So i was working on a simple payload encryption using xor project
here is the code
#include <Windows.h>
#include <stdio.h>
#include "resource.h"
VOID XorByOneKey(IN PBYTE pShellCode, IN SIZE_T sShellCodeSize, IN BYTE bKey) {
for (size_t i = 0; i < sShellCodeSize; i++) {
pShellCode[i] = pShellCode[i] ^ bKey;
}
}
int main() {
HRSRC hRsrc = NULL;
HGLOBAL hGlobal = NULL;
PVOID pPayloadAddress = NULL;
SIZE_T sPayloadSize = NULL;
// Get the location to the data stored in .rsrc by its id *IDR_RCDATA1*
hRsrc = FindResourceW(NULL, MAKEINTRESOURCEW(IDR_RCDATA1), RT_RCDATA);
if (hRsrc == NULL) {
// in case of function failure
printf("[!] FindResourceW Failed with Error : %d\n", GetLastError());
return EXIT_FAILURE;
}
// Get the handle of the specified resource data since it is required to lock resource later
hGlobal = LoadResource(NULL, hRsrc);
if (hGlobal == NULL) {
// in case of function failure
printf("[!] LoadResource Failed with Error : %d\n", GetLastError());
return EXIT_FAILURE;
}
// Get the address of our payload in .rsrc section
pPayloadAddress = LockResource(hGlobal);
if (pPayloadAddress == NULL) {
// in case of function failure
printf("[!] LockResource Failed With Error : %d\n", GetLastError());
return EXIT_FAILURE;
}
// Get the size of our payload in .rsrc section
sPayloadSize = SizeofResource(NULL, hRsrc);
if (sPayloadSize == NULL) {
// in case of function failure
printf("[!] SizeofResource Failed with Error : %d\n ", GetLastError());
return EXIT_FAILURE;
}
PVOID pTmpBuffer = HeapAlloc(GetProcessHeap(), 0, sPayloadSize);
if (pTmpBuffer != NULL) {
// copying the payload from the resource section
memcpy(pTmpBuffer, pPayloadAddress, sPayloadSize);
}
int i = 0;
XorByOneKey((PBYTE)pTmpBuffer, sPayloadSize, i);
// Printing the base address of the buffer
printf("[i] pTmpBuffer var : 0x%p \n", pTmpBuffer);
// Printing pointer and size to screen
printf("[i] sPayloadAddress var : 0x%p \n", pPayloadAddress);
printf("[i] sPayloadSize var : 0x%ld \n", sPayloadSize);
getchar();
return EXIT_SUCCESS;
}
However when i check the pTmpBuffer address using a debugger the shellcode their is not encrypted the shell code remains the same i have loaded the shellcode into the .rsrc section i am on Visual Studio 2022.
Any help would be appreciated
Tried moving the print message around to see if it was old but did not work
xor
with a zero key doesn't do anything.x ^ 0 == x
. That's not true for any other key value.