Hyperion-2.0/0000755000175000017500000000000013476706334012525 5ustar sophiesophieHyperion-2.0/readme.txt0000755000175000017500000001253213476706334014531 0ustar sophiesophie############################################################################### # # # ~ .__ °.__ 0 o ^ .__ °__ `´ # # °____) __ __| | | °| ______°____ 0 ____ __ _________|__|/ |_ ___.__. # # / \| | °\ |°| | °/ ___// __ \_/ ___\| | °\_ __ \ o\ __< | | # # | o°| \ | / |_| |__\___ \\ ___/\ °\___| o| /| | \/ || |° \___ O| # # |___| /____/|____/____/____ °>\___ >\___ >____/ |__|° |__||__| / ____| # # `´´`´\/´`nullsecurity team`´\/`´´`´\/`´``´\/ ``´```´```´´´´`´``0_o\/´´`´´ # # # # Hyperion: A runtime PE-Crypter # # # # VERSION # # 2.0 # # # # DATE # # 08/06/2019 # # # # AUTHOR # # belial - http://www.phobosys.de/hyperion # # # # LICENSE # # BSD-License # # # # DESCRIPTION # # Hyperion is a runtime encrypter for 32/64 bit portable executables. It is a # # reference implementation and bases on the paper "Hyperion: Implementation # # of a PE-Crypter". The paper describes the implementation details which # # aren't in the scope of this readme file. # # The crypter is a C project and can be compiled with the corresponding # # makefile (tested with Mingw and Visual Studio). Afterwards it is started # # via the command line and encrypts an input executable with AES-128. The # # encrypted file decrypts itself on startup (bruteforcing the AES key which # # may take a few seconds) and generates a log file for debug purpose. # # # # TODO # # - Support late Binding of DLLs/APIs # # - AV evasion (obfuscate sbox, strings, reduce entropy, etc.) # # - Polymorphic generation of the container # # - Add .NET Support # # - Preserve Icon and GUI/Console Flag # # - Check for correct DLL Version Numbers before Loading # # - 64 bit asm code cleanup (container and aes payload) # # - Remove macros in Asm Code # # # # CHANGELOG: # # # # v2.0: # # - added 64-bit support # # - upgraded fasm.exe to 1.71 # # - flexible payload structure to add your own ecryption algos # # - removed c++ code and added pure c instead # # # # v1.2: # # - added windows 8 and 8.1 support (thx to CoolOppo) # # # # v1.1: # # - code cleanup and refactoring (more leightweighted and increased # # maintainability) # # - change key space size via the command line # # - change key length via the command line # # - disable logfile generation of the container via commandline # # - display verbose informations while running # # # # v1.0: # # - initial release # # # ############################################################################### Hyperion-2.0/Makefile0000755000175000017500000000370313476706334014173 0ustar sophiesophieCC = gcc SRC = Src\Crypter BIN = . OBJ = Obj CFLAGS = -std=c99 -c -Wall -pedantic -O2 -m32 CONTAINER32 = Src\Container\32 CONTAINER64 = Src\Container\64 GENERATED_ASM = $(CONTAINER32)\decryption_payload.asm $(CONTAINER32)\image_base.inc\ $(CONTAINER32)\image_size.ing $(CONTAINER32)\infile_array.inc $(CONTAINER32)\infile_size.inc\ $(CONTAINER32)\key_size.inc $(CONTAINER32)\logfile_select.asm\ $(CONTAINER64)\decryption_payload.asm $(CONTAINER64)\image_base.inc\ $(CONTAINER64)\image_size.ing $(CONTAINER64)\infile_array.inc $(CONTAINER64)\infile_size.inc\ $(CONTAINER64)\key_size.inc $(CONTAINER64)\logfile_select.asm .PHONY:all all: verbose.o fileaccess.o hyperion.o pe_general.o pe32.o pe64.o fasmoutput.o \ encryption.o secure_string.o aes.o $(CC) -o $(BIN)\hyperion.exe $(OBJ)\hyperion.o $(OBJ)\verbose.o \ $(OBJ)\fileaccess.o $(OBJ)\pe_general.o $(OBJ)\pe32.o $(OBJ)\pe64.o \ $(OBJ)\fasmoutput.o $(OBJ)\encryption.o $(OBJ)\secure_string.o $(OBJ)\aes.o hyperion.o: $(SRC)\hyperion.c $(CC) $(CFLAGS) -o $(OBJ)\hyperion.o $(SRC)\hyperion.c verbose.o: $(SRC)\verbose.c $(CC) $(CFLAGS) -o $(OBJ)\verbose.o $(SRC)\verbose.c secure_string.o: $(SRC)\secure_string.c $(CC) $(CFLAGS) -o $(OBJ)\secure_string.o $(SRC)\secure_string.c fileaccess.o: $(SRC)\fileaccess.c $(CC) $(CFLAGS) -o $(OBJ)\fileaccess.o $(SRC)\fileaccess.c pe_general.o: $(SRC)\pe_general.c $(CC) $(CFLAGS) -o $(OBJ)\pe_general.o $(SRC)\pe_general.c pe32.o: $(SRC)\pe32.c $(CC) $(CFLAGS) -o $(OBJ)\pe32.o $(SRC)\pe32.c pe64.o: $(SRC)\pe64.c $(CC) $(CFLAGS) -o $(OBJ)\pe64.o $(SRC)\pe64.c fasmoutput.o: $(SRC)\fasmoutput.c $(CC) $(CFLAGS) -Wno-format -o $(OBJ)\fasmoutput.o $(SRC)\fasmoutput.c encryption.o: $(SRC)\encryption.c $(CC) $(CFLAGS) -o $(OBJ)\encryption.o $(SRC)\encryption.c aes.o: $(SRC)\aes.c $(CC) $(CFLAGS) -o $(OBJ)\aes.o $(SRC)\aes.c .PHONY:clean clean: del $(BIN)\hyperion.exe $(OBJ)\*.o $(GENERATED_ASM) >nul 2>&1 Hyperion-2.0/Src/0000755000175000017500000000000013476706334013254 5ustar sophiesophieHyperion-2.0/Src/Container/0000755000175000017500000000000013476706334015176 5ustar sophiesophieHyperion-2.0/Src/Container/64/0000755000175000017500000000000013476706334015427 5ustar sophiesophieHyperion-2.0/Src/Container/64/loadapis.asm0000644000175000017500000000775213476706334017740 0ustar sophiesophie;Dynamically load the needed APIs ;Strings are created on stack ;dllname: zero terminated string with dll name ;store: save the dll image base here ;Jumps to LoadLogAPIsExit if an Error Occurs macro loadDLL dllname, store, exit { lea rax,[dllname] invoke LoadLibrary,rax test rax,rax jz exit mov [store],rax } ;functionname: zero terminated string with functions name ;dll_imagebase: imagebase of the dll ;returns: function pointer in eax macro loadAPI functionname, dll_imagebase, exit { lea rax,[functionname] invoke GetProcAddress,qword [dll_imagebase],rax test rax,rax jz exit } ;Loads all necessary APISs proc loadRegularAPIs APITable:QWORD local str1[256]:BYTE, kernel32_imagebase:QWORD mov [APITable],rcx writeWithNewLine createStringLoading, str1, LoadRegularAPIsExit_Error ;Get Kernel32.Dll Imagebase writeWithNewLine createStringKernel32, str1, LoadRegularAPIsExit_Error loadDLL str1, kernel32_imagebase, LoadRegularAPIsExit_Error ;Load GetModuleHandle writeWithNewLine createStringGetModuleHandle, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov r10,[APITable] mov [r10+GetModuleHandle],rax ;Load VirtualAlloc writeWithNewLine createStringVirtualAlloc, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov r10,[APITable] mov [r10+VirtualAlloc],rax ;Load VirtualProtect writeWithNewLine createStringVirtualProtect, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov r10,[APITable] mov [r10+VirtualProtect],rax ;Load VirtualFree writeWithNewLine createStringVirtualFree, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov r10,[APITable] mov [r10+VirtualFree],rax mov rax,1 ret LoadRegularAPIsExit_Error: sub rax,rax ret endp ;Loads the basic functions for log file access proc loadLogAPIs APITable:QWORD local str1[256]:BYTE, kernel32_imagebase:QWORD mov [APITable], rcx ;Get Kernel32.Dll Imagebase createStringKernel32 str1 loadDLL str1, kernel32_imagebase, LoadLogAPIsExit_Error ;Load CreateFileMapping API createStringCreateFileMapping str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+CreateFileMapping],rax ;Load MapViewOfFile API createStringMapViewOfFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+MapViewOfFile],rax ;Load UnmapViewOfFile API createStringUnmapViewOfFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+UnmapViewOfFile],rax ;Load UnmapViewOfFile API createStringCreateFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+CreateFile],rax ;Load CloseHandle API createStringCloseHandle str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+CloseHandle],rax ;Load GetFileSize API createStringGetFileSize str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+GetFileSize],rax ;Load DeleteFile API createStringDeleteFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov r10,[APITable] mov [r10+DeleteFile],rax ;apis loaded successfully mov rax,1 ret LoadLogAPIsExit_Error: sub rax,rax ret endp Hyperion-2.0/Src/Container/64/logfile_disable.asm0000755000175000017500000000104013476706334021233 0ustar sophiesophie;writes a string and a newline to the logfile macro writeWithNewLine char_sequence, char_buffer, error_exit{ char_sequence char_buffer mov rax,1 } ;write a string to the logfile macro writeLog apitable, content{ mov rax,1 } ;delete old log file and create a new one macro initLogFile apitable{ mov rax,1 } ;write a newline into logfile macro writeNewLineToLog apitable{ mov rax,1 } ;write a register value into logile macro writeRegisterToLog apitable, value{ mov rax,1 }Hyperion-2.0/Src/Container/64/main.asm0000644000175000017500000000653113476706334017062 0ustar sophiesophie; Hyperion 64-Bit container.exe include 'image_base.inc' format PE64 GUI 5.0 at IMAGE_BASE entry start include '..\..\..\Fasm\INCLUDE\win64a.inc' include 'hyperion.inc' include 'createstrings.inc' include 'pe.inc' ;automatically generated by hyperion cpp stub include 'key_size.inc' include 'infile_size.inc' include 'image_size.inc' ;--- ;this contains the decrypted and loaded executable section '.bss' data readable writeable decrypted_infile: db IMAGE_SIZE dup (?) ;-------------------------------------------------- ;this contains the encrypted exe section '.data' data readable writeable encrypted_infile: include 'infile_array.inc' ;-------------------------------------------------- section '.text' code readable executable ;include necessary functions include 'logfile_select.asm' include 'loadapis.asm' include 'loadexecutable.asm' ;automatically generated by hyperion cpp stub include 'decryption_payload.asm' ;--- start: sub rsp,8 fastcall MainMethod test rax,rax jz the_end_my_friend ;file was loaded, execute it add rsp,8 jmp rax the_end_my_friend: invoke ExitProcess,0 proc MainMethod local str1[256]:BYTE,\ APITable:QWORD,\ CreateFileMapping_:QWORD,\ MapViewOfFile_:QWORD,\ UnmapViewOfFile_:QWORD,\ CreateFile_:QWORD,\ CloseHandle_:QWORD,\ DeleteFile_:QWORD,\ GetModuleHandle_:QWORD,\ VirtualAlloc_:QWORD,\ VirtualProtect_:QWORD,\ VirtualFree_:QWORD,\ RetVal:QWORD ;pointer to the API table lea rax,[CreateFileMapping_] mov [APITable],rax ;load APIs for log file access fastcall loadLogAPIs,[APITable] test rax,rax jz main_exiterrornolog ;create logfile and write initial message into it initLogFile APITable test rax,rax jz main_exiterrornolog ;load all necessary APIs fastcall loadRegularAPIs, [APITable] test rax,rax jz main_exiterror writeNewLineToLog APITable test rax,rax jz main_exiterror ;decrypt exe in data section fastcall decryptExecutable, [APITable], encrypted_infile test rax,rax jz main_exiterror ;load the executable at its image base ;(this will overwrite current MZ header and bss section) fastcall loadExecutable, [APITable], encrypted_infile test rax,rax jz main_exiterror ;start program execution mov rdx,IMAGE_BASE xor rax,rax mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew] add rax,rdx add rax,4 ;image file header now in eax add rax,sizeof.IMAGE_FILE_HEADER xor rdx,rdx mov edx,[rax+IMAGE_OPTIONAL_HEADER64.AddressOfEntryPoint] mov rax,IMAGE_BASE add rdx,rax ;entry point of original exe is now in rdx mov [RetVal],rdx ;finished without errors main_exitsuccess: writeNewLineToLog APITable createStringDone str1 lea rax,[str1] writeLog APITable, rax mov rax,[RetVal] jmp main_exit ;finished with errors after logfile API loading main_exiterror: writeNewLineToLog APITable createStringError str1 lea rax,[str1] writeLog APITable, rax sub rax,rax main_exit: ret ;finished with errors before logfile API loading main_exiterrornolog: ret endp ;import table section '.idata' import data readable writeable library kernel,'KERNEL32.DLL' import kernel,\ GetProcAddress,'GetProcAddress',\ LoadLibrary,'LoadLibraryA',\ ExitProcess,'ExitProcess' Hyperion-2.0/Src/Container/64/hyperion.inc0000755000175000017500000000075113476706334017765 0ustar sophiesophieCreateFileMapping equ 0 MapViewOfFile equ CreateFileMapping + 8 UnmapViewOfFile equ MapViewOfFile + 8 CreateFile equ UnmapViewOfFile + 8 CloseHandle equ CreateFile + 8 GetFileSize equ CloseHandle + 8 DeleteFile equ GetFileSize + 8 GetModuleHandle equ DeleteFile + 8 VirtualAlloc equ GetModuleHandle + 8 VirtualProtect equ VirtualAlloc + 8 VirtualFree equ VirtualProtect + 8 SIZE_DATA_SECTION_NAME equ 5 SIZE_CHECKSUM equ 4 Hyperion-2.0/Src/Container/64/createstrings.inc0000755000175000017500000003000013476706334020773 0ustar sophiesophiemacro createStringBruteforcing location { mov [location+0],'B' mov [location+1],'r' mov [location+2],'u' mov [location+3],'t' mov [location+4],'e' mov [location+5],'f' mov [location+6],'o' mov [location+7],'r' mov [location+8],'c' mov [location+9],'i' mov [location+10],'n' mov [location+11],'g' mov [location+12],' ' mov [location+13],'K' mov [location+14],'e' mov [location+15],'y' mov [location+16],0 } macro createStringSettingPermissions location { mov [location+0],'S' mov [location+1],'e' mov [location+2],'t' mov [location+3],'t' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'S' mov [location+9],'e' mov [location+10],'c' mov [location+11],'t' mov [location+12],'i' mov [location+13],'o' mov [location+14],'n' mov [location+15],' ' mov [location+16],'P' mov [location+17],'e' mov [location+18],'r' mov [location+19],'m' mov [location+20],'i' mov [location+21],'s' mov [location+22],'s' mov [location+23],'i' mov [location+24],'o' mov [location+25],'n' mov [location+26],'s' mov [location+27],0 } macro createStringOrdinal location { mov [location+0],'O' mov [location+1],'r' mov [location+2],'d' mov [location+3],'i' mov [location+4],'n' mov [location+5],'a' mov [location+6],'l' mov [location+7],':' mov [location+8],' ' mov [location+9],0 } macro createStringName location { mov [location+0],'N' mov [location+1],'a' mov [location+2],'m' mov [location+3],'e' mov [location+4],':' mov [location+5],' ' mov [location+6],0 } macro createStringProcessImportDirectory location { mov [location+0],'P' mov [location+1],'r' mov [location+2],'o' mov [location+3],'c' mov [location+4],'e' mov [location+5],'s' mov [location+6],'s' mov [location+7],'i' mov [location+8],'n' mov [location+9],'g' mov [location+10],' ' mov [location+11],'I' mov [location+12],'m' mov [location+13],'p' mov [location+14],'o' mov [location+15],'r' mov [location+16],'t' mov [location+17],' ' mov [location+18],'D' mov [location+19],'i' mov [location+20],'r' mov [location+21],'e' mov [location+22],'c' mov [location+23],'t' mov [location+24],'o' mov [location+25],'r' mov [location+26],'y' mov [location+27],':' mov [location+28],0 } macro createStringFoundImportTable location { mov [location+0],'I' mov [location+1],'m' mov [location+2],'p' mov [location+3],'o' mov [location+4],'r' mov [location+5],'t' mov [location+6],' ' mov [location+7],'T' mov [location+8],'a' mov [location+9],'b' mov [location+10],'l' mov [location+11],'e' mov [location+12],':' mov [location+13],0 } macro createStringLoadingFilesAPIs location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'A' mov [location+9],'P' mov [location+10],'I' mov [location+11],'s' mov [location+12],0 } macro createStringMappingFileInMemory location { mov [location+0],'M' mov [location+1],'a' mov [location+2],'p' mov [location+3],'p' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'F' mov [location+9],'i' mov [location+10],'l' mov [location+11],'e' mov [location+12],' ' mov [location+13],'i' mov [location+14],'n' mov [location+15],'t' mov [location+16],'o' mov [location+17],' ' mov [location+18],'M' mov [location+19],'e' mov [location+20],'m' mov [location+21],'o' mov [location+22],'r' mov [location+23],'y' mov [location+24],0 } macro createStringLoaded location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'e' mov [location+5],'d' mov [location+6],' ' mov [location+7],0 } macro createStringLoadedPEHeader location { mov [location+0],'S' mov [location+1],'e' mov [location+2],'t' mov [location+3],' ' mov [location+4],'I' mov [location+5],'m' mov [location+6],'a' mov [location+7],'g' mov [location+8],'e' mov [location+9],' ' mov [location+10],'w' mov [location+11],'r' mov [location+12],'i' mov [location+13],'t' mov [location+14],'a' mov [location+15],'b' mov [location+16],'l' mov [location+17],'e' mov [location+18],':' mov [location+19],0 } macro createStringVerifyPE location { mov [location+0],'V' mov [location+1],'e' mov [location+2],'r' mov [location+3],'i' mov [location+4],'f' mov [location+5],'y' mov [location+6],'i' mov [location+7],'n' mov [location+8],'g' mov [location+9],' ' mov [location+10],'P' mov [location+11],'E' mov [location+12],0 } macro createStringVerifyChecksum location { mov [location+0],'V' mov [location+1],'e' mov [location+2],'r' mov [location+3],'i' mov [location+4],'f' mov [location+5],'y' mov [location+6],'i' mov [location+7],'n' mov [location+8],'g' mov [location+9],' ' mov [location+10],'C' mov [location+11],'h' mov [location+12],'e' mov [location+13],'c' mov [location+14],'k' mov [location+15],'s' mov [location+16],'u' mov [location+17],'m' mov [location+18],0 } macro createStringDone location { mov [location+0],'D' mov [location+1],'o' mov [location+2],'n' mov [location+3],'e' mov [location+4],0 } macro createStringLoading location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'A' mov [location+9],'P' mov [location+10],'I' mov [location+11],'s' mov [location+12],':' mov [location+13],0 } macro createStringError location { mov [location+0],'E' mov [location+1],'r' mov [location+2],'r' mov [location+3],'o' mov [location+4],'r' mov [location+5],0 } macro createStringStartingHyperion location { mov [location+00],'H' mov [location+01],'y' mov [location+02],'p' mov [location+03],'e' mov [location+04],'r' mov [location+05],'i' mov [location+06],'o' mov [location+07],'n' mov [location+08],' ' mov [location+09],'L' mov [location+10],'o' mov [location+11],'g' mov [location+12],'f' mov [location+13],'i' mov [location+14],'l' mov [location+15],'e' mov [location+16],13 mov [location+17],10 mov [location+18],0 } macro createStringStartingHyperionLines location { mov [location+00],'-' mov [location+01],'-' mov [location+02],'-' mov [location+03],'-' mov [location+04],'-' mov [location+05],'-' mov [location+06],'-' mov [location+07],'-' mov [location+08],'-' mov [location+09],'-' mov [location+10],'-' mov [location+11],'-' mov [location+12],'-' mov [location+13],'-' mov [location+14],'-' mov [location+15],'-' mov [location+16],13 mov [location+17],10 mov [location+18],0 } macro createStringLogTxt location { mov [location+0],'l' mov [location+1],'o' mov [location+2],'g' mov [location+3],'.' mov [location+4],'t' mov [location+5],'x' mov [location+6],'t' mov [location+7],0 } macro createStringKernel32 location { mov [location+00],'k' mov [location+01],'e' mov [location+02],'r' mov [location+03],'n' mov [location+04],'e' mov [location+05],'l' mov [location+06],'3' mov [location+07],'2' mov [location+08],'.' mov [location+09],'d' mov [location+10],'l' mov [location+11],'l' mov [location+12],0 } macro createStringCreateFileMapping location { mov [location+00],'C' mov [location+01],'r' mov [location+02],'e' mov [location+03],'a' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'M' mov [location+11],'a' mov [location+12],'p' mov [location+13],'p' mov [location+14],'i' mov [location+15],'n' mov [location+16],'g' mov [location+17],'A' mov [location+18],0 } macro createStringMapViewOfFile