"

"push esp ; LoadLibrary \r\n"

"push ebx ; Kernel32 base address \r\n"

"call edx ; GetProcAddress(LL) \r\n\r\n"

"add esp, 0xc ; pop LoadLibrary \r\n"

"pop ecx ; ECX = 0 \r\n"

"push eax ; EAX = LoadLibrary \r\n\r\n";

return sContent;

{

string Name;

size_t Offset;

{

DLLBase kernel;

kernel.Name = "kernel32.dll";

kernel.Offset = 1;

DLLOffsets.push_back(kernel);

{

for (size_t i = 0; i < DLLOffsets.size(); i++)

if (DLLOffsets[i].Name.compare(p_sDLLName) == 0) return true;

return false;

{

DLLBase dll;

// Check if DLL already exists

if (DLLBaseExists(p_sDLLName)) return;

dll.Name = p_sDLLName;

dll.Offset = CurrentDLLIOffset;

DLLOffsets.push_back(dll);

CurrentDLLIOffset++;

{

for (size_t i = 0; i < DLLOffsets.size(); i++)

if (DLLOffsets[i].Name.compare(p_sDLLName) == 0) return DLLOffsets[i].Offset;

cout << "Error: Cannot find DLL base index for " << p_sDLLName << endl;

return 0;

{

string Name;

size_t Offset;

{

for (size_t i = 0; i < FunctionOffsets.size(); i++)

if (FunctionOffsets[i].Name.compare(p_sFunctionName) == 0) return true;

return false;

{

FunctionOffset func;

// Check if DLL already exists

if (FunctionOffsetExists(p_sFunctionName)) return;

func.Name = p_sFunctionName;

func.Offset = CurrentFunctionOffset;

FunctionOffsets.push_back(func);

CurrentFunctionOffset++;

{

for (size_t i = 0; i < FunctionOffsets.size(); i++)

if (FunctionOffsets[i].Name.compare(p_sFunctionName) == 0) return FunctionOffsets[i].Offset;

cout << "Error: Cannot find function offset for " << p_sFunctionName << endl;

return 0;

{

string Name;

size_t Offset;

{

for (size_t i = 0; i < StringOffsets.size(); i++)

if (StringOffsets[i].Name.compare(p_sString) == 0) return true;

return false;

{

StringOffset str;

// Check if string already exists

if (StringOffsetExists(p_sString)) return;

str.Name = p_sString;

str.Offset = CurrentStringOffset;

StringOffsets.push_back(str);

{

for (size_t i = 0; i < StringOffsets.size(); i++)

if (StringOffsets[i].Name.compare(p_sString) == 0) return StringOffsets[i].Offset;

cout << "Error: Cannot find string offset for " << p_sString << endl;

return 0;

{

std::stringstream stream;

stream << std::hex << p_iNumber;

std::string result(stream.str());

return result;

{

string sContent = "";

size_t Len = p_sDLLName.length();

// Check if the DLL was already loades

if (DLLBaseExists(p_sDLLName)) return "";

if (Len % 4 == 0)

{

sContent = "xor eax, eax ; EAX = 0 \r\n";

sContent += "push eax ; NULL on the stack \r\n";

}

else if (Len % 4 == 1)

{

sContent = "xor eax, eax\r\n";

sContent += "mov al, 0x";

sContent += CharToHexString(p_sDLLName[Len - 1]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 2)

{

sContent = "xor eax, eax\r\n";

sContent += "mov ax, 0x";

sContent += CharToHexString(p_sDLLName[Len - 1]);

sContent += CharToHexString(p_sDLLName[Len - 2]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 3)

{

sContent = "xor eax, eax\r\n";

sContent += "mov eax, 0x23";

sContent += CharToHexString(p_sDLLName[Len - 1]);

sContent += CharToHexString(p_sDLLName[Len - 2]);

sContent += CharToHexString(p_sDLLName[Len - 3]);

sContent += "\r\n";

sContent += "push eax\r\n";

sContent += "sub dword [esp + 3], 0x23\r\n";

}

else cout << "Imaginary number?" << endl;

// Put the string as hex data pushes on the stack

size_t Times = Len / 4;

for (size_t i = Times; i > 0; i--)

{

sContent += "push 0x";

for (size_t j = 4; j > 0; j--)

{

sContent += CharToHexString(p_sDLLName[i * 4 - 4 + j - 1]);

}

sContent += "\r\n";

}

// LoadLibrary function call

sContent += "push esp ; String on the stack \r\n";

sContent += "call dword [esp + ";

sContent += to_string(((Times + 2) * 4) + NrBasesToStack * 4);

sContent += "]\r\n";

sContent += "add esp, ";

sContent += to_string(((Times + 1) * 4));

sContent += "\r\n";

sContent += "push eax ; DLL base on the stack \r\n\r\n";

