sgn

package
v0.0.0-...-f54fa65 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 22, 2024 License: MIT Imports: 10 Imported by: 2

Documentation

Index

Constants

View Source 
const INSTRUCTIONS string = `` /* 41918-byte string literal not displayed */

INSTRUCTIONS contains the ENTIRE x86/x64 instruction set

View Source 
const X64_DECODER_STUB = `` /* 135-byte string literal not displayed */

x64DecoderStub is base decoder assembly for 64 bit binaries

View Source 
const X86_DECODER_STUB = `` /* 155-byte string literal not displayed */

x86DecoderStub is base decoder assembly for 32 bit binaries

Variables

View Source 
var ConditionalJumpMnemonics = []string{
	"JAE",
	"JA",
	"JBE",
	"JB",
	"JC",
	"JE",
	"JGE",
	"JG",
	"JLE",
	"JL",
	"JNAE",
	"JNA",
	"JNBE",
	"JNB",
	"JNC",
	"JNE",
	"JNGE",
	"JNG",
	"JNLE",
	"JNL",
	"JNO",
	"JNP",
	"JNS",
	"JNZ",
	"JO",
	"JPE",
	"JPO",
	"JP",
	"JS",
	"JZ",
}

ConditionalJumpMnemonics contains the conditional branching instruction mnemonics

View Source 
var OPERANDS = []string{"XOR", "SUB", "ADD", "ROL", "ROR", "NOT"}

OPERANDS string array containing logical & arithmatic operands for encoding the decoder stub

View Source 
var REGS map[int][]REG

REGS contains 32/64 bit registers

View Source 
var STUB map[int]string

STUB will contain the decoder stub for the selected architecture Values will be set on init

View Source 
var SafeGarbageInstructions = []string{
	";",
	"NOP",
	"CLD",
	"CLC",
	"CMC",
	"WAIT",
	"FNOP",
	"FXAM",
	"FTST",
	"JMP 2",
	"ROL {R},0",
	"ROR {R},0",
	"SHL {R},0",
	"SHR {R},0",
	"RCL {R},0",
	"RCR {R},0",
	"SAL {R},0",
	"SAR {R},0",
	"XOR {R},0",
	"SUB {R},0",
	"ADD {R},0",
	"AND {R},{R}",
	"OR {R},{R}",
	"BT {R},{R}",
	"CMP {R},{R}",
	"MOV {R},{R}",
	"XCHG {R},{R}",
	"TEST {R},{R}",
	"CMOVA {R},{R}",
	"CMOVB {R},{R}",
	"CMOVC {R},{R}",
	"CMOVE {R},{R}",
	"CMOVG {R},{R}",
	"CMOVL {R},{R}",
	"CMOVO {R},{R}",
	"CMOVP {R},{R}",
	"CMOVS {R},{R}",
	"CMOVZ {R},{R}",
	"CMOVAE {R},{R}",
	"CMOVGE {R},{R}",
	"CMOVLE {R},{R}",
	"CMOVNA {R},{R}",
	"CMOVNB {R},{R}",
	"CMOVNC {R},{R}",
	"CMOVNE {R},{R}",
	"CMOVNG {R},{R}",
	"CMOVNL {R},{R}",
	"CMOVNO {R},{R}",
	"CMOVNP {R},{R}",
	"CMOVNS {R},{R}",
	"CMOVNZ {R},{R}",
	"CMOVPE {R},{R}",
	"CMOVPO {R},{R}",
	"CMOVBE {R},{R}",
	"CMOVNAE {R},{R}",
	"CMOVNBE {R},{R}",
	"CMOVNLE {R},{R}",
	"CMOVNGE {R},{R}",

	"JMP {L};{G};{L}:",
	"NOT {R};{G};NOT {R}",
	"NEG {R};{G};NEG {R}",
	"INC {R};{G};DEC {R}",
	"DEC {R};{G};INC {R}",

	"ADD {R},{K};{G};SUB {R},{K}",
	"SUB {R},{K};{G};ADD {R},{K}",
	"ROR {R},{K};{G};ROL {R},{K}",
	"ROL {R},{K};{G};ROR {R},{K}",
}

SafeGarbageInstructions array containing safe garbage instructions that does not munipulate registers or stack (do not affect the overall execution of the program) !!! These instructions must not clobber registers or stack flags may be affected !!!

View Source 
var SafeRegisterPrefix map[int]([]byte)

SafeRegisterPrefix contains the instructions for saving registers to stack

View Source 
var SafeRegisterSuffix map[int]([]byte)

SafeRegisterSuffix contains the instructions for restoring registers from stack

View Source 
var SupportedOperandTypes = []string{
	"imm8",
	"imm16",
	"imm32",
	"imm64",
	"r8",
	"r16",
	"r32",
	"r64",
	"r/m8",
	"r/m16",
	"r/m32",
	"r/m64",
	"m",
	"m8",
	"m16",
	"m32",
	"m64",
	"RAX",
	"RCX",
	"RDX",
	"RBX",
	"RSP",
	"RBP",
	"RSI",
	"RDI",
	"EAX",
	"ECX",
	"EDX",
	"EBX",
	"ESP",
	"EBP",
	"ESI",
	"EDI",
	"AX",
	"CX",
	"DX",
	"BX",
	"SP",
	"BP",
	"SI",
	"DI",
	"AH",
	"AL",
	"CH",
	"CL",
	"DH",
	"DL",
	"BH",
	"BL",
	"SPL",
	"BPL",
	"SIL",
	"DIL",
}