location { mov [location+00],'M' mov [location+01],'a' mov [location+02],'p' mov [location+03],'V' mov [location+04],'i' mov [location+05],'e' mov [location+06],'w' mov [location+07],'O' mov [location+08],'f' mov [location+09],'F' mov [location+10],'i' mov [location+11],'l' mov [location+12],'e' mov [location+13],0 } macro createStringUnmapViewOfFile location { mov [location+00],'U' mov [location+01],'n' mov [location+02],'m' mov [location+03],'a' mov [location+04],'p' mov [location+05],'V' mov [location+06],'i' mov [location+07],'e' mov [location+08],'w' mov [location+09],'O' mov [location+10],'f' mov [location+11],'F' mov [location+12],'i' mov [location+13],'l' mov [location+14],'e' mov [location+15],0 } macro createStringCreateFile location { mov [location+00],'C' mov [location+01],'r' mov [location+02],'e' mov [location+03],'a' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'A' mov [location+11],0 } macro createStringCloseHandle location { mov [location+00],'C' mov [location+01],'l' mov [location+02],'o' mov [location+03],'s' mov [location+04],'e' mov [location+05],'H' mov [location+06],'a' mov [location+07],'n' mov [location+08],'d' mov [location+09],'l' mov [location+10],'e' mov [location+11],0 } macro createStringGetFileSize location { mov [location+00],'G' mov [location+01],'e' mov [location+02],'t' mov [location+03],'F' mov [location+04],'i' mov [location+05],'l' mov [location+06],'e' mov [location+07],'S' mov [location+08],'i' mov [location+09],'z' mov [location+10],'e' mov [location+11],0 } macro createStringDeleteFile location { mov [location+00],'D' mov [location+01],'e' mov [location+02],'l' mov [location+03],'e' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'A' mov [location+11],0 } macro createStringGetModuleHandle location { mov [location+00],'G' mov [location+01],'e' mov [location+02],'t' mov [location+03],'M' mov [location+04],'o' mov [location+05],'d' mov [location+06],'u' mov [location+07],'l' mov [location+08],'e' mov [location+09],'H' mov [location+10],'a' mov [location+11],'n' mov [location+12],'d' mov [location+13],'l' mov [location+14],'e' mov [location+15],'A' mov [location+16],0 } macro createStringVirtualAlloc location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'A' mov [location+08],'l' mov [location+09],'l' mov [location+10],'o' mov [location+11],'c' mov [location+12],0 } macro createStringVirtualProtect location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'P' mov [location+08],'r' mov [location+09],'o' mov [location+10],'t' mov [location+11],'e' mov [location+12],'c' mov [location+13],'t' mov [location+14],0 } macro createStringVirtualFree location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'F' mov [location+08],'r' mov [location+09],'e' mov [location+10],'e' mov [location+11],0 } Hyperion-2.0/Src/Container/64/logfile_enable.asm0000644000175000017500000001444113476706334021064 0ustar sophiesophie;------------------------------------------- ;the content of this file is excluded, | ;when the user disables logging features | ;in hyperion command line. pls keep in mind | ;and dont rely on its existence. | ;------------------------------------------- ;--- Begin Macro Section --- ;writes a string and a newline to the logfile macro writeWithNewLine char_sequence, char_buffer, error_exit{ char_sequence char_buffer lea rax,[str1] fastcall writeLog_,[APITable],rax test rax,rax jz error_exit fastcall writeNewLineToLog_,[APITable] test rax,rax jz error_exit } ;write a string to the logfile macro writeLog apitable, content{ fastcall writeLog_,[apitable], content } ;delete old log file and create a new one macro initLogFile apitable{ fastcall initLogFile_, [apitable] } ;write a newline into logfile macro writeNewLineToLog apitable{ fastcall writeNewLineToLog_, [apitable] } ;write a register value into logile macro writeRegisterToLog apitable, value{ fastcall writeRegisterToLog_, [apitable], value } ;--- End Macro Section --- ;get the length of a string proc strlen_ string_ptr:QWORD mov [string_ptr],rcx push rdi push rcx mov rdi,[string_ptr] sub rcx, rcx sub al, al not rcx cld repne scasb not rcx dec rcx mov rax,rcx pop rcx pop rdi ret endp ;write into log.txt ;returns false if an eerror occurs proc writeLog_ APITable:QWORD, content:QWORD local str1[256]:BYTE, oldlogsize:QWORD, newlogsize:QWORD, contentsize:QWORD,\ filehandle:QWORD, filemappingobject:QWORD, mapaddress:QWORD, retval:QWORD mov [APITable],rcx mov [content],rdx ;open file createStringLogTxt str1 mov rax,[APITable] lea r10,[str1] sub r11,r11 fastcall qword [rax+CreateFile], r10, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, r11, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, r11 mov [retval],rax test rax,rax jz wl_logexit mov [filehandle],rax ;get logfile size mov rax,[APITable] fastcall qword [rax+GetFileSize], qword [filehandle], 0 mov [oldlogsize],rax ;get size of string for logfile for concatenation fastcall strlen_, qword [content] mov [contentsize], rax add rax,qword [oldlogsize] mov [newlogsize], rax ;create the file mapping sub r10,r10 mov r11,[APITable] fastcall qword [r11+CreateFileMapping], qword [filehandle], r10, PAGE_READWRITE, r10, rax, r10 mov [retval],rax test rax, rax jz wl_closelogfile mov [filemappingobject],rax sub r10,r10 mov r11,[APITable] fastcall qword [r11+MapViewOfFile], rax, FILE_MAP_ALL_ACCESS, r10, r10, qword [newlogsize] mov [retval],rax test rax, rax jz wl_closemaphandle mov [mapaddress],rax ;copy string into map add rax,[oldlogsize] mov rdi,rax mov rsi,[content] mov rcx,[contentsize] repz movsb mov [retval],1 wl_unmapfile: mov rax,[APITable] fastcall qword [rax+UnmapViewOfFile], qword [mapaddress] wl_closemaphandle: mov rax,[APITable] fastcall qword [rax+CloseHandle], qword [filemappingobject] wl_closelogfile: mov rax,[APITable] fastcall qword [rax+CloseHandle], qword [filehandle] wl_logexit: mov rax,[retval] ret; endp ;adds a to the logfile ;returns false if an error occurs proc writeNewLineToLog_ APITable:QWORD local str1[3]:BYTE mov [APITable],rcx lea rax,[str1] mov byte [rax+0],13 mov byte [rax+1],10 mov byte [rax+2],0 fastcall writeLog_, [APITable], rax ret endp ;returns false if an error occurs proc writeRegisterToLog_ APITable:QWORD, Value:QWORD local str1[18]:BYTE, retval:QWORD mov [APITable],rcx mov [Value],rdx lea rax,[str1] fastcall binToString_, rax, [Value] fastcall writeLog_,[APITable],rax mov [retval],rax test rax,rax jz wrtl_exit fastcall writeNewLineToLog_,[APITable] mov [retval],rax test rax,rax jz wrtl_exit wrtl_exit: mov rax,[retval] ret endp ;converts into an 8 byte string and stores it proc binToString_ buffer:QWORD, bin:QWORD mov [buffer],rcx mov [bin], rdx mov r10,[bin] mov rcx,16 bts_next_byte: mov rax,r10 and rax,0000000fh cmp rax,9 jg bts_add_55 bts_add_48: add rax,48 jmp bts_store_bin bts_add_55: add rax,55 bts_store_bin: dec rcx mov rdx,[buffer] mov byte [rcx+rdx],al test rcx,rcx jz bts_finished_conversion shr r10,4 jmp bts_next_byte bts_finished_conversion: mov rax,[buffer] mov byte [rax+16],0 ret endp ;Write initial message into logfile proc initLogFile_ APITable:QWORD local str1[256]:BYTE mov [APITable], rcx createStringLogTxt str1 mov rax,[APITable] lea r10,[str1] fastcall qword [rax+DeleteFile],r10 createStringStartingHyperionLines str1 lea r10,[str1] fastcall writeLog_,[APITable],r10 test rax,rax jz ilf_exit_error createStringStartingHyperion str1 lea r10,[str1] fastcall writeLog_,[APITable],r10 test rax,rax jz ilf_exit_error createStringStartingHyperionLines str1 lea r10,[str1] fastcall writeLog_,[APITable],r10 test rax,rax jz ilf_exit_error fastcall writeNewLineToLog_,[APITable] test rax,rax jz ilf_exit_error ilf_exit_success: mov rax,1 ret ilf_exit_error: sub rax,rax ret endp Hyperion-2.0/Src/Container/64/pe.inc0000755000175000017500000001647313476706334016544 0ustar sophiesophieIMAGE_DOS_SIGNATURE = 05A4Dh IMAGE_OS2_SIGNATURE = 0454Eh IMAGE_OS2_SIGNATURE_LE = 0454Ch IMAGE_VXD_SIGNATURE = 0454Ch IMAGE_LX_SIGNATURE = 0584Ch IMAGE_NT_SIGNATURE = 04550h IMAGE_FILE_MACHINE_UNKNOWN = 0 IMAGE_FILE_MACHINE_I386 = 014ch IMAGE_FILE_MACHINE_R3000 = 0162h IMAGE_FILE_MACHINE_R4000 = 0166h IMAGE_FILE_MACHINE_R10000 = 0168h IMAGE_FILE_MACHINE_WCEMIPSV2 = 0169h IMAGE_FILE_MACHINE_ALPHA = 0184h IMAGE_FILE_MACHINE_SH3 = 01a2h IMAGE_FILE_MACHINE_SH3DSP = 01a3h IMAGE_FILE_MACHINE_SH3E = 01a4h IMAGE_FILE_MACHINE_SH4 = 01a6h IMAGE_FILE_MACHINE_SH5 = 01a8h IMAGE_FILE_MACHINE_ARM = 01c0h IMAGE_FILE_MACHINE_THUMB = 01c2h IMAGE_FILE_MACHINE_AM33 = 01d3h IMAGE_FILE_MACHINE_POWERPC = 01F0h IMAGE_FILE_MACHINE_POWERPCFP = 01f1h IMAGE_FILE_MACHINE_IA64 = 0200h IMAGE_FILE_MACHINE_MIPS16 = 0266h IMAGE_FILE_MACHINE_ALPHA64 = 0284h IMAGE_FILE_MACHINE_MIPSFPU = 0366h IMAGE_FILE_MACHINE_MIPSFPU16 = 0466h IMAGE_FILE_MACHINE_AXP64 = IMAGE_FILE_MACHINE_ALPHA64 IMAGE_FILE_MACHINE_TRICORE = 0520h IMAGE_FILE_MACHINE_CEF = 0CEFh IMAGE_FILE_MACHINE_EBC = 0EBCh IMAGE_FILE_MACHINE_AMD64 = 8664h IMAGE_FILE_MACHINE_M32R = 9041h IMAGE_FILE_MACHINE_CEE = 0C0EEh IMAGE_SIZEOF_NT_OPTIONAL32_HEADER = 224 IMAGE_NT_OPTIONAL_HDR32_MAGIC = 10bh IMAGE_FILE_RELOCS_STRIPPED = 0001h IMAGE_FILE_EXECUTABLE_IMAGE = 0002h IMAGE_FILE_LINE_NUMS_STRIPPED = 0004h IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0008h IMAGE_FILE_AGGRESIVE_WS_TRIM = 0010h IMAGE_FILE_LARGE_ADDRESS_AWARE = 0020h IMAGE_FILE_BYTES_REVERSED_LO = 0080h IMAGE_FILE_32BIT_MACHINE = 0100h IMAGE_FILE_DEBUG_STRIPPED = 0200h IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0400h IMAGE_FILE_NET_RUN_FROM_SWAP = 0800h IMAGE_FILE_SYSTEM = 1000h IMAGE_FILE_DLL = 2000h IMAGE_FILE_UP_SYSTEM_ONLY = 4000h IMAGE_FILE_BYTES_REVERSED_HI = 8000h IMAGE_SUBSYSTEM_UNKNOWN = 0 IMAGE_SUBSYSTEM_NATIVE = 1 IMAGE_SUBSYSTEM_WINDOWS_GUI = 2 IMAGE_SUBSYSTEM_WINDOWS_CUI = 3 IMAGE_SUBSYSTEM_OS2_CUI = 5 IMAGE_SUBSYSTEM_POSIX_CUI = 7 IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8 IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9 IMAGE_SUBSYSTEM_EFI_APPLICATION = 10 IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11 IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12 IMAGE_SUBSYSTEM_EFI_ROM = 13 IMAGE_SUBSYSTEM_XBOX = 14 IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16 IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0040h IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0080h IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0100h IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0200h IMAGE_DLLCHARACTERISTICS_NO_SEH = 0400h IMAGE_DLLCHARACTERISTICS_NO_BIND = 0800h IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 2000h IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 8000h IMAGE_DIRECTORY_ENTRY_EXPORT = 0 IMAGE_DIRECTORY_ENTRY_IMPORT = 1 IMAGE_DIRECTORY_ENTRY_RESOURCE = 2 IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3 IMAGE_DIRECTORY_ENTRY_SECURITY = 4 IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 IMAGE_DIRECTORY_ENTRY_DEBUG = 6 IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7 IMAGE_DIRECTORY_ENTRY_ARCHITECTURE = 7 IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8 IMAGE_DIRECTORY_ENTRY_TLS = 9 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11 IMAGE_DIRECTORY_ENTRY_IAT = 12 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14 IMAGE_SIZEOF_SECTION_HEADER = 40 IMAGE_SCN_TYPE_NO_PAD = 00000008h IMAGE_SCN_CNT_CODE = 00000020h IMAGE_SCN_CNT_INITIALIZED_DATA = 00000040h IMAGE_SCN_CNT_UNINITIALIZED_DATA = 00000080h IMAGE_SCN_LNK_OTHER = 00000100h IMAGE_SCN_LNK_INFO = 00000200h IMAGE_SCN_LNK_REMOVE = 00000800h IMAGE_SCN_LNK_COMDAT = 00001000h IMAGE_SCN_NO_DEFER_SPEC_EXC = 00004000h IMAGE_SCN_GPREL = 00008000h IMAGE_SCN_MEM_FARDATA = 00008000h IMAGE_SCN_MEM_PURGEABLE = 00020000h IMAGE_SCN_MEM_16BIT = 00020000h IMAGE_SCN_MEM_LOCKED = 00040000h IMAGE_SCN_MEM_PRELOAD = 00080000h IMAGE_SCN_ALIGN_1BYTES = 00100000h IMAGE_SCN_ALIGN_2BYTES = 00200000h IMAGE_SCN_ALIGN_4BYTES = 00300000h IMAGE_SCN_ALIGN_8BYTES = 00400000h IMAGE_SCN_ALIGN_16BYTES = 00500000h IMAGE_SCN_ALIGN_32BYTES = 00600000h IMAGE_SCN_ALIGN_64BYTES = 00700000h IMAGE_SCN_ALIGN_128BYTES = 00800000h IMAGE_SCN_ALIGN_256BYTES = 00900000h IMAGE_SCN_ALIGN_512BYTES = 00A00000h IMAGE_SCN_ALIGN_1024BYTES = 00B00000h IMAGE_SCN_ALIGN_2048BYTES = 00C00000h IMAGE_SCN_ALIGN_4096BYTES = 00D00000h IMAGE_SCN_ALIGN_8192BYTES = 00E00000h IMAGE_SCN_LNK_NRELOC_OVFL = 01000000h IMAGE_SCN_MEM_DISCARDABLE = 02000000h IMAGE_SCN_MEM_NOT_CACHED = 04000000h IMAGE_SCN_MEM_NOT_PAGED = 08000000h IMAGE_SCN_MEM_SHARED = 10000000h IMAGE_SCN_MEM_EXECUTE = 20000000h IMAGE_SCN_MEM_READ = 40000000h IMAGE_SCN_MEM_WRITE = 80000000h IMAGE_SCN_SCALE_INDEX = 00000001h struct IMAGE_DOS_HEADER e_magic dw ? e_cblp dw ? e_cp dw ? e_crlc dw ? e_cparhdr dw ? e_minalloc dw ? e_maxalloc dw ? e_ss dw ? e_sp dw ? e_csum dw ? e_ip dw ? e_cs dw ? e_lfarlc dw ? e_ovno dw ? e_res rw 4 e_oemid dw ? e_oeminfo dw ? e_res2 rw 10 e_lfanew dd ? ends struct IMAGE_FILE_HEADER Machine dw ? NumberOfSections dw ? TimeDateStamp dd ? PointerToSymbolTable dd ? NumberOfSymbols dd ? SizeOfOptionalHeader dw ? Characteristics dw ? ends struct IMAGE_DATA_DIRECTORY VirtualAddress dd ? isize dd ? ends IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 struct IMAGE_OPTIONAL_HEADER64 Magic dw ? MajorLinkerVersion db ? MinorLinkerVersion db ? SizeOfCode dd ? SizeOfInitializedData dd ? SizeOfUninitializedData dd ? AddressOfEntryPoint dd ? BaseOfCode dd ? ImageBase dq ? SectionAlignment dd ? FileAlignment dd ? MajorOperatingSystemVersion dw ? MinorOperatingSystemVersion dw ? MajorImageVersion dw ? MinorImageVersion dw ? MajorSubsystemVersion dw ? MinorSubsystemVersion dw ? Win32VersionValue dd ? SizeOfImage dd ? SizeOfHeaders dd ? CheckSum dd ? Subsystem dw ? DllCharacteristics dw ? SizeOfStackReserve dq ? SizeOfStackCommit dq ? SizeOfHeapReserve dq ? SizeOfHeapCommit dq ? LoaderFlags dd ? NumberOfRvaAndSizes dd ? DataDirectory rb (sizeof.IMAGE_DATA_DIRECTORY*IMAGE_NUMBEROF_DIRECTORY_ENTRIES) ends struct IMAGE_NT_HEADERS64 Signature dd ? FileHeader IMAGE_FILE_HEADER ? OptionalHeader IMAGE_OPTIONAL_HEADER64 ? ends IMAGE_SIZEOF_SHORT_NAME = 8 struct IMAGE_SECTION_HEADER _Name db IMAGE_SIZEOF_SHORT_NAME dup (?) union PhysicalAddress dd ? VirtualSize dd ? ends VirtualAddress dd ? SizeOfRawData dd ? PointerToRawData dd ? PointerToRelocations dd ? PointerToLinenumbers dd ? NumberOfRelocations dw ? NumberOfLinenumbers dw ? Characteristics dd ? ends struct IMAGE_IMPORT_DESCRIPTOR union Characteristics dd ? OriginalFirstThunk dd ? ends TimeDateStamp dd ? ForwarderChain dd ? Name_ dd ? FirstThunk dd ? ends struct IMAGE_IMPORT_BY_NAME Hint dw ? Name_ rb 1 ends IMAGE_ORDINAL_FLAG64 = 8000000000000000h Hyperion-2.0/Src/Container/64/loadexecutable.asm0000644000175000017500000003624513476706334021124 0ustar sophiesophie;Loads the exe which is stored in input_image ;into memory and starts its execution proc loadExecutable APITable:QWORD, input_image:QWORD local str1[256]:BYTE, ret_val:QWORD, image_file_header:QWORD,\ loaded_file:QWORD mov [APITable],rcx mov [input_image],rdx ;verify checksum of packed executable writeWithNewLine createStringVerifyChecksum, str1, le_exit_error fastcall verifyChecksum, [input_image], INFILE_SIZE test rax,rax jz le_exit_error ;verify whether the content of the data section is pe writeWithNewLine createStringVerifyPE, str1, le_exit_error mov rax,[input_image] add rax,4 fastcall verifyPE, rax test rax,rax mov [image_file_header],rax jz le_exit_error ;copy pe header and sections into memory writeNewLineToLog APITable writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error mov rax,[input_image] add rax,4 mov rcx,INFILE_SIZE sub rcx,4 fastcall loadFile, [APITable], [image_file_header], rax, rcx test rax,rax mov [loaded_file],rax jz le_exit_error ;loading import table writeNewLineToLog APITable writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error fastcall loadImportTable, [APITable], [loaded_file] test rax,rax jz le_exit_error ;set the correct permissions for each section writeNewLineToLog APITable writeWithNewLine createStringSettingPermissions, str1, le_exit_error mov rax,[input_image] add rax,4 mov rcx,INFILE_SIZE sub rcx,4 fastcall setPermissions, [APITable], [image_file_header], rax, rcx test rax,rax jz le_exit_error le_exit_success: mov rax,1 ret le_exit_error: sub rax,rax ret endp ;load the APIs in the import table proc loadImportTable, APITable:QWORD, image_base:QWORD local str1[256]:BYTE, import_table:QWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE mov [APITable], rcx mov [image_base], rdx push rsi push rdi push rbx sub rsp,8 ;find import table in data directory mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew] add rax,rdx add rax,4 ;image file header now in eax add rax,sizeof.IMAGE_FILE_HEADER lea rax,[rax+IMAGE_OPTIONAL_HEADER64.DataDirectory] ;first data directory entry now in eax add rax,sizeof.IMAGE_DATA_DIRECTORY ;import data directory entry now in eax mov eax,[rax+IMAGE_DATA_DIRECTORY.VirtualAddress] add rax,rdx ;pointer to import table now in eax mov [import_table],rax writeWithNewLine createStringFoundImportTable, str1, le_exit_error writeRegisterToLog APITable, [import_table] test rax,rax jz pit_exit_error ;init null directory entry lea r8,[null_directory_entry] mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR mov al,0 pit_init_null_directory_loop: mov [r8],al inc r8 dec rcx jnz pit_init_null_directory_loop mov rbx,[import_table] ;iterate over the directory tables pit_next_directory_entry: lea rsi,[null_directory_entry] mov rdi,rbx mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR rep cmpsb je pit_exit_success ;load APIs of this directory fastcall loadImportDirectoryTable, [APITable], [image_base], rbx test rax,rax jz pit_exit_error ;next entry add rbx,sizeof.IMAGE_IMPORT_DESCRIPTOR jmp pit_next_directory_entry pit_exit_success: mov eax,1 jmp pit_exit_ret pit_exit_error: sub rax,rax pit_exit_ret: add rsp,8 pop rbx pop rdi pop rsi ret endp ;loads the APIs proc loadImportDirectoryTable, APITable:QWORD, image_base:QWORD, directory_entry:QWORD local str1[256]:BYTE, lookup_table:QWORD, import_address_table:QWORD, dll_image_base:QWORD mov [APITable],rcx mov [image_base],rdx mov [directory_entry],r8 push rbx push r12 ;write info about data directory table to logfile writeNewLineToLog APITable test rax,rax jz lidt_exit_error writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error mov rax,[directory_entry] mov eax,[rax+IMAGE_IMPORT_DESCRIPTOR.Name_] add rax,[image_base] mov rbx,rax ;pointer to dll name in ebx writeLog APITable, rax test rax,rax jz lidt_exit_error writeNewLineToLog APITable test rax,rax jz lidt_exit_error ;load the corresponding dll invoke LoadLibrary, rbx test rax,rax jz lidt_exit_error mov [dll_image_base],rax ;read pointers to the api tables mov rdx,[directory_entry] mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk] add rax,[image_base] mov [import_address_table],rax ;check whether OriginalFirstThunk exists and can be used mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk] test eax,eax jnz lidt_use_original_first_thunk ;in some binaries, OriginalFirstThunk table is empty ;in this case, use FirstThunk insteadt to fetch API names or ordinals mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk] lidt_use_original_first_thunk: add rax,[image_base] mov [lookup_table],rax ;index to current API sub r12,r12 ;iterate the lookup_table entries lidt_next_lookup_entry: mov rcx,r12 mov rax,[lookup_table] add rax,r12 ;counter is in r12 mov rax,[rax] ;get entry (64 bit in PE+) test rax,rax jz lidt_exit_success mov rbx,rax mov rcx,IMAGE_ORDINAL_FLAG64 and rax,rcx jnz lidt_byordinal lidt_byname: createStringName str1 lea rax,[str1] writeLog APITable, rax test rax,rax jz lidt_exit_error add rbx,[image_base] ;according to spec, first 32 bits are 0, therefore add is possible lea rbx,[rbx+IMAGE_IMPORT_BY_NAME.Name_] mov rax,rbx ;pointer to API name is now in rax and rbx writeLog APITable, rax test rax,rax jz lidt_exit_error writeNewLineToLog APITable test rax,rax jz lidt_exit_error ;API name pointer in rbx invoke GetProcAddress, [dll_image_base], rbx test rax,rax jz lidt_exit_error mov rbx,[import_address_table] add rbx,r12 mov [rbx],rax ;fetch next API add r12,8 ;size of entries in import lookup table and import address table is 8 in PE+ jmp lidt_next_lookup_entry lidt_byordinal: createStringOrdinal str1 lea rax,[str1] writeLog APITable, rax test rax,rax jz lidt_exit_error ;remove the ordinal flag mov rcx,IMAGE_ORDINAL_FLAG64 xor rbx,rcx mov rax,rbx writeRegisterToLog APITable, rax test rax,rax jz pit_exit_error ;API ordinal in rbx invoke GetProcAddress, [dll_image_base], rbx test rax,rax jz lidt_exit_error mov rbx,[import_address_table] add rbx,r12 mov [rbx],rax ;fetch next API add r12,8 jmp lidt_next_lookup_entry lidt_exit_success: mov rax,1 jmp lidt_exit_ret lidt_exit_error: sub rax,rax lidt_exit_ret: pop r12 pop rbx ret endp; ;sets the memory permissions for each section proc setPermissions, APITable:QWORD, image_file_header:QWORD, file_image_base:QWORD, \ file_image_size:QWORD local number_of_sections:QWORD, image_base:QWORD, section_headers:QWORD,\ pe_header_size:QWORD, str1[256]:BYTE, vprotect_ret:QWORD mov [APITable],rcx mov [image_file_header],rdx mov [file_image_base],r8 mov [file_image_size],r9 push rbx push r12 ;find section header sub rax,rax mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections] mov [number_of_sections],rax add rdx,sizeof.IMAGE_FILE_HEADER mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase] mov [image_base],rax ;search for section header lea r12,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory] mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes] mov rdx,sizeof.IMAGE_DATA_DIRECTORY mul rdx add rax,r12 ;first section header found mov [section_headers],rax mov rax,sizeof.IMAGE_SECTION_HEADER mov rdx,[number_of_sections] mul rdx ;end of section header sections found add rax,[section_headers] mov r12,[file_image_base] sub rax,r12 ;unaligned size of pe header in eax mov [pe_header_size],rax ;set pe header page read-only mov rax,[APITable] lea r12,[vprotect_ret] fastcall qword [rax+VirtualProtect], [image_base], [pe_header_size], PAGE_READONLY, r12 test rax,rax jz sp_exit_error ;some output for the user writeRegisterToLog APITable, [image_base] test rax,rax jz sp_exit_error ;set the section page permissions mov r12,[number_of_sections] mov rbx,[section_headers] sp_load_section_loop: fastcall setSection, [APITable], rbx, [image_base], [file_image_base] test rax,rax jz sp_exit_error add rbx,sizeof.IMAGE_SECTION_HEADER dec r12 jnz sp_load_section_loop sp_exit_success: mov rax,1 jmp sp_exit_ret sp_exit_error: sub rax,rax sp_exit_ret: pop r12 pop rbx ret endp; ;sets the complete image of the decrypted file writeable so ;we can copy pe header and sections into it proc loadFile, APITable:QWORD, image_file_header:QWORD, file_image_base:QWORD, \ file_image_size:QWORD local number_of_sections:QWORD, image_base:QWORD, aux:QWORD,\ str1[256]:BYTE, vprotect_ret:QWORD, section_headers:QWORD, pe_header_size:QWORD mov [APITable],rcx mov [image_file_header],rdx mov [file_image_base],r8 mov [file_image_size],r9 push rbx push rdi push rsi sub rsp,8 ;proper 16 byte stack alignment ;find section header ;mov edx,[image_file_header] sub rax,rax mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections] mov [number_of_sections],rax add rdx,sizeof.IMAGE_FILE_HEADER mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase] mov [image_base],rax ;make the complete image writable mov esi,[rdx+IMAGE_OPTIONAL_HEADER64.SizeOfImage] mov [aux],rdx ;store edx, we need it later lea rbx,[vprotect_ret] mov rax,[APITable] fastcall qword [rax+VirtualProtect], [image_base], rsi, PAGE_READWRITE, rbx test rax,rax jz lf_exit_error ;some output for the user writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error writeRegisterToLog APITable, [image_base] test rax,rax jz lf_exit_error mov rdx,[aux] ;restore rdx ;continue search for section header lea rbx,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory] mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes] mov rdx,sizeof.IMAGE_DATA_DIRECTORY mul rdx add rax,rbx ;first section header found mov [section_headers],rax mov rax,sizeof.IMAGE_SECTION_HEADER mov rdx,[number_of_sections] mul rdx ;end of section header sections found add rax,[section_headers] mov rbx,[file_image_base] sub rax,rbx ;unaligned size of pe header in eax mov [pe_header_size],rax ;copy header to memory mov rdi,[image_base] mov rsi,[file_image_base] mov rcx,[pe_header_size] rep movsb ;load the sections mov rsi,[number_of_sections] mov rbx,[section_headers] lf_load_section_loop: fastcall loadSection, [APITable], rbx, [image_base], [file_image_base] test rax,rax jz lf_exit_error add rbx,sizeof.IMAGE_SECTION_HEADER dec rsi jnz lf_load_section_loop lf_exit_success: mov rax,[image_base] jmp lf_exit_ret lf_exit_error: sub rax,rax lf_exit_ret: add rsp,8 pop rsi pop rdi pop rbx ret endp ;load the corresponding section into memory proc loadSection, APITable:QWORD, section_header:QWORD, image_base:QWORD,\ file_image_base:QWORD local str1[256]:BYTE mov [APITable],rcx mov [section_header],rdx mov [image_base],r8 mov [file_image_base],r9 push rdi push rsi ;copy from file into memory mov rdx,[section_header] mov edi,[rdx+IMAGE_SECTION_HEADER.VirtualAddress] add rdi,[image_base] mov esi,[rdx+IMAGE_SECTION_HEADER.PointerToRawData] add rsi,[file_image_base] mov ecx,[rdx+IMAGE_SECTION_HEADER.SizeOfRawData] rep movsb ;print some infos to the log file createStringLoaded str1 lea rax,[str1] writeLog APITable, rax test rax,rax jz ls_exit_error lea rdi,[str1] mov byte [rdi+8],0 mov rdx,[section_header] lea rsi,[rdx+IMAGE_SECTION_HEADER._Name] mov rcx,8 push rdi rep movsb pop rdi writeLog APITable, rdi writeNewLineToLog APITable mov rdx,[section_header] mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress] add rax,[image_base] writeRegisterToLog APITable, rax ls_exit_success: mov rax,1 jmp ls_exit_ret ls_exit_error: sub rax,rax ls_exit_ret: pop rsi pop rdi ret endp ;set the memory page permission for the corresponding section proc setSection, APITable:QWORD, section_header:QWORD, image_base:QWORD,\ file_image_base:QWORD local section_flags:QWORD, vprotect_ret:QWORD, str1[256]:BYTE mov [APITable],rcx mov [section_header],rdx mov [image_base],r8 mov [file_image_base],r9 push rbx push r12 ;section execute/read/write? mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE jne ssn_no_execute_read_write mov rax,PAGE_EXECUTE_READWRITE mov [section_flags],rax jmp ssn_set_memory ssn_no_execute_read_write: ;section execute/read? mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ jne ssn_no_execute_read mov rax,PAGE_EXECUTE_READ mov [section_flags],rax jmp ssn_set_memory ssn_no_execute_read: ;section read/write? mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE jne ssn_no_read_write mov rax,PAGE_READWRITE mov [section_flags],rax jmp ssn_set_memory ssn_no_read_write: ;section read? mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_READ cmp ebx,IMAGE_SCN_MEM_READ jne ssn_no_read mov rax,PAGE_READONLY mov [section_flags],rax jmp ssn_set_memory ssn_no_read: mov rax,PAGE_NOACCESS mov [section_flags],rax ;set section permissions ssn_set_memory: mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress] add rax,[image_base] mov ebx,[rdx+IMAGE_SECTION_HEADER.VirtualSize] mov r10,[APITable] lea r12,[vprotect_ret] fastcall qword [r10+VirtualProtect],rax,rbx,[section_flags], r12 test rax,rax jz ssn_exit_error ;some output for the user mov rdx,[section_header] mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress] add rax,[image_base] writeRegisterToLog APITable, rax ssn_exit_success: mov rax,1 jmp ssn_exit_ret ssn_exit_error: sub rax,rax ssn_exit_ret: pop r12 pop rbx ret endp; ;check MZ und PE signature and return start of the image file header proc verifyPE, image_base:QWORD mov [image_base], rcx mov ax,[rcx+IMAGE_DOS_HEADER.e_magic] cmp ax,IMAGE_DOS_SIGNATURE jne vpe_exit_error mov eax,[rcx+IMAGE_DOS_HEADER.e_lfanew] add rcx,rax mov eax,dword [rcx] cmp eax,IMAGE_NT_SIGNATURE jne vpe_exit_error add rcx,4 vpe_exit_success: mov rax,rcx ret vpe_exit_error: sub rax,rax ret endp ;First 4 bytes of data seciton contain a checksum ;Verify that the checksum is correct ;TODO: CHECKSUM SIZE is atm hardcoded proc verifyChecksum, section_address:QWORD, section_size:QWORD mov [section_address],rcx mov [section_size],rdx push rbx push rdi mov rbx,[section_address] mov eax,[rbx] add rbx,4 mov rcx,[section_size] sub rcx,4 ;checksum is in eax ;pointer to file in ebx ;size of file in ecx sub rdi,rdi vs_calc_cs: sub rdx,rdx mov dl,byte [rbx] add edi,edx inc rbx dec rcx jnz vs_calc_cs ;calculated checksum is in edi cmp edi,eax jne vs_exit_error vs_exit_success: mov eax,1 jmp vs_exit_ret vs_exit_error: sub eax,eax vs_exit_ret: pop rdi pop rbx ret endp Hyperion-2.0/Src/Container/32/0000755000175000017500000000000013476706334015422 5ustar sophiesophieHyperion-2.0/Src/Container/32/loadapis.asm0000755000175000017500000000667013476706334017734 0ustar sophiesophie;Dynamically load the needed APIs ;Strings are created on stack ;dllname: zero terminated string with dll name ;store: save the dll image base here ;Jumps to LoadLogAPIsExit if an Error Occurs macro loadDLL dllname, store, exit { lea eax,[dllname] invoke LoadLibrary,eax test eax,eax jz exit mov [store],eax } ;functionname: zero terminated string with functions name ;dll_imagebase: imagebase of the dll ;returns: function pointer in eax macro loadAPI functionname, dll_imagebase, exit { lea eax,[functionname] invoke GetProcAddress,dword [dll_imagebase],eax test eax,eax jz exit } ;Loads all necessary APISs proc loadRegularAPIs stdcall APITable:DWORD local str1[256]:BYTE, kernel32_imagebase:DWORD pushad writeWithNewLine createStringLoading, str1, LoadRegularAPIsExit_Error ;Get Kernel32.Dll Imagebase writeWithNewLine createStringKernel32, str1, LoadRegularAPIsExit_Error loadDLL str1, kernel32_imagebase, LoadRegularAPIsExit_Error ;Load GetModuleHandle writeWithNewLine createStringGetModuleHandle, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov edx,[APITable] mov [edx+GetModuleHandle],eax ;Load VirtualAlloc writeWithNewLine createStringVirtualAlloc, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov edx,[APITable] mov [edx+VirtualAlloc],eax ;Load VirtualProtect writeWithNewLine createStringVirtualProtect, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov edx,[APITable] mov [edx+VirtualProtect],eax ;Load VirtualFree writeWithNewLine createStringVirtualFree, str1, LoadRegularAPIsExit_Error loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error mov edx,[APITable] mov [edx+VirtualFree],eax popad mov eax,1 ret LoadRegularAPIsExit_Error: popad mov eax,0 ret endp ;Loads the basic functions for log file access proc loadLogAPIs stdcall APITable:DWORD local str1[256]:BYTE, kernel32_imagebase:DWORD pushad ;Get Kernel32.Dll Imagebase createStringKernel32 str1 loadDLL str1, kernel32_imagebase, LoadLogAPIsExit_Error ;Load CreateFileMapping API createStringCreateFileMapping str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+CreateFileMapping],eax ;Load MapViewOfFile API createStringMapViewOfFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+MapViewOfFile],eax ;Load UnmapViewOfFile API createStringUnmapViewOfFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+UnmapViewOfFile],eax ;Load UnmapViewOfFile API createStringCreateFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+CreateFile],eax ;Load CloseHandle API createStringCloseHandle str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+CloseHandle],eax ;Load GetFileSize API createStringGetFileSize str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+GetFileSize],eax ;Load DeleteFile API createStringDeleteFile str1 loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error mov edx,[APITable] mov [edx+DeleteFile],eax ;apis loaded successfully popad mov eax,1 ret LoadLogAPIsExit_Error: popad mov eax,0 ret endp Hyperion-2.0/Src/Container/32/logfile_disable.asm0000755000175000017500000000077513476706334021244 0ustar sophiesophie;writes a string and a newline to the logfile macro writeWithNewLine char_sequence, char_buffer, error_exit{ char_sequence char_buffer mov eax,1 } ;write a string to the logfile macro writeLog apitable, content{ mov eax,1 } ;delete old log file and create a new one macro initLogFile apitable{ mov eax,1 } ;write a newline into logfile macro writeNewLineToLog apitable{ mov eax,1 } ;write a register value into logile macro writeRegisterToLog apitable, value{ mov eax,1 }Hyperion-2.0/Src/Container/32/main.asm0000755000175000017500000000612113476706334017053 0ustar sophiesophie; Hyperion 32-Bit container.exe include 'image_base.inc' format PE GUI 4.0 at IMAGE_BASE entry start include '..\..\..\Fasm\INCLUDE\win32a.inc' include 'hyperion.inc' include 'createstrings.inc' include 'pe.inc' ;automatically generated by hyperion cpp stub include 'key_size.inc' include 'infile_size.inc' include 'image_size.inc' ;--- ;this contains the decrypted and loaded executable section '.bss' data readable writeable decrypted_infile: db IMAGE_SIZE dup (?) ;-------------------------------------------------- ;this contains the encrypted exe section '.data' data readable writeable encrypted_infile: include 'infile_array.inc' ;-------------------------------------------------- section '.text' code readable executable ;include necessary functions include 'logfile_select.asm' include 'loadapis.asm' include 'loadexecutable.asm' ;automatically generated by hyperion cpp stub include 'decryption_payload.asm' ;--- start: stdcall MainMethod invoke ExitProcess,0 proc MainMethod stdcall local str1[256]:BYTE,\ APITable:DWORD,\ CreateFileMapping_:DWORD,\ MapViewOfFile_:DWORD,\ UnmapViewOfFile_:DWORD,\ CreateFile_:DWORD,\ CloseHandle_:DWORD,\ DeleteFile_:DWORD,\ GetModuleHandle_:DWORD,\ VirtualAlloc_:DWORD,\ VirtualProtect_:DWORD,\ VirtualFree_:DWORD ;pointer to the API table lea eax,[CreateFileMapping_] mov [APITable],eax ;load APIs for log file access stdcall loadLogAPIs,[APITable] test eax,eax jz main_exiterrornolog ;create logfile and write initial message into it initLogFile APITable test eax,eax jz main_exiterrornolog ;load all necessary APIs stdcall loadRegularAPIs, [APITable] test eax,eax jz main_exiterror writeNewLineToLog APITable test eax,eax jz main_exiterror ;decrypt exe in data section stdcall decryptExecutable, [APITable], encrypted_infile test eax,eax jz main_exiterror ;load the executable at its image base ;(this will overwrite current MZ header and bss section) stdcall loadExecutable, [APITable], encrypted_infile test eax,eax jz main_exiterror ;start program execution mov edx,IMAGE_BASE mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew] add eax,edx add eax,4 ;image file header now in eax add eax,sizeof.IMAGE_FILE_HEADER mov eax,[eax+IMAGE_OPTIONAL_HEADER32.AddressOfEntryPoint] add eax,IMAGE_BASE ;entry point of original exe is now in eax jmp eax ;finished without errors main_exitsuccess: writeNewLineToLog APITable createStringDone str1 lea eax,[str1] writeLog APITable, eax ret ;finished with errors after logfile API loading main_exiterror: writeNewLineToLog APITable createStringError str1 lea eax,[str1] writeLog APITable, eax ret ;finished with errors before logfile API loading main_exiterrornolog: ret endp ;import table section '.idata' import data readable writeable library kernel,'KERNEL32.DLL' import kernel,\ GetProcAddress,'GetProcAddress',\ LoadLibrary,'LoadLibraryA',\ ExitProcess,'ExitProcess' Hyperion-2.0/Src/Container/32/hyperion.inc0000755000175000017500000000074713476706334017765 0ustar sophiesophieCreateFileMapping equ 0 MapViewOfFile equ CreateFileMapping + 4 UnmapViewOfFile equ MapViewOfFile + 4 CreateFile equ UnmapViewOfFile + 4 CloseHandle equ CreateFile + 4 GetFileSize equ CloseHandle + 4 DeleteFile equ GetFileSize + 4 GetModuleHandle equ DeleteFile + 4 VirtualAlloc equ GetModuleHandle + 4 VirtualProtect equ VirtualAlloc + 4 VirtualFree equ VirtualProtect + 4 SIZE_DATA_SECTION_NAME equ 5 SIZE_CHECKSUM equ 4Hyperion-2.0/Src/Container/32/createstrings.inc0000755000175000017500000003000013476706334020766 0ustar sophiesophiemacro createStringBruteforcing location { mov [location+0],'B' mov [location+1],'r' mov [location+2],'u' mov [location+3],'t' mov [location+4],'e' mov [location+5],'f' mov [location+6],'o' mov [location+7],'r' mov [location+8],'c' mov [location+9],'i' mov [location+10],'n' mov [location+11],'g' mov [location+12],' ' mov [location+13],'K' mov [location+14],'e' mov [location+15],'y' mov [location+16],0 } macro createStringSettingPermissions location { mov [location+0],'S' mov [location+1],'e' mov [location+2],'t' mov [location+3],'t' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'S' mov [location+9],'e' mov [location+10],'c' mov [location+11],'t' mov [location+12],'i' mov [location+13],'o' mov [location+14],'n' mov [location+15],' ' mov [location+16],'P' mov [location+17],'e' mov [location+18],'r' mov [location+19],'m' mov [location+20],'i' mov [location+21],'s' mov [location+22],'s' mov [location+23],'i' mov [location+24],'o' mov [location+25],'n' mov [location+26],'s' mov [location+27],0 } macro createStringOrdinal location { mov [location+0],'O' mov [location+1],'r' mov [location+2],'d' mov [location+3],'i' mov [location+4],'n' mov [location+5],'a' mov [location+6],'l' mov [location+7],':' mov [location+8],' ' mov [location+9],0 } macro createStringName location { mov [location+0],'N' mov [location+1],'a' mov [location+2],'m' mov [location+3],'e' mov [location+4],':' mov [location+5],' ' mov [location+6],0 } macro createStringProcessImportDirectory location { mov [location+0],'P' mov [location+1],'r' mov [location+2],'o' mov [location+3],'c' mov [location+4],'e' mov [location+5],'s' mov [location+6],'s' mov [location+7],'i' mov [location+8],'n' mov [location+9],'g' mov [location+10],' ' mov [location+11],'I' mov [location+12],'m' mov [location+13],'p' mov [location+14],'o' mov [location+15],'r' mov [location+16],'t' mov [location+17],' ' mov [location+18],'D' mov [location+19],'i' mov [location+20],'r' mov [location+21],'e' mov [location+22],'c' mov [location+23],'t' mov [location+24],'o' mov [location+25],'r' mov [location+26],'y' mov [location+27],':' mov [location+28],0 } macro createStringFoundImportTable location { mov [location+0],'I' mov [location+1],'m' mov [location+2],'p' mov [location+3],'o' mov [location+4],'r' mov [location+5],'t' mov [location+6],' ' mov [location+7],'T' mov [location+8],'a' mov [location+9],'b' mov [location+10],'l' mov [location+11],'e' mov [location+12],':' mov [location+13],0 } macro createStringLoadingFilesAPIs location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'A' mov [location+9],'P' mov [location+10],'I' mov [location+11],'s' mov [location+12],0 } macro createStringMappingFileInMemory location { mov [location+0],'M' mov [location+1],'a' mov [location+2],'p' mov [location+3],'p' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'F' mov [location+9],'i' mov [location+10],'l' mov [location+11],'e' mov [location+12],' ' mov [location+13],'i' mov [location+14],'n' mov [location+15],'t' mov [location+16],'o' mov [location+17],' ' mov [location+18],'M' mov [location+19],'e' mov [location+20],'m' mov [location+21],'o' mov [location+22],'r' mov [location+23],'y' mov [location+24],0 } macro createStringLoaded location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'e' mov [location+5],'d' mov [location+6],' ' mov [location+7],0 } macro createStringLoadedPEHeader location { mov [location+0],'S' mov [location+1],'e' mov [location+2],'t' mov [location+3],' ' mov [location+4],'I' mov [location+5],'m' mov [location+6],'a' mov [location+7],'g' mov [location+8],'e' mov [location+9],' ' mov [location+10],'w' mov [location+11],'r' mov [location+12],'i' mov [location+13],'t' mov [location+14],'a' mov [location+15],'b' mov [location+16],'l' mov [location+17],'e' mov [location+18],':' mov [location+19],0 } macro createStringVerifyPE location { mov [location+0],'V' mov [location+1],'e' mov [location+2],'r' mov [location+3],'i' mov [location+4],'f' mov [location+5],'y' mov [location+6],'i' mov [location+7],'n' mov [location+8],'g' mov [location+9],' ' mov [location+10],'P' mov [location+11],'E' mov [location+12],0 } macro createStringVerifyChecksum location { mov [location+0],'V' mov [location+1],'e' mov [location+2],'r' mov [location+3],'i' mov [location+4],'f' mov [location+5],'y' mov [location+6],'i' mov [location+7],'n' mov [location+8],'g' mov [location+9],' ' mov [location+10],'C' mov [location+11],'h' mov [location+12],'e' mov [location+13],'c' mov [location+14],'k' mov [location+15],'s' mov [location+16],'u' mov [location+17],'m' mov [location+18],0 } macro createStringDone location { mov [location+0],'D' mov [location+1],'o' mov [location+2],'n' mov [location+3],'e' mov [location+4],0 } macro createStringLoading location { mov [location+0],'L' mov [location+1],'o' mov [location+2],'a' mov [location+3],'d' mov [location+4],'i' mov [location+5],'n' mov [location+6],'g' mov [location+7],' ' mov [location+8],'A' mov [location+9],'P' mov [location+10],'I' mov [location+11],'s' mov [location+12],':' mov [location+13],0 } macro createStringError location { mov [location+0],'E' mov [location+1],'r' mov [location+2],'r' mov [location+3],'o' mov [location+4],'r' mov [location+5],0 } macro createStringStartingHyperion location { mov [location+00],'H' mov [location+01],'y' mov [location+02],'p' mov [location+03],'e' mov [location+04],'r' mov [location+05],'i' mov [location+06],'o' mov [location+07],'n' mov [location+08],' ' mov [location+09],'L' mov [location+10],'o' mov [location+11],'g' mov [location+12],'f' mov [location+13],'i' mov [location+14],'l' mov [location+15],'e' mov [location+16],13 mov [location+17],10 mov [location+18],0 } macro createStringStartingHyperionLines location { mov [location+00],'-' mov [location+01],'-' mov [location+02],'-' mov [location+03],'-' mov [location+04],'-' mov [location+05],'-' mov [location+06],'-' mov [location+07],'-' mov [location+08],'-' mov [location+09],'-' mov [location+10],'-' mov [location+11],'-' mov [location+12],'-' mov [location+13],'-' mov [location+14],'-' mov [location+15],'-' mov [location+16],13 mov [location+17],10 mov [location+18],0 } macro createStringLogTxt location { mov [location+0],'l' mov [location+1],'o' mov [location+2],'g' mov [location+3],'.' mov [location+4],'t' mov [location+5],'x' mov [location+6],'t' mov [location+7],0 } macro createStringKernel32 location { mov [location+00],'k' mov [location+01],'e' mov [location+02],'r' mov [location+03],'n' mov [location+04],'e' mov [location+05],'l' mov [location+06],'3' mov [location+07],'2' mov [location+08],'.' mov [location+09],'d' mov [location+10],'l' mov [location+11],'l' mov [location+12],0 } macro createStringCreateFileMapping location { mov [location+00],'C' mov [location+01],'r' mov [location+02],'e' mov [location+03],'a' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'M' mov [location+11],'a' mov [location+12],'p' mov [location+13],'p' mov [location+14],'i' mov [location+15],'n' mov [location+16],'g' mov [location+17],'A' mov [location+18],0 } macro createStringMapViewOfFile location { mov [location+00],'M' mov [location+01],'a' mov [location+02],'p' mov [location+03],'V' mov [location+04],'i' mov [location+05],'e' mov [location+06],'w' mov [location+07],'O' mov [location+08],'f' mov [location+09],'F' mov [location+10],'i' mov [location+11],'l' mov [location+12],'e' mov [location+13],0 } macro createStringUnmapViewOfFile location { mov [location+00],'U' mov [location+01],'n' mov [location+02],'m' mov [location+03],'a' mov [location+04],'p' mov [location+05],'V' mov [location+06],'i' mov [location+07],'e' mov [location+08],'w' mov [location+09],'O' mov [location+10],'f' mov [location+11],'F' mov [location+12],'i' mov [location+13],'l' mov [location+14],'e' mov [location+15],0 } macro createStringCreateFile location { mov [location+00],'C' mov [location+01],'r' mov [location+02],'e' mov [location+03],'a' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'A' mov [location+11],0 } macro createStringCloseHandle location { mov [location+00],'C' mov [location+01],'l' mov [location+02],'o' mov [location+03],'s' mov [location+04],'e' mov [location+05],'H' mov [location+06],'a' mov [location+07],'n' mov [location+08],'d' mov [location+09],'l' mov [location+10],'e' mov [location+11],0 } macro createStringGetFileSize location { mov [location+00],'G' mov [location+01],'e' mov [location+02],'t' mov [location+03],'F' mov [location+04],'i' mov [location+05],'l' mov [location+06],'e' mov [location+07],'S' mov [location+08],'i' mov [location+09],'z' mov [location+10],'e' mov [location+11],0 } macro createStringDeleteFile location { mov [location+00],'D' mov [location+01],'e' mov [location+02],'l' mov [location+03],'e' mov [location+04],'t' mov [location+05],'e' mov [location+06],'F' mov [location+07],'i' mov [location+08],'l' mov [location+09],'e' mov [location+10],'A' mov [location+11],0 } macro createStringGetModuleHandle location { mov [location+00],'G' mov [location+01],'e' mov [location+02],'t' mov [location+03],'M' mov [location+04],'o' mov [location+05],'d' mov [location+06],'u' mov [location+07],'l' mov [location+08],'e' mov [location+09],'H' mov [location+10],'a' mov [location+11],'n' mov [location+12],'d' mov [location+13],'l' mov [location+14],'e' mov [location+15],'A' mov [location+16],0 } macro createStringVirtualAlloc location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'A' mov [location+08],'l' mov [location+09],'l' mov [location+10],'o' mov [location+11],'c' mov [location+12],0 } macro createStringVirtualProtect location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'P' mov [location+08],'r' mov [location+09],'o' mov [location+10],'t' mov [location+11],'e' mov [location+12],'c' mov [location+13],'t' mov [location+14],0 } macro createStringVirtualFree location { mov [location+00],'V' mov [location+01],'i' mov [location+02],'r' mov [location+03],'t' mov [location+04],'u' mov [location+05],'a' mov [location+06],'l' mov [location+07],'F' mov [location+08],'r' mov [location+09],'e' mov [location+10],'e' mov [location+11],0 } Hyperion-2.0/Src/Container/32/logfile_enable.asm0000755000175000017500000001233613476706334021063 0ustar sophiesophie;------------------------------------------- ;the content of this file is excluded, | ;when the user disables logging features | ;in hyperion command line. pls keep in mind | ;and dont rely on its existence. | ;------------------------------------------- ;--- Begin Macro Section --- ;writes a string and a newline to the logfile macro writeWithNewLine char_sequence, char_buffer, error_exit { char_sequence char_buffer lea eax,[str1] stdcall writeLog_,[APITable],eax test eax,eax jz error_exit stdcall writeNewLineToLog_,[APITable] test eax,eax jz error_exit } ;write a string to the logfile macro writeLog apitable, content{ stdcall writeLog_,[apitable], content } ;delete old log file and create a new one macro initLogFile apitable{ stdcall initLogFile_, [apitable] } ;write a newline into logfile macro writeNewLineToLog apitable{ stdcall writeNewLineToLog_, [apitable] } ;write a register value into logile macro writeRegisterToLog apitable, value{ stdcall writeRegisterToLog_, [apitable], value } ;--- End Macro Section --- ;write into log.txt ;returns false if an eerror occurs proc writeLog_ stdcall APITable:DWORD, content:DWORD local str1[256]:BYTE, oldlogsize:DWORD, newlogsize:DWORD, contentsize:DWORD,\ filehandle:DWORD, filemappingobject:DWORD, mapaddress:DWORD, retval:DWORD pushad ;open file createStringLogTxt str1 mov eax,[APITable] lea ebx,[str1] sub edx,edx stdcall dword [eax+CreateFile], ebx, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, edx, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, edx mov [retval],eax test eax,eax jz wl_logexit mov [filehandle],eax ;get logfile size mov eax,[APITable] stdcall dword [eax+GetFileSize], dword [filehandle], 0 mov [oldlogsize],eax ;get size of string for logfile for concatenation stdcall strlen_, dword [content] mov [contentsize], eax add eax,dword [oldlogsize] mov [newlogsize], eax ;create the file mapping sub ebx,ebx mov edx,[APITable] stdcall dword [edx+CreateFileMapping], dword [filehandle], ebx, PAGE_READWRITE, ebx, eax, ebx mov [retval],eax test eax, eax jz wl_closelogfile mov [filemappingobject],eax sub ebx,ebx mov edx,[APITable] stdcall dword [edx+MapViewOfFile], eax, FILE_MAP_ALL_ACCESS, ebx, ebx, dword [newlogsize] mov [retval],eax test eax, eax jz wl_closemaphandle mov [mapaddress],eax ;copy string into map add eax,[oldlogsize] mov edi,eax mov esi,[content] mov ecx,[contentsize] repz movsb mov [retval],1 wl_unmapfile: mov edx,[APITable] stdcall dword [edx+UnmapViewOfFile], dword [mapaddress] wl_closemaphandle: mov edx,[APITable] stdcall dword [edx+CloseHandle], dword [filemappingobject] wl_closelogfile: mov eax,[APITable] stdcall dword [eax+CloseHandle], dword [filehandle] wl_logexit: popad mov eax,[retval] ret; endp ;adds a to the logfile ;returns false if an error occurs proc writeNewLineToLog_ APITable:DWORD local str1[3]:BYTE lea eax,[str1] mov byte [eax+0],13 mov byte [eax+1],10 mov byte [eax+2],0 stdcall writeLog_, [APITable], eax ret endp ;adds "" to the logfile ;returns false if an error occurs proc writeRegisterToLog_ stdcall APITable:DWORD, Value:DWORD local str1[10]:BYTE, retval:DWORD pushad lea eax,[str1] stdcall binToString_, eax, [Value] stdcall writeLog_,[APITable],eax mov [retval],eax test eax,eax jz wrtl_exit stdcall writeNewLineToLog_,[APITable] mov [retval],eax test eax,eax jz wrtl_exit wrtl_exit: popad mov eax,[retval] ret endp ;converts into an 8 byte string and stores it proc binToString_ stdcall buffer:DWORD, bin:DWORD pushad mov ebx,[bin] mov ecx,8 bts_next_byte: mov eax,ebx and eax,0000000fh cmp eax,9 jg bts_add_55 bts_add_48: add eax,48 jmp bts_store_bin bts_add_55: add eax,55 bts_store_bin: dec ecx mov edx,[buffer] mov byte [ecx+edx],al test ecx,ecx jz bts_finished_conversion shr ebx,4 jmp bts_next_byte bts_finished_conversion: mov eax,[buffer] mov byte [eax+8],0 popad ret endp ;get the length of a string proc strlen_ stdcall string_ptr:DWORD push edi push ecx mov edi,[string_ptr] sub ecx, ecx sub al, al not ecx cld repne scasb not ecx dec ecx mov eax,ecx pop ecx pop edi ret endp ;Write initial message into logfile proc initLogFile_ stdcall APITable:DWORD local str1[256]:BYTE pushad createStringLogTxt str1 mov eax,[APITable] lea ebx,[str1] stdcall dword [eax+DeleteFile],ebx createStringStartingHyperionLines str1 lea eax,[str1] stdcall writeLog_,[APITable],eax test eax,eax jz ilf_exit_error createStringStartingHyperion str1 lea eax,[str1] stdcall writeLog_,[APITable],eax test eax,eax jz ilf_exit_error createStringStartingHyperionLines str1 lea eax,[str1] stdcall writeLog_,[APITable],eax test eax,eax jz ilf_exit_error stdcall writeNewLineToLog_,[APITable] test eax,eax jz ilf_exit_error ilf_exit_success: popad mov eax,1 ret ilf_exit_error: popad sub eax,eax ret endpHyperion-2.0/Src/Container/32/pe.inc0000755000175000017500000002471213476706334016532 0ustar sophiesophieIMAGE_DOS_SIGNATURE = 05A4Dh IMAGE_OS2_SIGNATURE = 0454Eh IMAGE_OS2_SIGNATURE_LE = 0454Ch IMAGE_VXD_SIGNATURE = 0454Ch IMAGE_LX_SIGNATURE = 0584Ch IMAGE_NT_SIGNATURE = 04550h IMAGE_FILE_MACHINE_UNKNOWN = 0 IMAGE_FILE_MACHINE_I386 = 014ch IMAGE_FILE_MACHINE_R3000 = 0162h IMAGE_FILE_MACHINE_R4000 = 0166h IMAGE_FILE_MACHINE_R10000 = 0168h IMAGE_FILE_MACHINE_WCEMIPSV2 = 0169h IMAGE_FILE_MACHINE_ALPHA = 0184h IMAGE_FILE_MACHINE_SH3 = 01a2h IMAGE_FILE_MACHINE_SH3DSP = 01a3h IMAGE_FILE_MACHINE_SH3E = 01a4h IMAGE_FILE_MACHINE_SH4 = 01a6h IMAGE_FILE_MACHINE_SH5 = 01a8h IMAGE_FILE_MACHINE_ARM = 01c0h IMAGE_FILE_MACHINE_THUMB = 01c2h IMAGE_FILE_MACHINE_AM33 = 01d3h IMAGE_FILE_MACHINE_POWERPC = 01F0h IMAGE_FILE_MACHINE_POWERPCFP = 01f1h IMAGE_FILE_MACHINE_IA64 = 0200h IMAGE_FILE_MACHINE_MIPS16 = 0266h IMAGE_FILE_MACHINE_ALPHA64 = 0284h IMAGE_FILE_MACHINE_MIPSFPU = 0366h IMAGE_FILE_MACHINE_MIPSFPU16 = 0466h IMAGE_FILE_MACHINE_AXP64 = IMAGE_FILE_MACHINE_ALPHA64 IMAGE_FILE_MACHINE_TRICORE = 0520h IMAGE_FILE_MACHINE_CEF = 0CEFh IMAGE_FILE_MACHINE_EBC = 0EBCh IMAGE_FILE_MACHINE_AMD64 = 8664h IMAGE_FILE_MACHINE_M32R = 9041h IMAGE_FILE_MACHINE_CEE = 0C0EEh IMAGE_SIZEOF_NT_OPTIONAL32_HEADER = 224 IMAGE_NT_OPTIONAL_HDR32_MAGIC = 10bh IMAGE_FILE_RELOCS_STRIPPED = 0001h IMAGE_FILE_EXECUTABLE_IMAGE = 0002h IMAGE_FILE_LINE_NUMS_STRIPPED = 0004h IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0008h IMAGE_FILE_AGGRESIVE_WS_TRIM = 0010h IMAGE_FILE_LARGE_ADDRESS_AWARE = 0020h IMAGE_FILE_BYTES_REVERSED_LO = 0080h IMAGE_FILE_32BIT_MACHINE = 0100h IMAGE_FILE_DEBUG_STRIPPED = 0200h IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0400h IMAGE_FILE_NET_RUN_FROM_SWAP = 0800h IMAGE_FILE_SYSTEM = 1000h IMAGE_FILE_DLL = 2000h IMAGE_FILE_UP_SYSTEM_ONLY = 4000h IMAGE_FILE_BYTES_REVERSED_HI = 8000h IMAGE_SUBSYSTEM_UNKNOWN = 0 IMAGE_SUBSYSTEM_NATIVE = 1 IMAGE_SUBSYSTEM_WINDOWS_GUI = 2 IMAGE_SUBSYSTEM_WINDOWS_CUI = 3 IMAGE_SUBSYSTEM_OS2_CUI = 5 IMAGE_SUBSYSTEM_POSIX_CUI = 7 IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8 IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9 IMAGE_SUBSYSTEM_EFI_APPLICATION = 10 IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11 IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12 IMAGE_SUBSYSTEM_EFI_ROM = 13 IMAGE_SUBSYSTEM_XBOX = 14 IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16 IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0040h IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0080h IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0100h IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0200h IMAGE_DLLCHARACTERISTICS_NO_SEH = 0400h IMAGE_DLLCHARACTERISTICS_NO_BIND = 0800h IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 2000h IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 8000h IMAGE_DIRECTORY_ENTRY_EXPORT = 0 IMAGE_DIRECTORY_ENTRY_IMPORT = 1 IMAGE_DIRECTORY_ENTRY_RESOURCE = 2 IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3 IMAGE_DIRECTORY_ENTRY_SECURITY = 4 IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 IMAGE_DIRECTORY_ENTRY_DEBUG = 6 IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7 IMAGE_DIRECTORY_ENTRY_ARCHITECTURE = 7 IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8 IMAGE_DIRECTORY_ENTRY_TLS = 9 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11 IMAGE_DIRECTORY_ENTRY_IAT = 12 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14 IMAGE_SIZEOF_SECTION_HEADER = 40 IMAGE_SCN_TYPE_NO_PAD = 00000008h IMAGE_SCN_CNT_CODE = 00000020h IMAGE_SCN_CNT_INITIALIZED_DATA = 00000040h IMAGE_SCN_CNT_UNINITIALIZED_DATA = 00000080h IMAGE_SCN_LNK_OTHER = 00000100h IMAGE_SCN_LNK_INFO = 00000200h IMAGE_SCN_LNK_REMOVE = 00000800h IMAGE_SCN_LNK_COMDAT = 00001000h IMAGE_SCN_NO_DEFER_SPEC_EXC = 00004000h IMAGE_SCN_GPREL = 00008000h IMAGE_SCN_MEM_FARDATA = 00008000h IMAGE_SCN_MEM_PURGEABLE = 00020000h IMAGE_SCN_MEM_16BIT = 00020000h IMAGE_SCN_MEM_LOCKED = 00040000h IMAGE_SCN_MEM_PRELOAD = 00080000h IMAGE_SCN_ALIGN_1BYTES = 00100000h IMAGE_SCN_ALIGN_2BYTES = 00200000h IMAGE_SCN_ALIGN_4BYTES = 00300000h IMAGE_SCN_ALIGN_8BYTES = 00400000h IMAGE_SCN_ALIGN_16BYTES = 00500000h IMAGE_SCN_ALIGN_32BYTES = 00600000h IMAGE_SCN_ALIGN_64BYTES = 00700000h IMAGE_SCN_ALIGN_128BYTES = 00800000h IMAGE_SCN_ALIGN_256BYTES = 00900000h IMAGE_SCN_ALIGN_512BYTES = 00A00000h IMAGE_SCN_ALIGN_1024BYTES = 00B00000h IMAGE_SCN_ALIGN_2048BYTES = 00C00000h IMAGE_SCN_ALIGN_4096BYTES = 00D00000h IMAGE_SCN_ALIGN_8192BYTES = 00E00000h IMAGE_SCN_LNK_NRELOC_OVFL = 01000000h IMAGE_SCN_MEM_DISCARDABLE = 02000000h IMAGE_SCN_MEM_NOT_CACHED = 04000000h IMAGE_SCN_MEM_NOT_PAGED = 08000000h IMAGE_SCN_MEM_SHARED = 10000000h IMAGE_SCN_MEM_EXECUTE = 20000000h IMAGE_SCN_MEM_READ = 40000000h IMAGE_SCN_MEM_WRITE = 80000000h IMAGE_SCN_SCALE_INDEX = 00000001h struct IMAGE_DOS_HEADER e_magic dw ? e_cblp dw ? e_cp dw ? e_crlc dw ? e_cparhdr dw ? e_minalloc dw ? e_maxalloc dw ? e_ss dw ? e_sp dw ? e_csum dw ? e_ip dw ? e_cs dw ? e_lfarlc dw ? e_ovno dw ? e_res rw 4 e_oemid dw ? e_oeminfo dw ? e_res2 rw 10 e_lfanew dd ? ends struct IMAGE_FILE_HEADER Machine dw ? NumberOfSections dw ? TimeDateStamp dd ? PointerToSymbolTable dd ? NumberOfSymbols dd ? SizeOfOptionalHeader dw ? Characteristics dw ? ends struct IMAGE_DATA_DIRECTORY VirtualAddress dd ? isize dd ? ends IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 struct IMAGE_OPTIONAL_HEADER32 Magic dw ? MajorLinkerVersion db ? MinorLinkerVersion db ? SizeOfCode dd ? SizeOfInitializedData dd ? SizeOfUninitializedData dd ? AddressOfEntryPoint dd ? BaseOfCode dd ? BaseOfData dd ? ImageBase dd ? SectionAlignment dd ? FileAlignment dd ? MajorOperatingSystemVersion dw ? MinorOperatingSystemVersion dw ? MajorImageVersion dw ? MinorImageVersion dw ? MajorSubsystemVersion dw ? MinorSubsystemVersion dw ? Win32VersionValue dd ? SizeOfImage dd ? SizeOfHeaders dd ? CheckSum dd ? Subsystem dw ? DllCharacteristics dw ? SizeOfStackReserve dd ? SizeOfStackCommit dd ? SizeOfHeapReserve dd ? SizeOfHeapCommit dd ? LoaderFlags dd ? NumberOfRvaAndSizes dd ? DataDirectory rb (sizeof.IMAGE_DATA_DIRECTORY*IMAGE_NUMBEROF_DIRECTORY_ENTRIES) ends struct IMAGE_NT_HEADERS32 Signature dd ? FileHeader IMAGE_FILE_HEADER ? OptionalHeader IMAGE_OPTIONAL_HEADER32 ? ends IMAGE_SIZEOF_SHORT_NAME = 8 struct IMAGE_SECTION_HEADER _Name db IMAGE_SIZEOF_SHORT_NAME dup (?) union PhysicalAddress dd ? VirtualSize