// Add DLL to base list and increment bases on stack number

AddDLLBase(p_sDLLName);

NrBasesToStack++;

return sContent;

{

string sContent = "";

size_t Len = p_sFunctionName.length();

// Check if the function address was already found

if (FunctionOffsetExists(p_sFunctionName)) return "";

if (Len % 4 == 0)

{

sContent = "xor eax, eax ; EAX = 0 \r\n";

sContent += "push eax ; NULL on the stack \r\n";

}

else if (Len % 4 == 1)

{

sContent = "xor eax, eax\r\n";

sContent += "mov al, 0x";

sContent += CharToHexString(p_sFunctionName[Len - 1]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 2)

{

sContent = "xor eax, eax\r\n";

sContent += "mov ax, 0x";

sContent += CharToHexString(p_sFunctionName[Len - 1]);

sContent += CharToHexString(p_sFunctionName[Len - 2]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 3)

{

sContent = "xor eax, eax\r\n";

sContent += "mov eax, 0x23";

sContent += CharToHexString(p_sFunctionName[Len - 1]);

sContent += CharToHexString(p_sFunctionName[Len - 2]);

sContent += CharToHexString(p_sFunctionName[Len - 3]);

sContent += "\r\n";

sContent += "push eax\r\n";

sContent += "sub dword [esp + 3], 0x23\r\n";

}

else cout << "Imaginary number?" << endl;

// Put the string as hex data pushes on the stack

size_t Times = Len / 4;

for (size_t i = Times; i > 0; i--)

{

sContent += "push 0x";

for (size_t j = 4; j > 0; j--)

{

sContent += CharToHexString(p_sFunctionName[i * 4 - 4 + j - 1]);

}

sContent += "\r\n";

}

// LoadLibrary function call

sContent += "push esp ; String on the stack \r\n";

sContent += "push dword [esp + ";

sContent += to_string((NrFunctionsToStack * 4) + ((NrBasesToStack + 3 - GetDLLBase(p_sDLLName)) * 4) + ((Times + 2) * 4));

sContent += "] \r\n";

// Call GetProcAddress

sContent += "call dword [esp + ";

sContent += to_string(((NrFunctionsToStack + 1) * 4) + ((NrBasesToStack + 1) * 4) + ((Times + 2) * 4));

sContent += "]\r\n";

sContent += "add esp, ";

sContent += to_string(((Times + 1) * 4));

sContent += "\r\n";

sContent += "push eax ; Function address on the stack \r\n\r\n";

// Add function address to the list and increment nr of functions on stack number

AddFunctionOffset(p_sFunctionName);

NrFunctionsToStack++;

// Do it!

return sContent;

{

string sContent = "";

size_t Len = p_sString.length();

// Check if the string was already on the stack

if (StringOffsetExists(p_sString)) return "";

if (Len % 4 == 0)

{

sContent = "xor eax, eax ; EAX = 0 \r\n";

sContent += "push eax ; NULL on the stack \r\n";

}

else if (Len % 4 == 1)

{

sContent = "xor eax, eax\r\n";

sContent += "mov al, 0x";

sContent += CharToHexString(p_sString[Len - 1]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 2)

{

sContent = "xor eax, eax\r\n";

sContent += "mov ax, 0x";

sContent += CharToHexString(p_sString[Len - 1]);

sContent += CharToHexString(p_sString[Len - 2]);

sContent += "\r\n";

sContent += "push eax\r\n";

}

else if (Len % 4 == 3)

{

sContent = "xor eax, eax\r\n";

sContent += "mov eax, 0x23";

sContent += CharToHexString(p_sString[Len - 1]);

sContent += CharToHexString(p_sString[Len - 2]);

sContent += CharToHexString(p_sString[Len - 3]);

sContent += "\r\n";

sContent += "push eax\r\n";

sContent += "sub dword [esp + 3], 0x23\r\n";

}

else cout << "Imaginary number?" << endl;

// Put the string as hex data pushes on the stack

size_t Times = Len / 4;

for (size_t i = Times; i > 0; i--)

{

sContent += "push 0x";

for (size_t j = 4; j > 0; j--)

{

sContent += CharToHexString(p_sString[i * 4 - 4 + j - 1]);

}

sContent += "\r\n";

}

// Add dtring offset

sContent += "push esp\r\n\r\n";

CurrentStringOffset = CurrentStringOffset + Times + 2;

AddStringOffset(p_sString);

return sContent;

{

string sContent = "";

size_t NrParam = p_oFunctionCall.Parameters.size();

size_t CurrentParamNr = 1;

// First, put all string parameters on the stack

for (size_t i = 0; i < p_oFunctionCall.Parameters.size(); i++)

if (p_oFunctionCall.Parameters[i].Type == PARAMETER_TYPE_STRING) sContent += GeneratePutStringToStack(p_oFunctionCall.Parameters[i].StringValue);

