modules/illScrappy/metasploit-framework/modules/encoders/r3Evolve.rb
#!!!! data is always the same size as the register in [], so it would be [ax + 0x4142]
# and never [ax + 0x41]
# also, I need to combine more, so it could hold up to 3 registers and 1 num
# all math is pre-calculated by the nasm compiler
data is always the same size as the register in [], so it would be [ax + 0x4142]
and never [ax + 0x41]
also, I need to combine more, so it could hold up to 3 registers and 1 num
all math is pre-calculated by the nasm compiler
data is always the same size as the register in [] so it would be [ ax + 0x4142 ] and never [ ax + 0x41 ] also I need to combine more so it could hold up to 3 registers and 1 num all math is pre - calculated by the nasm compiler
def prep_lea(reg1,reg2)
					def calc_lea(reg1,reg2)
						data = get_bytes(@reg_div)
						size = reg_size(data)
						def rand_data(data,size)
							if $ac == 'x64'
								while size == 0 or size == 3 or (size == 1 and data.to_i(16) >= 2147483647)
									data = get_bytes(@reg_div)
									size = reg_size(data)
								end
							elsif $ac == 'x86'
								while size == 2 or data.to_i(16) >= 2147483647
									data = get_bytes(@reg_div)
									size = reg_size(data)
									while size == -1
										data = get_bytes(@reg_div)
										size = reg_size(data)
									end
								end 
							end
							return data,size
						end
						rand_reg  = lambda {return $r.rand(0..$mr)}
						rand_size = lambda {if $ac == 'x64'; ms = 3; else ms = 2;end; return $r.rand(0..ms)}
						rand_op   = lambda {bit_mod = $r.rand(0..2); if bit_mod == 0; return ' - '; elsif bit_mod == 1; return ' * '; else return ' + '; end}
						data,size = rand_data(data,size)
						rand_op = rand_op.call
						if rand_op == ' * '
							tmp = $r.rand(0..2)
							if tmp == 0
								data = '2'
							elsif tmp == 1
								data = '4'
							else
								data = '8'
							end
						end
						tf = $r.rand(0..1)
						if tf == 0
							if $ac == 'x64'
								data = $reg[rand_reg.call][rand_size.call] + rand_op + data
							else
								data = $reg[rand_reg.call][0] + rand_op + data
							end
							@@junk = lea($reg[reg1][size], data)
						elsif  tf == 1
							@@junk = lea($reg[reg1][size], data)
						end
					end
					calc_lea(reg1,reg2)
					if $nni == false
						while ((con(@@junk)).unpack("H*").join.scan(/../).index('00')) != nil
							calc_lea(reg1,reg2)
						end
					end
				end
def prep_lea ( reg1 , reg2 ) def calc_lea ( reg1 , reg2 ) data = get_bytes ( @reg_div ) size = reg_size ( data ) def rand_data ( data , size ) if $ac == 'x64' while size == 0 or size == 3 or ( size == 1 and data . to_i ( 16 ) >= 2147483647 ) data = get_bytes ( @reg_div ) size = reg_size ( data ) end elsif $ac == 'x86' while size == 2 or data . to_i ( 16 ) >= 2147483647 data = get_bytes ( @reg_div ) size = reg_size ( data ) while size == - 1 data = get_bytes ( @reg_div ) size = reg_size ( data ) end end end return data , size end rand_reg = lambda { return $r . rand ( 0 .. $mr ) } rand_size = lambda { if $ac == 'x64' ; ms = 3 ; else ms = 2 ; end ; return $r . rand ( 0 .. ms ) } rand_op = lambda { bit_mod = $r . rand ( 0 .. 2 ) ; if bit_mod == 0 ; return ' - ' ; elsif bit_mod == 1 ; return ' * ' ; else return ' + ' ; end } data , size = rand_data ( data , size ) rand_op = rand_op . call if rand_op == ' * ' tmp = $r . rand ( 0 .. 2 ) if tmp == 0 data = '2' elsif tmp == 1 data = '4' else data = '8' end end tf = $r . rand ( 0 .. 1 ) if tf == 0 if $ac == 'x64' data = $reg [ rand_reg . call ] [ rand_size . call ] + rand_op + data else data = $reg [ rand_reg . call ] [ 0 ] + rand_op + data end @@junk = lea ( $reg [ reg1 ] [ size ] , data ) elsif tf == 1 @@junk = lea ( $reg [ reg1 ] [ size ] , data ) end end calc_lea ( reg1 , reg2 ) if $nni == false while ( ( con ( @@junk ) ) . unpack ( "H*" ) . join . scan ( / .. / ) . index ( '00' ) ) != nil calc_lea ( reg1 , reg2 ) end end end
data is always the same size as the register in [], so it would be [ax + 0x4142]
and never [ax + 0x41]
also, I need to combine more, so it could hold up to 3 registers and 1 num
all math is pre-calculated by the nasm compiler
data is always the same size as the register in [] so it would be [ ax + 0x4142 ] and never [ ax + 0x41 ] also I need to combine more so it could hold up to 3 registers and 1 num all math is pre - calculated by the nasm compiler
# size will be randomized later # can't lea a qword # can't lea a qword # !!! add a skew to what gets more, the [reg + data] or [data]
reg1
reg2