dd ? ends VirtualAddress dd ? SizeOfRawData dd ? PointerToRawData dd ? PointerToRelocations dd ? PointerToLinenumbers dd ? NumberOfRelocations dw ? NumberOfLinenumbers dw ? Characteristics dd ? ends struct IMAGE_EXPORT_DIRECTORY Characteristics dd ? TimeDateStamp dd ? MajorVersion dw ? MinorVersion dw ? Name_ dd ? Base dd ? NumberOfFunctions dd ? NumberOfNames dd ? AddressOfFunctions dd ? AddressOfNames dd ? AddressOfNameOrdinals dd ? ends struct IMAGE_IMPORT_DESCRIPTOR union Characteristics dd ? OriginalFirstThunk dd ? ends TimeDateStamp dd ? ForwarderChain dd ? Name_ dd ? FirstThunk dd ? ends struct IMAGE_THUNK_DATA32 union ForwarderString dd ? Function dd ? Ordinal dd ? AddressOfData dd ? ends ends struct IMAGE_IMPORT_BY_NAME Hint dw ? Name_ rb 1 ends IMAGE_ORDINAL_FLAG32 = 80000000h struct IMAGE_BOUND_IMPORT_DESCRIPTOR TimeDateStamp dd ? OffsetModuleName dw ? NumberOfModuleForwarderRefs dw ? ends struct IMAGE_BOUND_FORWARDER_REF TimeDateStamp dd ? OffsetModuleName dw ? Reserved dw ? ends struct IMAGE_RESOURCE_DIRECTORY Characteristics dd ? TimeDateStamp dd ? MajorVersion dw ? MinorVersion dw ? NumberOfNamedEntries dw ? NumberOfIdEntries dw ? ends struct IMAGE_RESOURCE_DIRECTORY_ENTRY _id dd ? _offset dd ? ends struct IMAGE_RESOURCE_DIRECTORY_STRING Length_ dw ? NameString rb 1 ends struct IMAGE_RESOURCE_DATA_ENTRY OffsetToData dd ? Size_ dd ? CodePage dd ? Reserved dd ? ends RT_NEWRESOURCE = 00002000h RT_ERROR = 00007fffh RT_CURSOR = 000000001 RT_BITMAP = 000000002 RT_ICON = 000000003 RT_MENU = 000000004 RT_DIALOG = 000000005 RT_STRING = 000000006 RT_FONTDIR = 000000007 RT_FONT = 000000008 RT_ACCELERATORS = 000000009 RT_RCDATA = 0000000010 RT_MESSAGETABLE = 0000000011 RT_GROUP_CURSOR = 0000000012 RT_GROUP_ICON = 0000000014 RT_VERSION = 0000000016 RT_NEWBITMAP = (RT_BITMAP or RT_NEWRESOURCE) RT_NEWMENU = (RT_MENU or RT_NEWRESOURCE) RT_NEWDIALOG = (RT_DIALOG or RT_NEWRESOURCE) struct IMAGE_BASE_RELOCATION VirtualAddress dd ? SizeOfBlock dd ? ends IMAGE_REL_BASED_ABSOLUTE = 0 IMAGE_REL_BASED_HIGH = 1 IMAGE_REL_BASED_LOW = 2 IMAGE_REL_BASED_HIGHLOW = 3 IMAGE_REL_BASED_HIGHADJ = 4 IMAGE_REL_BASED_MIPS_JMPADDR = 5 IMAGE_REL_BASED_SECTION = 6 IMAGE_REL_BASED_REL32 = 7 struct IMAGE_TLS_DIRECTORY32 StartAddressOfRawData dd ? EndAddressOfRawData dd ? AddressOfIndex dd ? AddressOfCallBacks dd ? SizeOfZeroFill dd ? Characteristics dd ? ends struct IMAGE_LOAD_CONFIG_DIRECTORY32 Characteristics dd ? TimeDateStamp dd ? MajorVersion dw ? MinorVersion dw ? GlobalFlagsClear dd ? GlobalFlagsSet dd ? CriticalSectionDefaultTimeout dd ? DeCommitFreeBlockThreshold dd ? DeCommitTotalFreeThreshold dd ? LockPrefixTable dd ? MaximumAllocationSize dd ? VirtualMemoryThreshold dd ? ProcessHeapFlags dd ? ProcessAffinityMask dd ? CSDVersion dw ? Reserved1 dw ? EditList dd ? Reserved rd 1 endsHyperion-2.0/Src/Container/32/loadexecutable.asm0000755000175000017500000003353613476706334021122 0ustar sophiesophie;Loads the exe which is stored in input_image ;into memory and starts its execution proc loadExecutable stdcall APITable:DWORD,\ input_image:DWORD local str1[256]:BYTE, ret_val:DWORD, image_file_header:DWORD,\ loaded_file:DWORD pushad ;verify checksum of packed executable writeWithNewLine createStringVerifyChecksum, str1, le_exit_error stdcall verifyChecksum, [input_image], INFILE_SIZE test eax,eax jz le_exit_error ;verify whether the content of the data section is pe writeWithNewLine createStringVerifyPE, str1, le_exit_error mov eax,[input_image] add eax,4 stdcall verifyPE, eax, INFILE_SIZE test eax,eax mov [image_file_header],eax jz le_exit_error ;copy pe header and sections into memory writeNewLineToLog APITable writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error mov eax,[input_image] add eax,4 mov ebx,INFILE_SIZE sub ebx,4 stdcall loadFile, [APITable], [image_file_header], eax, ebx test eax,eax mov [loaded_file],eax jz le_exit_error ;loading import table writeNewLineToLog APITable writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error stdcall loadImportTable, [APITable], [loaded_file] test eax,eax jz le_exit_error ;set the correct permissions for each section writeNewLineToLog APITable writeWithNewLine createStringSettingPermissions, str1, le_exit_error mov eax,[input_image] add eax,4 mov ebx,INFILE_SIZE sub ebx,4 stdcall setPermissions, [APITable], [image_file_header], eax, ebx test eax,eax jz le_exit_error le_exit_success: popad mov eax,1 ret le_exit_error: popad mov eax,0 ret endp ;load the APIs in the import table proc loadImportTable, APITable:DWORD, image_base:DWORD local str1[256]:BYTE, import_table:DWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE pushad ;find import table in data directory mov edx,[image_base] mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew] add eax,edx add eax,4 ;image file header now in eax add eax,sizeof.IMAGE_FILE_HEADER lea eax,[eax+IMAGE_OPTIONAL_HEADER32.DataDirectory] ;first data directory entry now in eax add eax,sizeof.IMAGE_DATA_DIRECTORY ;import data directory entry now in eax mov eax,[eax+IMAGE_DATA_DIRECTORY.VirtualAddress] add eax,edx ;pointer to import table now in eax mov [import_table],eax writeWithNewLine createStringFoundImportTable, str1, le_exit_error writeRegisterToLog APITable, [import_table] test eax,eax jz pit_exit_error ;init null directory entry lea esi,[null_directory_entry] mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR mov al,0 pit_init_null_directory_loop: mov [esi],al inc esi dec ecx jnz pit_init_null_directory_loop mov ebx,[import_table] ;iterate over the directory tables pit_next_directory_entry: lea esi,[null_directory_entry] mov edi,ebx mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR rep cmpsb je pit_exit_success ;load APIs of this directory stdcall loadImportDirectoryTable, [APITable], [image_base], ebx test eax,eax jz pit_exit_error ;next entry add ebx,sizeof.IMAGE_IMPORT_DESCRIPTOR jmp pit_next_directory_entry pit_exit_success: popad mov eax,1 ret pit_exit_error: popad mov eax,0 ret endp ;loads the APIs proc loadImportDirectoryTable stdcall, APITable:DWORD, image_base:DWORD, directory_entry:DWORD local str1[256]:BYTE, lookup_table:DWORD, import_address_table:DWORD, dll_image_base:DWORD pushad ;write info about data directory table to logfile writeNewLineToLog APITable test eax,eax jz lidt_exit_error writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error mov eax,[directory_entry] mov eax,[eax+IMAGE_IMPORT_DESCRIPTOR.Name_] add eax,[image_base] mov ebx,eax ;pointer to dll name in ebx writeLog APITable, eax test eax,eax jz lidt_exit_error writeNewLineToLog APITable test eax,eax jz lidt_exit_error ;load the corresponding dll invoke LoadLibrary, ebx test eax,eax jz lidt_exit_error mov [dll_image_base],eax ;read pointer to the api tables mov edx,[directory_entry] mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk] add eax,[image_base] mov [lookup_table],eax mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk] add eax,[image_base] mov [import_address_table],eax ;index to current API sub ecx,ecx ;iterate the lookup_table entries lidt_next_lookup_entry: mov eax,[lookup_table] add eax,ecx mov eax,[eax] test eax,eax jz lidt_exit_success mov ebx,eax and eax,IMAGE_ORDINAL_FLAG32 jnz lidt_byordinal lidt_byname: createStringName str1 lea eax,[str1] writeLog APITable, eax test eax,eax jz lidt_exit_error add ebx,[image_base] lea ebx,[ebx+IMAGE_IMPORT_BY_NAME.Name_] mov eax,ebx writeLog APITable, eax test eax,eax jz lidt_exit_error writeNewLineToLog APITable test eax,eax jz lidt_exit_error ;API name pointer in ebx push ecx invoke GetProcAddress, [dll_image_base], ebx pop ecx test eax,eax jz lidt_exit_error mov ebx,[import_address_table] add ebx,ecx mov [ebx],eax ;fetch next API add ecx,4 jmp lidt_next_lookup_entry lidt_byordinal: createStringOrdinal str1 lea eax,[str1] writeLog APITable, eax test eax,eax jz lidt_exit_error ;remove the ordinal flag xor ebx,IMAGE_ORDINAL_FLAG32 mov eax,ebx writeRegisterToLog APITable, eax test eax,eax jz pit_exit_error ;API ordinal in ebx push ecx invoke GetProcAddress, [dll_image_base], ebx pop ecx test eax,eax jz lidt_exit_error mov ebx,[import_address_table] add ebx,ecx mov [ebx],eax ;fetch next API add ecx,4 jmp lidt_next_lookup_entry lidt_exit_success: popad mov eax,1 ret lidt_exit_error: popad mov eax,0 ret endp; ;sets the memory permissions for each section proc setPermissions stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \ file_image_size:DWORD local number_of_sections:DWORD, image_base:DWORD, section_headers:DWORD,\ pe_header_size:DWORD, str1[256]:BYTE, vprotect_ret:DWORD pushad ;find section header mov edx,[image_file_header] sub eax,eax mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections] mov [number_of_sections],eax add edx,sizeof.IMAGE_FILE_HEADER mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase] mov [image_base],eax ;search for section header lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory] mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes] mov edx,sizeof.IMAGE_DATA_DIRECTORY mul edx add eax,ebx ;first section header found mov [section_headers],eax mov eax,sizeof.IMAGE_SECTION_HEADER mov edx,[number_of_sections] mul edx ;end of section header sections found add eax,[section_headers] mov ebx,[file_image_base] sub eax,ebx ;unaligned size of pe header in eax mov [pe_header_size],eax ;set pe header page read-only mov edx,[APITable] lea eax,[vprotect_ret] stdcall dword [edx+VirtualProtect], [image_base], [pe_header_size], PAGE_READONLY, eax test eax,eax jz sp_exit_error ;some output for the user writeRegisterToLog APITable, [image_base] test eax,eax jz sp_exit_error ;set the section page permissions mov ecx,[number_of_sections] mov ebx,[section_headers] sp_load_section_loop: stdcall setSection, [APITable], ebx, [image_base], [file_image_base] test eax,eax jz sp_exit_error add ebx,sizeof.IMAGE_SECTION_HEADER dec ecx jnz sp_load_section_loop sp_exit_success: popad mov eax,1 ret sp_exit_error: popad sub eax,eax ret endp; ;sets the complete image of the decrypted file writeable so ;we can copy pe header and sections into into proc loadFile stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \ file_image_size:DWORD local number_of_sections:DWORD, image_base:DWORD, aux:DWORD,\ str1[256]:BYTE, vprotect_ret:DWORD, section_headers:DWORD, pe_header_size:DWORD pushad ;find section header mov edx,[image_file_header] sub eax,eax mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections] mov [number_of_sections],eax add edx,sizeof.IMAGE_FILE_HEADER mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase] mov [image_base],eax ;make the complete image writable mov eax,[edx+IMAGE_OPTIONAL_HEADER32.SizeOfImage] mov [aux],edx ;store edx, we need it later lea edx,[vprotect_ret] mov ebx,[APITable] stdcall dword [ebx+VirtualProtect], [image_base], eax, PAGE_READWRITE, edx test eax,eax jz lf_exit_error ;some output for the user writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error writeRegisterToLog APITable, [image_base] test eax,eax jz lf_exit_error mov edx,[aux] ;restore edx ;continue search for section header lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory] mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes] mov edx,sizeof.IMAGE_DATA_DIRECTORY mul edx add eax,ebx ;first section header found mov [section_headers],eax mov eax,sizeof.IMAGE_SECTION_HEADER mov edx,[number_of_sections] mul edx ;end of section header sections found add eax,[section_headers] mov ebx,[file_image_base] sub eax,ebx ;unaligned size of pe header in eax mov [pe_header_size],eax ;copy header to memory mov edi,[image_base] mov esi,[file_image_base] mov ecx,[pe_header_size] rep movsb ;load the sections mov ecx,[number_of_sections] mov ebx,[section_headers] lf_load_section_loop: stdcall loadSection, [APITable], ebx, [image_base], [file_image_base] test eax,eax jz lf_exit_error add ebx,sizeof.IMAGE_SECTION_HEADER dec ecx jnz lf_load_section_loop lf_exit_success: popad mov eax,[image_base] ret lf_exit_error: popad mov eax,0 ret endp ;load the corresponding section into memory proc loadSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\ file_image_base:DWORD local str1[256]:BYTE pushad ;copy from file into memory mov edx,[section_header] mov edi,[edx+IMAGE_SECTION_HEADER.VirtualAddress] add edi,[image_base] mov esi,[file_image_base] add esi,[edx+IMAGE_SECTION_HEADER.PointerToRawData] mov ecx,[edx+IMAGE_SECTION_HEADER.SizeOfRawData] rep movsb ;print some infos to the log file createStringLoaded str1 lea eax,[str1] writeLog APITable, eax test eax,eax jz ls_exit_error lea edi,[str1] mov byte [edi+8],0 mov edx,[section_header] lea esi,[edx+IMAGE_SECTION_HEADER._Name] mov ecx,8 push edi rep movsb pop edi writeLog APITable, edi writeNewLineToLog APITable mov edx,[section_header] mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress] add eax,[image_base] writeRegisterToLog APITable, eax ls_exit_success: popad mov eax,1 ret ls_exit_error: popad sub eax,eax ret endp ;set the memory page permission for the corresponding section proc setSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\ file_image_base:DWORD local section_flags:DWORD, vprotect_ret:DWORD, str1[256]:BYTE pushad mov edx,[section_header] ;section execute/read/write? mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE jne ssn_no_execute_read_write mov eax,PAGE_EXECUTE_READWRITE mov [section_flags],eax jmp ssn_set_memory ssn_no_execute_read_write: ;section execute/read? mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ jne ssn_no_execute_read mov eax,PAGE_EXECUTE_READ mov [section_flags],eax jmp ssn_set_memory ssn_no_execute_read: ;section read/write? mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE jne ssn_no_read_write mov eax,PAGE_READWRITE mov [section_flags],eax jmp ssn_set_memory ssn_no_read_write: ;section read? mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics] and ebx,IMAGE_SCN_MEM_READ cmp ebx,IMAGE_SCN_MEM_READ jne ssn_no_read mov eax,PAGE_READONLY mov [section_flags],eax jmp ssn_set_memory ssn_no_read: mov eax,PAGE_NOACCESS mov [section_flags],eax ;set section permissions ssn_set_memory: mov edx,[section_header] mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress] add eax,[image_base] mov ebx,[edx+IMAGE_SECTION_HEADER.VirtualSize] mov ecx,[APITable] lea edx,[vprotect_ret] stdcall dword [ecx+VirtualProtect],eax,ebx,[section_flags], edx test eax,eax jz ssn_exit_error ;some output for the user mov edx,[section_header] mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress] add eax,[image_base] writeRegisterToLog APITable, eax ssn_exit_success: popad mov eax,1 ret ssn_exit_error: popad sub eax,eax ret endp; ;check MZ und PE signature and return start of the image file header proc verifyPE stdcall, image_base:DWORD, section_size:DWORD local retval:DWORD pushad mov edx,[image_base] mov ax,[edx+IMAGE_DOS_HEADER.e_magic] cmp ax,IMAGE_DOS_SIGNATURE jne vpe_exit_error mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew] add edx,eax mov eax,dword [edx] cmp eax,IMAGE_NT_SIGNATURE jne vpe_exit_error add edx,4 mov [retval],edx vpe_exit_success: popad mov eax,[retval] ret vpe_exit_error: popad sub eax,eax ret endp ;First 4 bytes of data seciton contain a checksum ;Verify that the checksum is correct ;TODO: CHECKSUM SIZE is atm hardcoded proc verifyChecksum stdcall, section_address:DWORD, section_size:DWORD pushad mov ebx,dword [section_address] mov eax,[ebx] add ebx,4 mov ecx,[section_size] sub ecx,4 ;checksum is in eax ;pointer to file in ebx ;size of file in ecx sub edi,edi vs_calc_cs: sub edx,edx mov dl,byte [ebx] add edi,edx inc ebx dec ecx jnz vs_calc_cs ;calculated checksum is in edi cmp edi,eax jne vs_exit_error vs_exit_success: popad mov eax,1 ret vs_exit_error: popad sub eax,eax ret endpHyperion-2.0/Src/Payloads/0000755000175000017500000000000013476706334015030 5ustar sophiesophieHyperion-2.0/Src/Payloads/Aes/0000755000175000017500000000000013476706334015540 5ustar sophiesophieHyperion-2.0/Src/Payloads/Aes/64/0000755000175000017500000000000013476706334015771 5ustar sophiesophieHyperion-2.0/Src/Payloads/Aes/64/encryptionrounds.asm0000644000175000017500000001044213476706334022121 0ustar sophiesophie;uses the generated round keys to encrypt an aes block proc encryptionRounds encryption_ptr:QWORD,\ roundkeys_ptr:QWORD, sbox_ptr:QWORD, mul2_table_ptr:QWORD, \ mul3_table_ptr:QWORD mov [encryption_ptr],rcx mov [roundkeys_ptr],rdx mov [sbox_ptr],r8 mov [mul2_table_ptr],r9 push rbx push r12 push r13 sub rsp,8 ;TODO: Check alignment here ;roundkey and encryption in eax and ebx mov r12,[roundkeys_ptr] mov rbx,[encryption_ptr] ;initial round fastcall addRoundKey, rbx, r12 ;main round add r12,BLOCK_SIZE mov r13,ENCRYPTION_ROUNDS - 1 er_main: fastcall subBlockBytes, rbx, [sbox_ptr] fastcall shiftRows, rbx fastcall mixColumns23, rbx, [mul2_table_ptr], [mul3_table_ptr] fastcall addRoundKey, rbx, r12 add r12,BLOCK_SIZE dec r13 jnz er_main ;final round fastcall subBlockBytes, rbx, [sbox_ptr] fastcall shiftRows, rbx fastcall addRoundKey, rbx, r12 add rsp,8 pop r13 pop r12 pop rbx ret endp ;mix columns operation is a column matrix ;multiplication proc mixColumns23, data_ptr:QWORD, mul2_table_ptr:QWORD,\ mul3_table_ptr:QWORD local current_column:DWORD mov [data_ptr],rcx mov [mul2_table_ptr],rdx mov [mul3_table_ptr],r8 push rbx ;leaf function mov rdx, [data_ptr] rept 4{ ;element 3 mov eax, [rdx] mov cl, al shr eax,8 xor cl, al shr eax,8 mov rbx, [mul3_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul2_table_ptr] xlatb xor cl, al mov [current_column], ecx ;element 2 mov eax, [rdx] mov cl, al shr eax, 8 mov rbx, [mul3_table_ptr] xlatb xor cl, al shr eax, 8 mov rbx, [mul2_table_ptr] xlatb xor cl, al shr eax, 8 xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 1 mov eax, [rdx] mov rbx, [mul3_table_ptr] xlatb mov cl, al shr eax, 8 mov rbx, [mul2_table_ptr] xlatb xor cl, al shr eax, 8 xor cl, al shr eax, 8 xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 0 mov eax, [rdx] mov rbx, [mul2_table_ptr] xlatb mov cl, al shr eax, 8 xor cl, al shr eax, 8 xor cl, al shr eax, 8 mov rbx, [mul3_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl ;finished, store it mov [rdx], eax add rdx, COLUMN_SIZE } pop rbx ret endp ;shifts the rows as desrcibed in the AES specification ;the shift process is in the reversed order because of the ;endiannes macro loadRow{ mov al, byte [rbx+00] shl eax,8 mov al, byte [rbx+04] shl eax,8 mov al, byte [rbx+08] shl eax,8 mov al, byte [rbx+12] } macro storeRow{ mov byte [rbx+12], al shr eax,8 mov byte [rbx+08], al shr eax,8 mov byte [rbx+04], al shr eax,8 mov byte [rbx+00], al } proc shiftRows, data_ptr:DWORD push rbx ;leaf function mov rbx,rcx ;[data_ptr] loadRow rol eax, 24 storeRow inc rbx loadRow rol eax, 16 storeRow inc rbx loadRow rol eax, 8 storeRow pop rbx ret endp ;xors the data with the round key and stores result ;in data proc addRoundKey data_ptr:QWORD, round_key_ptr:QWORD mov r8,[rcx] xor r8,[rdx] mov [rcx],r8 add rcx,COLUMN_SIZE*2 add rdx,COLUMN_SIZE*2 mov r8,[rcx] xor r8,[rdx] mov [rcx],r8 ret endp ;substitute aes block with s-box proc subBlockBytes data_ptr:QWORD, sbox_ptr:QWORD push rbx ;leaf function mov rbx,rdx ;sbox rept 2{ mov rax,[rcx] ;data_ptr xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 xlatb ror rax, 8 mov [rcx], rax add rcx,COLUMN_SIZE*2 } pop rbx ret endp Hyperion-2.0/Src/Payloads/Aes/64/aes_constants_intern.inc0000755000175000017500000000115213476706334022711 0ustar sophiesophie;static for AES BLOCK_SIZE equ 16 COLUMN_SIZE equ 4 if defined AES128 KEY_SIZE = 16 EXTENDED_KEY_SIZE = 176 ROW_SIZE = 4 ENCRYPTION_ROUNDS = 10 end if if defined AES192 KEY_SIZE = 24 EXTENDED_KEY_SIZE = 208 ROW_SIZE = 6 ENCRYPTION_ROUNDS = 12 end if if defined AES256 KEY_SIZE = 32 EXTENDED_KEY_SIZE = 240 ROW_SIZE = 8 ENCRYPTION_ROUNDS = 14 end if ;size of the sbox SBOX_SIZE equ 256 ;size of the rcon table RCON_SIZE equ 256 ;size of the Galois multiplication ;lookup tables GALOIS_SIZE equ 256Hyperion-2.0/Src/Payloads/Aes/64/rcon.asm0000644000175000017500000000410513476706334017434 0ustar sophiesophiemacro CreateRcon target, [char] { mov byte [target], char inc target } ;dynamically generate the rcon in memory ;uses hard coded values, no algorithm proc createRcon rcon_ptr:QWORD CreateRcon rcx, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\ 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\ 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\ 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\ 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\ 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\ 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\ 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\ 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\ 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\ 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\ 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\ 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\ 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\ 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\ 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d ret endp Hyperion-2.0/Src/Payloads/Aes/64/keychain.asm0000644000175000017500000001774313476706334020302 0ustar sophiesophie;creates the round keys in keychain_ptr if defined AES128 proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\ rcon_ptr:QWORD mov [keychain_ptr],rcx mov [sbox_ptr],rdx mov [rcon_ptr],r8 push r12 push r13 push rbx sub rsp,8 mov r12, ROW_SIZE-1 ;rcx mov r13, 1 ;rdx key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with ecx-ROW_SIZE-1 fastcall loadColumn, [keychain_ptr], r12 ;shift rows rol eax,8 ;substitute with sbox fastcall subBytes, rax, [sbox_ptr] ;xor with rcon fastcall xorRcon, rax, [rcon_ptr], r13 inc r13 ;xor with column at index-ROW_SIZE-1 mov rbx,rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx ;store at index+1 inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ fastcall loadColumn, [keychain_ptr], r12 ;can be removed mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 } ;------------------- ;check for end of keychain generation cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 jne key_schedule_round add rsp,8 pop rbx pop r13 pop r12 ret endp end if if defined AES192 proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\ rcon_ptr:QWORD mov [keychain_ptr],rcx mov [sbox_ptr],rdx mov [rcon_ptr],r8 push r12 push r13 push rbx sub rsp,8 mov r12, ROW_SIZE-1 ;rcx mov r13, 1 ;rdx key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with r12-ROW_SIZE-1 fastcall loadColumn, [keychain_ptr], r12 ;shift rows rol eax,8 ;substitute with sbox fastcall subBytes, rax, [sbox_ptr] ;xor with rcon fastcall xorRcon, rax, [rcon_ptr], r13 inc r13 ;xor with column at index-ROW_SIZE-1 mov rbx,rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx ;store at index+1 inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ fastcall loadColumn, [keychain_ptr], r12 ;can be removed mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 } ;------------------- ;check for end of keychain generation cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 je exit_key_schedule_round ;------------------- ;two times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 2{ fastcall loadColumn, [keychain_ptr], r12 ;can be removed mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 } ;------------------- jmp key_schedule_round exit_key_schedule_round: add rsp,8 pop rbx pop r13 pop r12 ret endp end if if defined AES256 proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\ rcon_ptr:QWORD mov [keychain_ptr],rcx mov [sbox_ptr],rdx mov [rcon_ptr],r8 push r12 push r13 push rbx sub rsp,8 mov r12, ROW_SIZE-1 ;rcx mov r13, 1 ;rdx key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with ecx-ROW_SIZE-1 fastcall loadColumn, [keychain_ptr], r12 ;shift rows rol eax,8 ;substitute with sbox fastcall subBytes, rax, [sbox_ptr] ;xor with rcon fastcall xorRcon, rax, [rcon_ptr], r13 inc r13 ;xor with column at index-ROW_SIZE-1 mov rbx,rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx ;store at index+1 inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ fastcall loadColumn, [keychain_ptr], r12 ;can be removed mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 } ;------------------- ;check for end of keychain generation cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 je exit_key_schedule_round ;------------------- ;one times: get current column, subsitute with ;sbox and xor it with ecx-ROW_SIZE-1 ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 fastcall loadColumn, [keychain_ptr], r12 ;can be removed fastcall subBytes, rax, [sbox_ptr] mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 ;three times rept 3{ fastcall loadColumn, [keychain_ptr], r12 ;can be removed mov rbx, rax push r12 ;TODO: fix stack alignment sub r12,ROW_SIZE-1 fastcall loadColumn, [keychain_ptr],r12 pop r12 xor rax,rbx inc r12 fastcall storeColumn, rax, [keychain_ptr], r12 } ;------------------- jmp key_schedule_round exit_key_schedule_round: add rsp,8 pop rbx pop r13 pop r12 ret endp end if ;store a column at column_index in keychain proc storeColumn column:QWORD, keychain_ptr:QWORD, column_index:QWORD mov [column], rcx mov [keychain_ptr],rdx mov [column_index],r8 ;create pointer to first byte of the column ;and store column there mov rax, [column_index] mov r9, COLUMN_SIZE mul r9 add rax, [keychain_ptr] mov rcx, [column] mov [rax], ecx ret endp ;xor key dword with (rcon(index) 00 00 00) proc xorRcon key:QWORD, rcon_ptr:QWORD, rcon_index:QWORD push rbx ;leaf function mov rax,r8 ; [rcon_index] mov rbx,rdx; [rcon_ptr] xlatb shl rax,24 xor eax,ecx ;[key] pop rbx ret endp ;returns in eax the column at column_index in the key chain proc loadColumn keychain_ptr:QWORD, column_index:QWORD ;create pointer to first byte of the colum mov rax, rdx ;[column_index] mov r8, COLUMN_SIZE mul r8 add rax, rcx ;[keychain_ptr] ;return dword and exit mov eax,[rax] ret endp ;substitute subkey's bytes with the sbox proc subBytes subkey:QWORD, sbox_ptr:QWORD push rbx ;leaf function mov rax,rcx ;[subkey] mov rbx,rdx ;[sbox_ptr] xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 pop rbx ret endp Hyperion-2.0/Src/Payloads/Aes/64/decryptexecutable.asm0000644000175000017500000000523213476706334022211 0ustar sophiesophie;Decrypt the exe which is stored in input_image proc decryptExecutable APITable:QWORD, input_image:QWORD local str1[256]:BYTE, ret_val:QWORD,\ key[KEY_SIZE]:BYTE, encrypted_backup:QWORD mov [APITable],rcx mov [input_image],rdx push rdi push rsi writeWithNewLine createStringBruteforcing, str1, dec_exit_success ;init key lea rdi,[key] mov rcx, KEY_SIZE mov al,0 dec_init_key: mov [rdi],al inc rdi dec rcx jnz dec_init_key ;create a copy of the encrypted file ;which is used to brute force the key mov rax,[APITable] fastcall qword [rax+VirtualAlloc], 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE test rax, rax jz dec_exit_error mov [encrypted_backup],rax ;now copy the file into the buffer mov rdi,rax mov rsi,[input_image] mov rcx,INFILE_SIZE ;we can mov qwords because buffer is a multiple of 16 shr rcx,3 repz movsq keyspace_loop: lea rax,[key] fastcall decAES, INFILE_SIZE, [input_image], [input_image], rax fastcall verifyChecksum, [input_image], INFILE_SIZE test rax,rax jnz dec_decrypted_success ;restore the encrypted version to try the next key mov rsi,[encrypted_backup] mov rdi,[input_image] mov rcx,INFILE_SIZE shr rcx,3 repz movsq ;lea eax,[key] ;stdcall encAES, [section_size], [section_address], [section_address], eax ;next key lea rax,[key] fastcall nextKey, rax test rax,rax jz dec_exit_error ;abort if key space was explored, else continue jmp keyspace_loop dec_decrypted_success: mov rax,[APITable] fastcall qword [rax+VirtualFree], [encrypted_backup], 0, MEM_RELEASE test rax, rax jz dec_exit_error dec_exit_success: mov rax,1 jmp dec_exit_ret dec_exit_error: sub rax,rax dec_exit_ret: pop rsi pop rdi ret endp ;generate next decryption key proc nextKey key_ptr:QWORD mov [key_ptr],rcx mov rax,rcx mov r10,rax add r10,REAL_KEY_SIZE nkey_next_element: inc byte [rax] cmp byte [rax],REAL_KEY_RANGE jne nkey_not_finished mov byte [rax],0 inc rax cmp rax,r10 je nkey_finished jmp nkey_next_element nkey_not_finished: mov rax,1 ret nkey_finished: sub rax,rax ret endp; Hyperion-2.0/Src/Payloads/Aes/64/aes.asm0000644000175000017500000001057413476706334017252 0ustar sophiesophieinclude 'sbox.asm' include 'rcon.asm' include 'keychain.asm' include 'encryptionrounds.asm' include 'decryptionrounds.asm' include 'galois.asm' ;encrypts cleartext and stores the result at enctext proc encAES size:QWORD, cleartext_ptr:QWORD, enctext_ptr:QWORD,\ aeskey_ptr:QWORD local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\ rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\ galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:QWORD,\ mul3_table_ptr:QWORD, sbox_ptr:QWORD, keychain_ptr:QWORD,\ rcon_ptr:QWORD mov [size],rcx mov [cleartext_ptr],rdx mov [enctext_ptr],r8 mov [aeskey_ptr],r9 push rbx push rsi push rdi sub rsp,8 ;16 byte stack alignment ;sbox and rcon are created in memory ;galois lookup tables too lea rax,[sbox] mov [sbox_ptr], rax fastcall createSBox, rax lea rax,[rcon] mov [rcon_ptr], rax fastcall createRcon, rax lea rax,[galois_mul2] mov [mul2_table_ptr], rax lea rbx,[galois_mul3] mov [mul3_table_ptr], rbx fastcall createGaloisEncryption, rax, rbx ;copy the key into the round key buffer mov rcx, KEY_SIZE mov rsi, [aeskey_ptr] lea rdi, [keychain] mov [keychain_ptr], rdi rep movsb ;create the round keys fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\ [rcon_ptr] ;copy clear text to encryption buffer mov rcx, [size] mov rsi, [cleartext_ptr] mov rdi, [enctext_ptr] rep movsb ;rsi == current to be encrypted block ;ebx == end of cleartext mov rsi,[enctext_ptr] mov rbx,rsi add rbx,[size] eaes_block_loop: fastcall encryptionRounds, rsi, [keychain_ptr], \ [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr] add rsi,BLOCK_SIZE cmp rsi,rbx jnge eaes_block_loop add rsp,8 pop rdi pop rsi pop rbx mov rax,1 ret endp ;decrypts cleartext and stores the result at enctext proc decAES size:QWORD, enctext_ptr:QWORD, cleartext_ptr:QWORD,\ aeskey_ptr:QWORD local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\ sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\ rcon[RCON_SIZE]:BYTE,\ galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \ galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\ mul9_table_ptr:QWORD, mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\ mul14_table_ptr:QWORD, sbox_ptr:QWORD, invert_sbox_ptr:QWORD,\ keychain_ptr:QWORD, rcon_ptr:QWORD mov [size],rcx mov [enctext_ptr],rdx mov [cleartext_ptr],r8 mov [aeskey_ptr],r9 push rbx push rsi push rdi sub rsp,8 ;16 byte stack alignment ;sbox, invert sbox ;and rcon are created in memory lea rax,[sbox] mov [sbox_ptr], rax fastcall createSBox, rax lea rax,[rcon] mov [rcon_ptr], rax fastcall createRcon, rax lea rax, [invert_sbox] mov [invert_sbox_ptr], rax fastcall createInvertSBox, rax ;create galois lookup tables for ;9, 11, 13 and 14 lea rax,[galois_mul9] mov [mul9_table_ptr], rax lea rax,[galois_mul11] mov [mul11_table_ptr], rax lea rax,[galois_mul13] mov [mul13_table_ptr], rax lea rax,[galois_mul14] mov [mul14_table_ptr], rax fastcall createGaloisDecryption, [mul9_table_ptr],\ [mul11_table_ptr], [mul13_table_ptr], [mul14_table_ptr] ;copy the key into the round key buffer mov rcx, KEY_SIZE mov rsi, [aeskey_ptr] lea rdi, [keychain] mov [keychain_ptr], rdi rep movsb ;create the round keys fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\ [rcon_ptr] ;copy encrypted text to decryption buffer mov rcx, [size] mov rsi, [enctext_ptr] mov rdi, [cleartext_ptr] rep movsb ;rsi == current to be decrypted block ;ebx == end of cleartext mov rsi,[cleartext_ptr] mov rbx,rsi add rbx,[size] daes_block_loop: fastcall decryptionRounds, rsi, [keychain_ptr],\ [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\ [mul13_table_ptr], [mul14_table_ptr] add rsi,BLOCK_SIZE cmp rsi,rbx jnge daes_block_loop add rsp,8 pop rdi pop rsi pop rbx mov rax,1 ret endp Hyperion-2.0/Src/Payloads/Aes/64/aes.inc0000755000175000017500000000026113476706334017236 0ustar sophiesophie;select an AES mode AES128 equ 1 ;AES192 equ 1 ;AES256 equ 1 ;internal constants, don't change them include 'aes_constants_intern.inc'Hyperion-2.0/Src/Payloads/Aes/64/decryptionrounds.asm0000644000175000017500000000713013476706334022107 0ustar sophiesophie;uses the generated round keys to decrypt an aes block proc decryptionRounds decryption_ptr:QWORD,\ roundkeys_ptr:QWORD, inverse_sbox_ptr:QWORD, mul9_table_ptr:QWORD, \ mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\ mul14_table_ptr:QWORD mov [decryption_ptr], rcx mov [roundkeys_ptr], rdx mov [inverse_sbox_ptr], r8 mov [mul9_table_ptr], r9 push rbx push r12 ;roundkey and decryption in eax and ebx mov r12, [roundkeys_ptr] add r12, BLOCK_SIZE*ENCRYPTION_ROUNDS mov rbx, [decryption_ptr] ;final round fastcall addRoundKey, rbx, r12 fastcall inverseShiftRows, rbx fastcall subBlockBytes, rbx, [inverse_sbox_ptr] sub r12,BLOCK_SIZE ;main round dr_main: fastcall addRoundKey, rbx, r12 fastcall mixColumns9111314, rbx, [mul9_table_ptr], [mul11_table_ptr],\ [mul13_table_ptr], [mul14_table_ptr] fastcall inverseShiftRows, rbx fastcall subBlockBytes, rbx, [inverse_sbox_ptr] sub r12, BLOCK_SIZE cmp r12, [roundkeys_ptr] jne dr_main ;initial_round fastcall addRoundKey, rbx, r12 pop r12 pop rbx ret endp ;mix columns operation is a column matrix ;multiplication proc mixColumns9111314, data_ptr:QWORD, mul9_table_ptr:QWORD,\ mul11_table_ptr:QWORD, mul13_table_ptr:QWORD, mul14_table_ptr:QWORD local current_column:DWORD mov [data_ptr],rcx mov [mul9_table_ptr], rdx mov [mul11_table_ptr], r8 mov [mul13_table_ptr], r9 push rbx ;16 byte alignment not neccessary because leaf function mov rdx, [data_ptr] rept 4{ ;element 3 mov eax, [rdx] mov rbx, [mul9_table_ptr] xlatb mov cl, al shr eax,8 mov rbx, [mul13_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul11_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul14_table_ptr] xlatb xor cl, al mov [current_column], ecx ;element 2 mov eax, [rdx] mov rbx, [mul13_table_ptr] xlatb mov cl, al shr eax,8 mov rbx, [mul11_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul14_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul9_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 1 mov eax, [rdx] mov rbx, [mul11_table_ptr] xlatb mov cl, al shr eax,8 mov rbx, [mul14_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul9_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul13_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 0 mov eax, [rdx] mov rbx, [mul14_table_ptr] xlatb mov cl, al shr eax,8 mov rbx, [mul9_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul13_table_ptr] xlatb xor cl, al shr eax,8 mov rbx, [mul11_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl ;finished, store it mov [rdx], eax add rdx, COLUMN_SIZE } pop rbx ret endp ;reverse shift operation for decryption proc inverseShiftRows, data_ptr:QWORD push rbx ;16 byte alignment not neccessary because leaf function mov rbx,rcx;[data_ptr] loadRow rol eax, 8 storeRow inc rbx loadRow rol eax, 16 storeRow inc rbx loadRow rol eax, 24 storeRow pop rbx ret endp Hyperion-2.0/Src/Payloads/Aes/64/sbox.asm0000644000175000017500000001002013476706334017437 0ustar sophiesophiemacro CreateSBox target, [char] { mov byte [target], char inc target } ;dynamically generate the sbox in memory ;uses hard coded values, no algorithm proc createSBox sbox_ptr:QWORD CreateSBox rcx, 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\ 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\ 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\ 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\ 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\ 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\ 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\ 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\ 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\ 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\ 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\ 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\ 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\ 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\ 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\ 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 ret endp ;the inverted sbox for decryption proc createInvertSBox sbox_ptr:QWORD CreateSBox rcx, 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\ 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\ 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\ 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\ 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\ 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\ 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\ 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\ 0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\ 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\ 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\ 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\ 0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\ 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\ 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\ 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d ret endp Hyperion-2.0/Src/Payloads/Aes/64/galois.asm0000644000175000017500000002754313476706334017764 0ustar sophiesophiemacro CreateGalois target, [char] { mov byte [target], char inc target } ;create 2 lookup tables for multiplication in the ;galois field with 2 and 3 proc createGaloisEncryption mul2_ptr:QWORD, mul3_ptr:QWORD CreateGalois rcx, 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\ 0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\ 0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\ 0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\ 0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\ 0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\ 0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\ 0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\ 0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\ 0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\ 