// Parse all arguments (from the end)

for (size_t i = NrParam - 1; ; i--)

{

if (p_oFunctionCall.Parameters[i].Type == PARAMETER_TYPE_STRING)

{

sContent += "push dword [ESP + ";

sContent += to_string(((CurrentParamNr - 1) * 4) + ((CurrentStringOffset - GetStringOffset(p_oFunctionCall.Parameters[i].StringValue)) * 4));

sContent += "]\r\n";

}

else if (p_oFunctionCall.Parameters[i].Type == PARAMETER_TYPE_INT)

{

// If int parameter is 0, avoid NULL

if (p_oFunctionCall.Parameters[i].IntValue == 0)

{

sContent += "xor eax, eax\r\n";

sContent += "push eax\r\n";

}

else

{

sContent += "push 0x";

sContent += IntToHexString(p_oFunctionCall.Parameters[i].IntValue);

sContent += "\r\n";

}

}

else cout << "Error: Undefined parameter type!" << endl;

CurrentParamNr++;

if (i == 0) break;

}

// Call function

sContent += "call dword [ESP + ";

sContent += to_string(((NrParam - 1) * 4) + (CurrentStringOffset * 4) + ((CurrentFunctionOffset - GetFunctionOffset(p_oFunctionCall.Name)) * 4));

sContent += "]\r\n";

// Clean string parameters

if (CurrentStringOffset > 0)

{

sContent += "add ESP, ";

sContent += to_string(CurrentStringOffset * 4);

sContent += "\r\n";

}

// Clean global strings data

CurrentStringOffset = 0;

StringOffsets.clear();

return sContent;

{

return (p_cCharacter >= 32 && p_cCharacter <= 126 &&

p_cCharacter != '"' && p_cCharacter != ')' && p_cCharacter != '(' && p_cCharacter != ',');

{

char buffer[1024];

string sContent = "";

DWORD r = GetTempPath(1024, buffer);

if (r == 0) return "";

sContent = buffer;

return sContent;

{

char buffer[1024];

string sContent = "";

DWORD r = GetCurrentDirectory(1024, buffer);

if (r == 0) return "";

sContent = buffer;

return sContent;

{

DWORD dwAttrib = GetFileAttributes(p_sPath.c_str());

return (dwAttrib != INVALID_FILE_ATTRIBUTES);

{

string contents = "";

FILE* f = fopen(p_sFilename.c_str(), "rb");

// Get file size

fseek(f, 0, SEEK_END);

size_t size = ftell(f);

char* cdata = new char[size + 1];

cdata[size] = '\0';

// Read file

rewind(f);

fread(cdata, sizeof(char), size, f);

fclose(f);

// Return data

contents = cdata;

delete[] cdata;

return contents;

{

size_t size;

FILE* f = fopen(p_sFilename.c_str(), "rb");

// Get file size

fseek(f, 0, SEEK_END);

size = ftell(f);

rewind(f);

fclose(f);

return size;

{

unsigned char *p = NULL;

size_t size = 0;

p = ReadBinaryFile(p_sFilename, &size);

// Check if successful read

if (size == 0 || p == NULL)

{

cout << "Error: Cannot read shellcode file!" << endl;

return;

}

// Get space for shellcode

void *sc = VirtualAlloc(0, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

if (sc == NULL)

{

cout << "Error: Cannot allocate space for shellcode!" << endl;

return;

}

// Copy shellcode and execute it

memcpy(sc, p, size);

(*(int(*)()) sc)();

{

bool result = true;

string sReadString = "";

State CurrentState;

for (size_t i = 0; i < p_sFileData.length(); i++)

{

// Check for a string

if (isalnum(p_sFileData[i]))

{

sReadString += p_sFileData[i];

}

// If it is not an alphanumeric character

else

{

// We have a "function" definition

if (sReadString.compare("function") == 0)

{

CurrentState = DF_function;

// PROCESS "function" - Declare a function

while (true)

{

// Parse states transforms

for (size_t s = 0; s < CurrentState.Transforms.size(); s++)

{

if (CurrentState.Transforms[s].Character == p_sFileData[i])

{

//cout << "We found a transform (" << i << "): " << p_sFileData[i] << " [" << (int)p_sFileData[i] << "] - Current state: " << CurrentState.Name << endl;

// Process state

if (CurrentState.Process)

{

// Do stuff

CurrentState.ProcessStateData(CurrentState.Data);

CurrentState.Data = "";

}

// Go to next state

CurrentState = *(CurrentState.Transforms[s].NextState);

//cout << "Moved to state: " << CurrentState.Name << endl;

break;

}

else if (CurrentState.Transforms[s].Character == CHR_READ_ALPHANUMSTR && IsString(p_sFileData[i]))