SupportedOperandTypes contains all operand types supported by SGN

View Source 
var X64_REG_SAVE_PREFIX = []byte{
	0x50, 0x53, 0x51, 0x52,
	0x56, 0x57, 0x55, 0x54,
	0x41, 0x50, 0x41, 0x51,
	0x41, 0x52, 0x41, 0x53,
	0x41, 0x54, 0x41, 0x55,
	0x41, 0x56, 0x41, 0x57,
}

X64_REG_SAVE_PREFIX instructions for saving registers to stack

View Source 
var X64_REG_SAVE_SUFFIX = []byte{
	0x41, 0x5f, 0x41, 0x5e,
	0x41, 0x5d, 0x41, 0x5c,
	0x41, 0x5b, 0x41, 0x5a,
	0x41, 0x59, 0x41, 0x58,
	0x5c, 0x5d, 0x5f, 0x5e,
	0x5a, 0x59, 0x5b, 0x58,
}

X64_REG_SAVE_SUFFIX instructions for saving registers to stack

View Source 
var X86_REG_SAVE_PREFIX = []byte{0x60, 0x9c} // PUSHAD, PUSHFD

X86_REG_SAVE_PREFIX instructions for saving registers to stack

View Source 
var X86_REG_SAVE_SUFFIX = []byte{0x9d, 0x61} // POPFD, POPAD

X86_REG_SAVE_SUFFIX instructions for saving registers to stack

Functions

func CipherADFL 

func CipherADFL(data []byte, seed byte) []byte

CipherADFL (Additive Feedback Loop) performs a additive feedback xor operation similar to LFSR (Linear-feedback shift register) IN REVERSE ORDER !! with the supplied seed

func CoinFlip 

func CoinFlip() bool

CoinFlip implements a coin flip witch returns true/false

func GetRandomByte 

func GetRandomByte() byte

GetRandomByte generates a random single byte

func GetRandomBytes 

func GetRandomBytes(num int) []byte

GetRandomBytes generates a random byte slice with given size

func GetRandomSafeAssembly 

func GetRandomSafeAssembly() string

GetRandomSafeAssembly return a safe garbage instruction assembly

func GetSchemaTable 

func GetSchemaTable(schema SCHEMA) string

GetSchemaTable returns the printable encoder schema table

func RandomLabel 

func RandomLabel() string

RandomLabel generates a random assembly label

func RandomOperand 

func RandomOperand() string

RandomOperand generates a random operand string

Types

type Encoder 

type Encoder struct {
	ObfuscationLimit int
	PlainDecoder     bool
	Seed             byte
	EncodingCount    int
	SaveRegisters    bool
	// contains filtered or unexported fields
}

Encoder struct for keeping encoder specs

func NewEncoder 

func NewEncoder(arch int) (*Encoder, error)

NewEncoder for creating new encoder structures

func (*Encoder) AddADFLDecoder 

func (encoder *Encoder) AddADFLDecoder(payload []byte) ([]byte, error)

AddADFLDecoder creates decoder stub for binaries that are ciphered with CipherADFL function.

func (Encoder) AddCallOver 

func (encoder Encoder) AddCallOver(payload []byte) ([]byte, error)

AddCallOver function adds a call instruction over the end of the given payload address of the payload will be pushed to the stack and execution will continiou after the end of payload

func (Encoder) AddCondJmpOver 

func (encoder Encoder) AddCondJmpOver(payload []byte) ([]byte, error)

AddCondJmpOver function adds a jmp instruction over the end of the given payload execution will continiou after the end of payload

func (Encoder) AddJmpOver 

func (encoder Encoder) AddJmpOver(payload []byte) ([]byte, error)

AddJmpOver function adds a jmp instruction over the end of the given payload execution will continiou after the end of payload

func (*Encoder) AddSchemaDecoder 

func (encoder *Encoder) AddSchemaDecoder(payload []byte, schema SCHEMA) ([]byte, error)

AddSchemaDecoder creates decoder stub for binaries that are ciphered with SchemaCipher function. The schema array that is used on the given payload, architecture of the payload and obfuscation level is required.

func (Encoder) Assemble 

func (encoder Encoder) Assemble(asm string) ([]byte, bool)

Assemble assembes the given instructions and return a byte array with a boolean value indicating wether the operation is successful or not

func (*Encoder) CalculateAverageGarbageInstructionSize 

func (encoder *Encoder) CalculateAverageGarbageInstructionSize() (float64, error)

CalculateAverageGarbageInstructionSize calculate the avarage size of generated random garbage instructions

func (*Encoder) Encode 

func (encoder *Encoder) Encode(payload []byte) ([]byte, error)