0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\ 0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\ 0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\ 0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\ 0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\ 0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5 CreateGalois rdx, 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\ 0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\ 0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\ 0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\ 0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\ 0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\ 0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\ 0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\ 0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\ 0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\ 0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\ 0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\ 0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\ 0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\ 0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\ 0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a ret endp ;create 4 lookup tables for multiplication in the ;galois field with 9, 11, 13 and 14 proc createGaloisDecryption mul9_ptr:DWORD, mul11_ptr:QWORD,\ mul13_ptr:QWORD, mul14_ptr:QWORD CreateGalois rcx, 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \ 0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \ 0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \ 0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \ 0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \ 0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \ 0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \ 0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \ 0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \ 0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \ 0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \ 0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \ 0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \ 0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \ 0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \ 0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46 CreateGalois rdx, 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \ 0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \ 0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \ 0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \ 0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \ 0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \ 0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \ 0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \ 0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \ 0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \ 0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \ 0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \ 0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \ 0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \ 0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \ 0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3 CreateGalois r8, 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \ 0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \ 0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \ 0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \ 0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \ 0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \ 0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \ 0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \ 0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \ 0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \ 0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \ 0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \ 0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \ 0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \ 0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \ 0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97 CreateGalois r9, 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \ 0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \ 0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \ 0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \ 0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \ 0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \ 0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \ 0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \ 0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \ 0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \ 0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \ 0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \ 0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \ 0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \ 0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \ 0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d ret endp Hyperion-2.0/Src/Payloads/Aes/license.txt0000755000175000017500000000301513476706334017725 0ustar sophiesophieCopyright (c) 2012, Christian Ammann All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The views and conclusions contained in the software and documentation are those of the authors and should not be interpreted as representing official policies, either expressed or implied, of the Nullsecurity Project.Hyperion-2.0/Src/Payloads/Aes/32/0000755000175000017500000000000013476706334015764 5ustar sophiesophieHyperion-2.0/Src/Payloads/Aes/32/encryptionrounds.asm0000755000175000017500000000772613476706334022132 0ustar sophiesophie;uses the generated round keys to encrypt an aes block proc encryptionRounds encryption_ptr:DWORD,\ roundkeys_ptr:DWORD, sbox_ptr:DWORD, mul2_table_ptr:DWORD, \ mul3_table_ptr:DWORD pushad ;roundkey and encryption in eax and ebx mov eax,[roundkeys_ptr] mov ebx,[encryption_ptr] ;initial round stdcall addRoundKey, ebx, eax ;main round add eax,BLOCK_SIZE mov ecx,ENCRYPTION_ROUNDS - 1 er_main: stdcall subBlockBytes, ebx, [sbox_ptr] stdcall shiftRows, ebx stdcall mixColumns23, ebx, [mul2_table_ptr], [mul3_table_ptr] stdcall addRoundKey, ebx, eax add eax,BLOCK_SIZE dec ecx jnz er_main ;final round stdcall subBlockBytes, ebx, [sbox_ptr] stdcall shiftRows, ebx stdcall addRoundKey, ebx, eax popad ret endp ;mix columns operation is a column matrix ;multiplication proc mixColumns23, data_ptr:DWORD, mul2_table_ptr:DWORD,\ mul3_table_ptr:DWORD local current_column:DWORD push edx push eax push ebx push ecx mov edx, [data_ptr] rept 4{ ;element 3 mov eax, [edx] mov cl, al shr eax,8 xor cl, al shr eax,8 mov ebx, [mul3_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul2_table_ptr] xlatb xor cl, al mov [current_column], ecx ;element 2 mov eax, [edx] mov cl, al shr eax, 8 mov ebx, [mul3_table_ptr] xlatb xor cl, al shr eax, 8 mov ebx, [mul2_table_ptr] xlatb xor cl, al shr eax, 8 xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 1 mov eax, [edx] mov ebx, [mul3_table_ptr] xlatb mov cl, al shr eax, 8 mov ebx, [mul2_table_ptr] xlatb xor cl, al shr eax, 8 xor cl, al shr eax, 8 xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 0 mov eax, [edx] mov ebx, [mul2_table_ptr] xlatb mov cl, al shr eax, 8 xor cl, al shr eax, 8 xor cl, al shr eax, 8 mov ebx, [mul3_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl ;finished, store it mov [edx], eax add edx, COLUMN_SIZE } pop ecx pop ebx pop eax pop edx ret endp ;shifts the rows as desrcibed in the AES specification ;the shift process is in the reversed order because of the ;endiannes macro loadRow{ mov al, byte [ebx+00] shl eax,8 mov al, byte [ebx+04] shl eax,8 mov al, byte [ebx+08] shl eax,8 mov al, byte [ebx+12] } macro storeRow{ mov byte [ebx+12], al shr eax,8 mov byte [ebx+08], al shr eax,8 mov byte [ebx+04], al shr eax,8 mov byte [ebx+00], al } proc shiftRows, data_ptr:DWORD push eax push ebx mov ebx,[data_ptr] loadRow rol eax, 24 storeRow inc ebx loadRow rol eax, 16 storeRow inc ebx loadRow rol eax, 8 storeRow pop ebx pop eax ret endp ;xors the data with the round key and stores result ;in data proc addRoundKey data_ptr:DWORD, round_key_ptr:DWORD push eax push ebx push edx mov eax,[data_ptr] mov ebx,[round_key_ptr] rept 4{ mov edx,[eax] xor edx,[ebx] mov [eax],edx add eax,COLUMN_SIZE add ebx,COLUMN_SIZE } pop edx pop ebx pop eax ret endp ;substitute aes block with s-box proc subBlockBytes data_ptr:DWORD, sbox_ptr:DWORD push eax push ebx push edx mov ebx, [sbox_ptr] mov edx, [data_ptr] rept 4{ mov eax, [edx] xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 mov [edx], eax add edx, COLUMN_SIZE } pop edx pop ebx pop eax ret endpHyperion-2.0/Src/Payloads/Aes/32/aes_constants_intern.inc0000755000175000017500000000115213476706334022704 0ustar sophiesophie;static for AES BLOCK_SIZE equ 16 COLUMN_SIZE equ 4 if defined AES128 KEY_SIZE = 16 EXTENDED_KEY_SIZE = 176 ROW_SIZE = 4 ENCRYPTION_ROUNDS = 10 end if if defined AES192 KEY_SIZE = 24 EXTENDED_KEY_SIZE = 208 ROW_SIZE = 6 ENCRYPTION_ROUNDS = 12 end if if defined AES256 KEY_SIZE = 32 EXTENDED_KEY_SIZE = 240 ROW_SIZE = 8 ENCRYPTION_ROUNDS = 14 end if ;size of the sbox SBOX_SIZE equ 256 ;size of the rcon table RCON_SIZE equ 256 ;size of the Galois multiplication ;lookup tables GALOIS_SIZE equ 256Hyperion-2.0/Src/Payloads/Aes/32/rcon.asm0000755000175000017500000000365013476706334017436 0ustar sophiesophiemacro CreateRcon target, [char] { mov byte [target], char inc target } ;dynamically generate the rcon in memory ;uses hard coded values, no algorithm proc createRcon rcon_ptr:DWORD push eax mov eax, [rcon_ptr] CreateRcon eax, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\ 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\ 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\ 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\ 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\ 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\ 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\ 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\ 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\ 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\ 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\ 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\ 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\ 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\ 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\ 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d pop eax ret endpHyperion-2.0/Src/Payloads/Aes/32/keychain.asm0000755000175000017500000001576113476706334020276 0ustar sophiesophie;creates the round keys in keychain_ptr if defined AES128 proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\ rcon_ptr:DWORD local current_row:DWORD ;current column in ecx mov ecx, ROW_SIZE-1 ;current rcon index in edx mov edx, 1 key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with ecx-ROW_SIZE-1 stdcall loadColumn, [keychain_ptr], ecx ;shift rows rol eax,8 ;substitute with sbox stdcall subBytes, eax, [sbox_ptr] ;xor with rcon stdcall xorRcon, eax, [rcon_ptr], edx inc edx ;xor with column at index-ROW_SIZE-1 mov ebx,eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx ;store at index+1 inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ stdcall loadColumn, [keychain_ptr], ecx ;can be removed mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx } ;------------------- ;check for end of keychain generation cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 jne key_schedule_round ret endp end if if defined AES192 proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\ rcon_ptr:DWORD local current_row:DWORD ;current column in ecx mov ecx, ROW_SIZE-1 ;current rcon index in edx mov edx, 1 key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with ecx-ROW_SIZE-1 stdcall loadColumn, [keychain_ptr], ecx ;shift rows rol eax,8 ;substitute with sbox stdcall subBytes, eax, [sbox_ptr] ;xor with rcon stdcall xorRcon, eax, [rcon_ptr], edx inc edx ;xor with column at index-ROW_SIZE-1 mov ebx,eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx ;store at index+1 inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ stdcall loadColumn, [keychain_ptr], ecx ;can be removed mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx } ;------------------- ;check for end of keychain generation cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 je exit_key_schedule_round ;------------------- ;two times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 2{ stdcall loadColumn, [keychain_ptr], ecx ;can be removed mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx } ;------------------- jmp key_schedule_round exit_key_schedule_round: ret endp end if if defined AES256 proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\ rcon_ptr:DWORD local current_row:DWORD ;current column in ecx mov ecx, ROW_SIZE-1 ;current rcon index in edx mov edx, 1 key_schedule_round: ;------------------- ;get current column, apply key schedule core and ;xor the result with ecx-ROW_SIZE-1 stdcall loadColumn, [keychain_ptr], ecx ;shift rows rol eax,8 ;substitute with sbox stdcall subBytes, eax, [sbox_ptr] ;xor with rcon stdcall xorRcon, eax, [rcon_ptr], edx inc edx ;xor with column at index-ROW_SIZE-1 mov ebx,eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx ;store at index+1 inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx ;------------------- ;------------------- ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 rept 3{ stdcall loadColumn, [keychain_ptr], ecx ;can be removed mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx } ;------------------- ;check for end of keychain generation cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1 je exit_key_schedule_round ;------------------- ;one times: get current column, subsitute with ;sbox and xor it with ecx-ROW_SIZE-1 ;three times: get current column and ;xor it with ecx-ROW_SIZE-1 stdcall loadColumn, [keychain_ptr], ecx ;can be removed stdcall subBytes, eax, [sbox_ptr] mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx ;three times rept 3{ stdcall loadColumn, [keychain_ptr], ecx ;can be removed mov ebx, eax push ecx sub ecx,ROW_SIZE-1 stdcall loadColumn, [keychain_ptr],ecx pop ecx xor eax,ebx inc ecx stdcall storeColumn, eax, [keychain_ptr], ecx } ;------------------- jmp key_schedule_round exit_key_schedule_round: ret endp end if ;store a column at column_index in keychain proc storeColumn column:DWORD, keychain_ptr:DWORD, column_index:DWORD push eax push ebx push edx ;create pointer to first byte of the column ;and store column there mov eax, [column_index] mov ebx, COLUMN_SIZE mul ebx add eax, [keychain_ptr] mov ebx, [column] mov [eax], ebx pop edx pop ebx pop eax ret endp ;xor key dword with (rcon(index) 00 00 00) proc xorRcon key:DWORD, rcon_ptr:DWORD, rcon_index:DWORD push ebx mov eax,[rcon_index] mov ebx,[rcon_ptr] xlatb shl eax,24 mov ebx,[key] xor eax,ebx pop ebx ret endp ;returns in eax the column at column_index in the key chain proc loadColumn keychain_ptr:DWORD, column_index:DWORD push ebx push edx ;create pointer to first byte of the colum mov eax, [column_index] mov ebx, COLUMN_SIZE mul ebx add eax, [keychain_ptr] ;return dword and exit mov eax,[eax] pop edx pop ebx ret endp ;substitute subkey's bytes with the sbox proc subBytes subkey:DWORD, sbox_ptr:DWORD push ebx mov eax, [subkey] mov ebx, [sbox_ptr] xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 xlatb ror eax, 8 pop ebx ret endpHyperion-2.0/Src/Payloads/Aes/32/decryptexecutable.asm0000755000175000017500000000412313476706334022205 0ustar sophiesophie;Decrypt the exe which is stored in input_image proc decryptExecutable stdcall APITable:DWORD, input_image:DWORD local str1[256]:BYTE, ret_val:DWORD,\ key[KEY_SIZE]:BYTE, encrypted_backup:DWORD pushad writeWithNewLine createStringBruteforcing, str1, dec_exit_success ;init key lea edi,[key] mov ecx, KEY_SIZE mov al,0 dec_init_key: mov [edi],al inc edi dec ecx jnz dec_init_key ;create a copy of the encrypted file ;which is used to brute force the key mov eax,[APITable] stdcall dword [eax+VirtualAlloc], 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE test eax, eax jz dec_exit_error mov [encrypted_backup],eax ;now copy the file into the buffer mov edi,eax mov esi,[input_image] mov ecx,INFILE_SIZE ;we can mov dwords because buffer is a multiple of 16 shr ecx,2 repz movsd keyspace_loop: lea eax,[key] stdcall decAES, INFILE_SIZE, [input_image], [input_image], eax stdcall verifyChecksum, [input_image], INFILE_SIZE test eax,eax jnz dec_decrypted_success ;restore the encrypted version to try the next key mov esi,[encrypted_backup] mov edi,[input_image] mov ecx,INFILE_SIZE shr ecx,2 repz movsd ;lea eax,[key] ;stdcall encAES, [section_size], [section_address], [section_address], eax ;next key lea eax,[key] stdcall nextKey, eax test eax,eax jz dec_exit_error ;abort if key space was explored, else continue jmp keyspace_loop dec_decrypted_success: mov eax,[APITable] stdcall dword [eax+VirtualFree], [encrypted_backup], 0, MEM_RELEASE test eax, eax jz dec_exit_error dec_exit_success: popad mov eax,1 ret dec_exit_error: popad sub eax,eax ret endp ;generate next decryption key proc nextKey stdcall key_ptr:DWORD push ebx mov eax,[key_ptr] mov ebx,eax add ebx,REAL_KEY_SIZE nkey_next_element: inc byte [eax] cmp byte [eax],REAL_KEY_RANGE jne nkey_not_finished mov byte [eax],0 inc eax cmp eax,ebx je nkey_finished jmp nkey_next_element nkey_not_finished: pop ebx mov eax,1 ret nkey_finished: pop ebx sub eax,eax ret endp; Hyperion-2.0/Src/Payloads/Aes/32/aes.asm0000755000175000017500000000751313476706334017247 0ustar sophiesophieinclude 'sbox.asm' include 'rcon.asm' include 'keychain.asm' include 'encryptionrounds.asm' include 'decryptionrounds.asm' include 'galois.asm' ;encrypts cleartext and stores the result at enctext proc encAES size:DWORD, cleartext_ptr:DWORD, enctext_ptr:DWORD,\ aeskey_ptr:DWORD local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\ rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\ galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:DWORD,\ mul3_table_ptr:DWORD, sbox_ptr:DWORD, keychain_ptr:DWORD,\ rcon_ptr:DWORD pushad ;sbox and rcon are created in memory ;galois lookup tables too lea eax,[sbox] mov [sbox_ptr], eax stdcall createSBox, eax lea eax,[rcon] mov [rcon_ptr], eax stdcall createRcon, eax lea eax,[galois_mul2] mov [mul2_table_ptr], eax lea ebx,[galois_mul3] mov [mul3_table_ptr], ebx stdcall createGaloisEncryption, eax, ebx ;copy the key into the round key buffer mov ecx, KEY_SIZE mov esi, [aeskey_ptr] lea edi, [keychain] mov [keychain_ptr], edi rep movsb ;create the round keys stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\ [rcon_ptr] ;copy clear text to encryption buffer mov ecx, [size] mov esi, [cleartext_ptr] mov edi, [enctext_ptr] rep movsb ;eax == current to be encrypted block ;ebx == end of cleartext mov eax,[enctext_ptr] mov ebx,eax add ebx,[size] eaes_block_loop: stdcall encryptionRounds, eax, [keychain_ptr], \ [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr] add eax,BLOCK_SIZE cmp eax,ebx