Merge pull request chvancooten#8 from A1vinSmith/main

Add: VBA print format for XOR shellcode encoder
Yanko-OC · Jan 4, 2024 · 43b929e · 43b929e
2 parents fd265a4 + f8367de
commit 43b929e
Showing 1 changed file with 57 additions and 20 deletions.
diff --git a/XOR Shellcode Encoder/Program.cs b/XOR Shellcode Encoder/Program.cs
@@ -55,35 +55,72 @@ public static void Main(string[] args)
                 encoded[i] = (byte)((uint)buf[i] ^ 0xfa);
             }
 
-            StringBuilder hex = new StringBuilder(encoded.Length * 2);
-            int totalCount = encoded.Length;
-            for (int count = 0; count < totalCount; count++)
-            {
-                byte b = encoded[count];
+            StringBuilder hex;
 
-                if ((count + 1) == totalCount) // Dont append comma for last item
+            if (args.Length > 0)
+            {
+                switch (args[0])
                 {
-                    hex.AppendFormat("0x{0:x2}", b);
+                    case "-VBA":
+                        // Printout VBA payload
+                        uint counter = 0;
+
+                        hex = new StringBuilder(encoded.Length * 2);
+                        foreach (byte b in encoded)
+                        {
+                            hex.AppendFormat("{0:D3}, ", b);
+                            counter++;
+                            if (counter % 25 == 0)
+                            {
+                                hex.Append("_\n");
+                            }
+                        }
+                        Console.WriteLine($"XORed VBA payload (key: 0xfa):");
+                        Console.WriteLine(hex.ToString());
+                        break;
+                    default:
+                        Console.WriteLine("Accepted arguments: -VBA to print VBA payload instead of C#");
+                        break;
                 }
-                else
+            }
+            else
+            {
+                // Printout C# payload
+                hex = new StringBuilder(encoded.Length * 2);
+                int totalCount = encoded.Length;
+                for (int count = 0; count < totalCount; count++)
                 {
-                    hex.AppendFormat("0x{0:x2}, ", b);
-                }
+                    byte b = encoded[count];
 
-                if ((count + 1) % 15 == 0)
-                {
-                    hex.Append("\n");
+                    if ((count + 1) == totalCount) // Dont append comma for last item
+                    {
+                        hex.AppendFormat("0x{0:x2}", b);
+                    }
+                    else
+                    {
+                        hex.AppendFormat("0x{0:x2}, ", b);
+                    }
+
+                    if ((count + 1) % 15 == 0)
+                    {
+                        hex.Append("\n");
+                    }
                 }
+
+                Console.WriteLine($"XORed C# payload (key: 0xfa):");
+                Console.WriteLine($"byte[] buf = new byte[{buf.Length}] {{\n{hex}\n}};");
             }
 
-            Console.WriteLine($"XOR payload (key: 0xfa):");
-            Console.WriteLine($"byte[] buf = new byte[{buf.Length}] {{\n{hex}\n}};");
 
-            //// Decode the XOR payload
-            //for (int i = 0; i < buf.Length; i++)
-            //{
-            //    buf[i] = (byte)((uint)buf[i] ^ 0xfa);
-            //}
+
+
+            // Decode the XOR payload
+            /*
+            for (int i = 0; i < buf.Length; i++)
+            {
+                buf[i] = (byte)((uint)buf[i] ^ 0xfa);
+            }
+            */
 
         }
     }