Encode function is the primary encode method for SGN all nessary options and parameters are contained inside the encodder struct

func (*Encoder) GenerateGarbageAssembly 

func (encoder *Encoder) GenerateGarbageAssembly() string

GenerateGarbageAssembly generates random garbage instruction(s) assemblies based on the subject encoder architecture

func (*Encoder) GenerateGarbageInstructions 

func (encoder *Encoder) GenerateGarbageInstructions() ([]byte, error)

GenerateGarbageInstructions generates random garbage instruction(s) with the specified architecture and returns the assembled bytes

func (Encoder) GenerateGarbageJump 

func (encoder Encoder) GenerateGarbageJump() ([]byte, error)

GenerateGarbageJump generates a JMP instruction over random bytes

func (Encoder) GenerateIPToStack 

func (encoder Encoder) GenerateIPToStack() []byte

GenerateIPToStack function generates instructions series that pushes the instruction pointer to stack

func (*Encoder) GetArchitecture 

func (encoder *Encoder) GetArchitecture() int

GetArchitecture returns the encoder architecture

func (Encoder) GetAssemblySize 

func (encoder Encoder) GetAssemblySize(asm string) int

GetAssemblySize assembes the given instructions and returns the total instruction size if assembly fails return value is -1

func (Encoder) GetBasePointer 

func (encoder Encoder) GetBasePointer() string

GetBasePointer returns the base pointer register string based on the encoder architecture

func (*Encoder) GetRandomFunctionAssembly 

func (encoder *Encoder) GetRandomFunctionAssembly() string

GetRandomFunctionAssembly generates a function frame assembly with garbage instructions inside

func (*Encoder) GetRandomOperandValue 

func (encoder *Encoder) GetRandomOperandValue(operandType string) string

GetRandomOperandValue generates a instruction parameter value based on given operand type Only some operand types are considered because SGN only uses 32-64 bit registers

func (Encoder) GetRandomRegister 

func (encoder Encoder) GetRandomRegister(size int) string

GetRandomRegister returns a random register name based on given size and architecture

func (Encoder) GetRandomStackAddress 

func (encoder Encoder) GetRandomStackAddress() string

GetRandomStackAddress returns a stack address assembly referance based on the encoder architecture Ex: [esp+10] (address range is 1 byte)

func (*Encoder) GetRandomUnsafeAssembly 

func (encoder *Encoder) GetRandomUnsafeAssembly(destReg string) string

GetRandomUnsafeAssembly return a safe garbage instruction assembly

func (*Encoder) GetRandomUnsafeMnemonic 

func (encoder *Encoder) GetRandomUnsafeMnemonic(opRegSize int) *INSTRUCTION

GetRandomUnsafeMnemonic returns a random unsafe instruction based on the encoder architecture and operand number/type Currently SGN only supports instructions with 2 parameter

func (Encoder) GetSafeRandomRegister 

func (encoder Encoder) GetSafeRandomRegister(size int, excludes ...string) (string, error)

GetSafeRandomRegister returns a random register among all (registers-excluded parameters) based on given size

func (Encoder) GetStackPointer 

func (encoder Encoder) GetStackPointer() string

GetStackPointer returns the stack pointer register string based on the encoder architecture

func (*Encoder) NewCipherSchema 

func (encoder *Encoder) NewCipherSchema(num int) SCHEMA

NewCipherSchema generates random schema for using int the SchemaCipher function. Generated schema contains random operands and keys.

func (*Encoder) NewDecoderAssembly 

func (encoder *Encoder) NewDecoderAssembly(payloadSize int) (string, error)

NewDecoderAssembly creates a unobfuscated decoder stub to the given encoded payload with the given architecture and seed value

func (*Encoder) SchemaCipher 

func (encoder *Encoder) SchemaCipher(data []byte, index int, schema SCHEMA) []byte

SchemaCipher encodes a part of the given binary starting from the given index. Encoding done without using any loop conditions based on the schema values. Function performs logical/arithmetic operations given in the schema array. If invalid operand supplied function returns nil

func (*Encoder) SetArchitecture 

func (encoder *Encoder) SetArchitecture(arch int) error

SetArchitecture sets the encoder architecture

type INSTRUCTION 

type INSTRUCTION struct {
	Mnemonic string `json:"Mnemonic"`
	V64      bool   `json:"V64"`
	V32      bool   `json:"V32"`
	Operands []struct {
		Types []string `json:"Types"`
	} `json:"Operands"`
}

INSTRUCTION contains instruction information Intel syntax mandates "When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left operand is the destination." for our case first operand will allways will be considered destination operand

func (*INSTRUCTION) GetRandomMatchingOperandType 

func (ins *INSTRUCTION) GetRandomMatchingOperandType(srcRegSize int) string

GetRandomMatchingOperandType randomly selects a operand type for subject instruction

type REG 

type REG struct {
	Full     string
	Extended string
	High     string
	Low      string
	Arch     int
}

REG structure for registers

type SCHEMA 

type SCHEMA []struct {
	OP  string
	Key []byte
}

SCHEMA contains the operand and keys to apply single step encoding

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.