jnge eaes_block_loop popad mov eax,1 ret endp ;decrypts cleartext and stores the result at enctext proc decAES size:DWORD, enctext_ptr:DWORD, cleartext_ptr:DWORD,\ aeskey_ptr:DWORD local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\ sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\ rcon[RCON_SIZE]:BYTE,\ galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \ galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\ mul9_table_ptr:DWORD, mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\ mul14_table_ptr:DWORD, sbox_ptr:DWORD, invert_sbox_ptr:DWORD,\ keychain_ptr:DWORD, rcon_ptr:DWORD pushad ;sbox, invert sbox ;and rcon are created in memory lea eax,[sbox] mov [sbox_ptr], eax stdcall createSBox, eax lea eax,[rcon] mov [rcon_ptr], eax stdcall createRcon, eax lea eax, [invert_sbox] mov [invert_sbox_ptr], eax stdcall createInvertSBox, eax ;create galois lookup tables for ;9, 11, 13 and 14 lea eax,[galois_mul9] mov [mul9_table_ptr], eax lea ebx,[galois_mul11] mov [mul11_table_ptr], ebx lea ecx,[galois_mul13] mov [mul13_table_ptr], ecx lea edx,[galois_mul14] mov [mul14_table_ptr], edx stdcall createGaloisDecryption, eax, ebx, ecx, edx ;copy the key into the round key buffer mov ecx, KEY_SIZE mov esi, [aeskey_ptr] lea edi, [keychain] mov [keychain_ptr], edi rep movsb ;create the round keys stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\ [rcon_ptr] ;copy encrypted text to decryption buffer mov ecx, [size] mov esi, [enctext_ptr] mov edi, [cleartext_ptr] rep movsb ;eax == current to be decrypted block ;ebx == end of cleartext mov eax,[cleartext_ptr] mov ebx,eax add ebx,[size] daes_block_loop: stdcall decryptionRounds, eax, [keychain_ptr],\ [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\ [mul13_table_ptr], [mul14_table_ptr] add eax,BLOCK_SIZE cmp eax,ebx jnge daes_block_loop popad mov eax,1 ret endpHyperion-2.0/Src/Payloads/Aes/32/aes.inc0000755000175000017500000000026113476706334017231 0ustar sophiesophie;select an AES mode AES128 equ 1 ;AES192 equ 1 ;AES256 equ 1 ;internal constants, don't change them include 'aes_constants_intern.inc'Hyperion-2.0/Src/Payloads/Aes/32/decryptionrounds.asm0000755000175000017500000000646513476706334022117 0ustar sophiesophie;uses the generated round keys to decrypt an aes block proc decryptionRounds decryption_ptr:DWORD,\ roundkeys_ptr:DWORD, inverse_sbox_ptr:DWORD, mul9_table_ptr:DWORD, \ mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\ mul14_table_ptr:DWORD pushad ;roundkey and decryption in eax and ebx mov eax, [roundkeys_ptr] add eax, BLOCK_SIZE*ENCRYPTION_ROUNDS mov ebx, [decryption_ptr] ;final round stdcall addRoundKey, ebx, eax stdcall inverseShiftRows, ebx stdcall subBlockBytes, ebx, [inverse_sbox_ptr] sub eax,BLOCK_SIZE ;main round dr_main: stdcall addRoundKey, ebx, eax stdcall mixColumns9111314, ebx, [mul9_table_ptr], [mul11_table_ptr],\ [mul13_table_ptr], [mul14_table_ptr] stdcall inverseShiftRows, ebx stdcall subBlockBytes, ebx, [inverse_sbox_ptr] sub eax, BLOCK_SIZE cmp eax, [roundkeys_ptr] jne dr_main ;initial_round stdcall addRoundKey, ebx, eax popad ret endp ;mix columns operation is a column matrix ;multiplication proc mixColumns9111314, data_ptr:DWORD, mul9_table_ptr:DWORD,\ mul11_table_ptr:DWORD, mul13_table_ptr:DWORD, mul14_table_ptr:DWORD local current_column:DWORD push edx push eax push ebx push ecx mov edx, [data_ptr] rept 4{ ;element 3 mov eax, [edx] mov ebx, [mul9_table_ptr] xlatb mov cl, al shr eax,8 mov ebx, [mul13_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul11_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul14_table_ptr] xlatb xor cl, al mov [current_column], ecx ;element 2 mov eax, [edx] mov ebx, [mul13_table_ptr] xlatb mov cl, al shr eax,8 mov ebx, [mul11_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul14_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul9_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 1 mov eax, [edx] mov ebx, [mul11_table_ptr] xlatb mov cl, al shr eax,8 mov ebx, [mul14_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul9_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul13_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl mov [current_column], eax ;element 0 mov eax, [edx] mov ebx, [mul14_table_ptr] xlatb mov cl, al shr eax,8 mov ebx, [mul9_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul13_table_ptr] xlatb xor cl, al shr eax,8 mov ebx, [mul11_table_ptr] xlatb xor cl, al mov eax, [current_column] shl eax, 8 mov al, cl ;finished, store it mov [edx], eax add edx, COLUMN_SIZE } pop ecx pop ebx pop eax pop edx ret endp ;reverse shift operation for decryption proc inverseShiftRows, data_ptr:DWORD push eax push ebx mov ebx,[data_ptr] loadRow rol eax, 8 storeRow inc ebx loadRow rol eax, 16 storeRow inc ebx loadRow rol eax, 24 storeRow pop ebx pop eax ret endpHyperion-2.0/Src/Payloads/Aes/32/sbox.asm0000755000175000017500000000733213476706334017451 0ustar sophiesophiemacro CreateSBox target, [char] { mov byte [target], char inc target } ;dynamically generate the sbox in memory ;uses hard coded values, no algorithm proc createSBox sbox_ptr:DWORD push eax mov eax, [sbox_ptr] CreateSBox eax, 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\ 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\ 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\ 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\ 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\ 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\ 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\ 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\ 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\ 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\ 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\ 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\ 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\ 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\ 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\ 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 pop eax ret endp ;the inverted sbox for decryption proc createInvertSBox sbox_ptr:DWORD push eax mov eax, [sbox_ptr] CreateSBox eax, 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\ 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\ 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\ 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\ 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\ 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\ 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\ 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\ 0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\ 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\ 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\ 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\ 0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\ 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\ 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\ 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d pop eax ret endp Hyperion-2.0/Src/Payloads/Aes/32/galois.asm0000755000175000017500000002552413476706334017757 0ustar sophiesophiemacro CreateGalois target, [char] { mov byte [target], char inc target } ;create 2 lookup tables for multiplication in the ;galois field with 2 and 3 proc createGaloisEncryption mul2_ptr:DWORD, mul3_ptr:DWORD push eax mov eax, [mul2_ptr] CreateGalois eax, 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\ 0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\ 0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\ 0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\ 0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\ 0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\ 0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\ 0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\ 0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\ 0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\ 0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\ 0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\ 0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\ 0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\ 0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\ 0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5 mov eax, [mul3_ptr] CreateGalois eax, 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\ 0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\ 0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\ 0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\ 0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\ 0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\ 0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\ 0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\ 0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\ 0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\ 0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\ 0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\ 0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\ 0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\ 0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\ 0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a pop eax ret endp ;create 4 lookup tables for multiplication in the ;galois field with 9, 11, 13 and 14 proc createGaloisDecryption mul9_ptr:DWORD, mul11_ptr:DWORD,\ mul13_ptr:DWORD, mul14_ptr:DWORD push eax mov eax, [mul9_ptr] CreateGalois eax, 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \ 0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \ 0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \ 0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \ 0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \ 0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \ 0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \ 0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \ 0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \ 0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \ 0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \ 0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \ 0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \ 0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \ 0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \ 0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46 mov eax, [mul11_ptr] CreateGalois eax, 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \ 0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \ 0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \ 0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \ 0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \ 0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \ 0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \ 0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \ 0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \ 0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \ 0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \ 0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \ 0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \ 0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \ 0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \ 0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3 mov eax, [mul13_ptr] CreateGalois eax, 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \ 0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \ 0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \ 0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \ 0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \ 0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \ 0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \ 0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \ 0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \ 0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \ 0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \ 0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \ 0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \ 0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \ 0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \ 0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97 mov eax, [mul14_ptr] CreateGalois eax, 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \ 0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \ 0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \ 0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \ 0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \ 0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \ 0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \ 0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \ 0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \ 0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \ 0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \ 0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \ 0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \ 0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \ 0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \ 0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d pop eax ret endpHyperion-2.0/Src/Payloads/Aes/bin/0000755000175000017500000000000013476706334016310 5ustar sophiesophieHyperion-2.0/Src/Payloads/Aes/bin/aes10.dll0000755000175000017500000003500013476706334017717 0ustar sophiesophieMZ@@ !L!This program cannot be run in DOS mode. $PELT! G0@@p"@P@`.text /0 `.idata@4@.edataP6@@.reloc`8@BU UEjjPju jhl@@jjuu@@up@@Uh@@PuUPEc@|@w@{@@k@o@@0@@g@+@@@@v@@@@}@@Y@G@@@@@@@@r@@@@@&@6@?@@@4@@@@q@@1@@@@#@@@@@@@@@@@'@@u@ @@,@@@n@Z@@R@;@@@)@@/@@S@@@@ @@@[@j@@@9@J@L@X@@@@@@C@M@3@@E@@@@P@<@@@Q@@@@@@@8@@@@@!@@@@@@ @@@_@@D@@@@~@=@d@]@@s@`@@O@@"@*@@@F@@@@@^@ @@@2@:@ @I@@$@\@@@@b@@@@y@@@7@m@@@N@@l@V@@@e@z@@@@x@%@.@@@@@@@t@@K@@@@p@>@@f@H@@@@a@5@W@@@@@@@@@@i@@@@@@@@@U@(@@@@@ @@@B@h@A@@-@@@T@@@XUPER@ @j@@0@6@@8@@@@@@@@@@|@@9@@@/@@@4@@C@D@@@@@T@{@@2@@@#@=@@L@@ @B@@@N@@.@@f@(@@$@@v@[@@I@m@@@%@r@@@d@@h@@@@@\@@]@e@@@l@p@H@P@@@@@^@@F@W@@@@@@@@@@@@ @@@X@@@@E@@@,@@@@?@@@@@@@@@@k@:@@@A@O@g@@@@@@@@@@s@@@t@"@@@5@@@@7@@@u@@n@G@@@q@@)@@@o@@b@@@@@@@V@>@K@@@y@ @@@@@x@@Z@@@@@3@@@@1@@@@Y@'@@@_@`@Q@@@@@J@ @-@@z@@@@@@@@;@M@@*@@@@@@<@@S@@a@@+@@~@@w@@&@@i@@c@U@!@ @}@XUPE@@@@@@ @@@@@6@l@@@M@@/@^@@c@@@5@j@@@}@@@@@9@r@@@@a@@@%@J@@3@f@@@@:@t@@@@@@@@@ @@@@@6@l@@@M@@/@^@@c@@@5@j@@@}@@@@@9@r@@@@a@@@%@J@@3@f@@@@:@t@@@@@@@@@ @@@@@6@l@@@M@@/@^@@c@@@5@j@@@}@@@@@9@r@@@@a@@@%@J@@3@f@@@@:@t@@@@@@@@@ @@@@@6@l@@@M@@/@^@@c@@@5@j@@@}@@@@@9@r@@@@a@@@%@J@@3@f@@@@:@t@@@@@@@@@ @@@@@6@l@@@M@@/@^@@c@@@5@j@@@}@@@@@9@r@@@@a@@@%@J@@3@f@@@@:@t@@@@XUQuu PRuPBQQuY1AQuPQuQQuY1AQuPYQuQQuxY1AQuP3QuaQQuRY1AQuP +H UPSREE ]Z[X USE] ]1[ USRE EZ[USE] [U`E ]PS9 uSkSuuS(PSIuuSCSiPSaURPSQU0]0] 0M]0] 00EȉE]׈] 000EȉE] ׈00]0Eȉ0]0] 0M]0] 00EȉE]׈] 000EȉE] ׈00]0Eȉ0]0] 0M]0] 00EȉE]׈] 000EȉE] ׈00]0Eȉ0]0] 0M]0] 00EȉE]׈] 000EȉE] ׈00]0EȉY[XZ UPS]CCC C CCCCCC C CCCCCC C CC[XUPSRE] 3333Z[XUPSR] UZ[XU`E ]PS8S%uSlPSu uuuS#SuSA;E uPSaURPSQU] ׈]0]0]0M]׈]0]0] 0EȉE]׈]0] 0]0EȉE]׈] 0]0]0Eȉ] ׈]0]0]0M]׈]0]0] 0EȉE]׈]0] 0]0EȉE]׈] 0]0]0Eȉ] ׈]0]0]0M]׈]0]0] 0EȉE]׈]0] 0]0EȉE]׈] 0]0]0Eȉ] ׈]0]0]0M]׈]0]0] 0EȉE]׈]0] 0]0EȉE]׈] 0]0]0EȉY[XZUPS]CCC C CCCCCC C CCCCCC C CC[XUPE@@@@@ @ @@@@@@@@@@ @"@$@&@(@*@,@.@0@2@4@6@8@:@<@>@@@B@D@F@H@J@L@N@P@R@T@V@X@Z@\@^@`@b@d@f@h@j@l@n@p@r@t@v@x@z@|@~@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @@ @@@@@;@9@?@=@3@1@7@5@+@)@/@-@#@!@'@%@[@Y@_@]@S@Q@W@U@K@I@O@M@C@A@G@E@{@y@@}@s@q@w@u@k@i@o@m@c@a@g@e@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@E @@@@ @@ @ @@@@@@@@@0@3@6@5@<@?@:@9@(@+@.@-@$@'@"@!@`@c@f@e@l@o@j@i@x@{@~@}@t@w@r@q@P@S@V@U@\@_@Z@Y@H@K@N@M@D@G@B@A@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@[@X@]@^@W@T@Q@R@C@@@E@F@O@L@I@J@k@h@m@n@g@d@a@b@s@p@u@v@@|@y@z@;@8@=@>@7@4@1@2@#@ @%@&@/@,@)@*@ @@ @@@@@@@@@@@@@@XUPE@ @@@$@-@6@?@H@A@Z@S@l@e@~@w@@@@@@@@@@@@@@@@@;@2@)@ @@@ @@s@z@a@h@W@^@E@L@@@@@@@@@@@@@@@@@v@@d@m@R@[@@@I@>@7@,@%@@@@@@@@@@@@@@@@@@@@@M@D@_@V@i@`@{@r@@ @@@!@(@3@:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@|@u@n@g@X@Q@J@C@4@=@&@/@@@@ @@@@@@@@@@@@@@@@@G@N@U@\@c@j@q@x@@@@@+@"@9@0@@@@@@@@@@@@@@@@@ @@@@.@'@<@5@B@K@P@Y@f@o@t@}@@@@@@@@@@@@@@@@@1@8@#@*@@@@@y@p@k@b@]@T@O@F@E @ @@@,@'@:@1@X@S@N@E@t@@b@i@@@@@@@@@@@@@@@@@{@p@m@f@W@\@A@J@#@(@5@>@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@F@M@P@[@j@a@|@w@@@@@2@9@$@/@@@@@@@@@@@@@@@@@=@6@+@ @@@@ @e@n@s@x@I@B@_@T@@@@@@@@@@@@@@@@@G@L@Q@Z@k@`@}@v@@@ @@3@8@%@.@@@@@@@@@@@@@@@@@<@7@*@!@@@@ @d@o@r@y@H@C@^@U@@ @@@-@&@;@0@Y@R@O@D@u@~@c@h@@@@@@@@@@@@@@@@@z@q@l@g@V@]@@@K@"@)@4@?@@@@@@@@@@@@@@@@@@@@@E@ @@@4@9@.@#@h@e@r@@\@Q@F@K@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@k@f@q@|@_@R@E@H@@@@@7@:@-@ @m@`@w@z@Y@T@C@N@@@@@1@<@+@&@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@2@?@(@%@n@c@t@y@Z@W@@@M@@@@@@@@@@@@@@@@@ @@@@>@3@$@)@b@o@x@u@V@[@L@A@a@l@{@v@U@X@O@B@ @@@@=@0@'@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@g@j@}@p@S@^@I@D@@@@@;@6@!@,@ @@@@8@5@"@/@d@i@~@s@P@]@J@G@@@@@@@@@@@@@@@@@E@@@@8@6@$@*@p@~@l@b@H@F@T@Z@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@;@5@'@)@@ @@@K@E@W@Y@s@}@o@a@@@@@@@@@@@@@@@@@M@C@Q@_@u@{@i@g@=@3@!@/@@ @@@v@x@j@d@N@@@R@\@@@@@>@0@"@,@@@@@@@@@@@@@@@@@A@O@]@S@y@w@e@k@1@?@-@#@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@z@t@f@h@B@L@^@P@ @@@@2@<@.@ @@@@@@@@@@@@@@@@@ @@@@4@:@(@&@|@r@`@n@D@J@X@V@7@9@+@%@@@@@G@I@[@U@@q@c@m@@@@@@@@@@@@@@@@@XU`EPEPE썝]SPu<}uuupMu }E]uuuuP9|aU`EPEPEPE]䍍M荕URQSPu0}uuuMu }E]uuuuuuP9|aX@<@h@@J@@KERNEL32.DLLUSER32.DLLx@@@x@@@GetLastErrorFormatMessageALocalFree@@MessageBoxAPP(P8PHP I=I>ZPkPPyPAES10.DLLShowErrorMessageShowLastErroraesEncryptaesDecrypt(080A0N0Hyperion-2.0/Src/Crypter/0000755000175000017500000000000013476706334014704 5ustar sophiesophieHyperion-2.0/Src/Crypter/pe32.c0000755000175000017500000000117413476706334015627 0ustar sophiesophie#include "hyperion.h" /** * Jumps from the CoffHeader to the OptionalStandardHeader */ struct OptionalStandardHeader32* getOSH32(struct CoffHeader* coff_ptr){ struct OptionalStandardHeader32* ret = (struct OptionalStandardHeader32*) ((char*) coff_ptr + sizeof(struct CoffHeader)); return ret; } /** * Jumps from the OptionalStandardHeader to the OptionalWindowsHeader */ struct OptionalWindowsHeader32* getOWH32(struct OptionalStandardHeader32* os_ptr){ return (struct OptionalWindowsHeader32*) (((char*) os_ptr) + sizeof(struct OptionalStandardHeader32)); } Hyperion-2.0/Src/Crypter/verbose.c0000755000175000017500000000041613476706334016521 0ustar sophiesophie#include #include #include "hyperion.h" BOOL display_verbose = FALSE; void verbose(const char *format, ...) { va_list args; if (!display_verbose) return; va_start(args, format); vprintf(format, args); va_end(args); } Hyperion-2.0/Src/Crypter/encryption.c0000755000175000017500000000430013476706334017242 0ustar sophiesophie#include "hyperion.h" #include #include #include /** * Create a simple checksum from a file which adds each of its bytes */ uint32_t getChecksum(unsigned char* data, unsigned int size){ uint32_t ret = 0; for(unsigned int i=0; i #include #include #include "hyperion.h" BOOL isExecutable(struct CoffHeader* coff_header){ if (coff_header==0) { return FALSE; } if (!(coff_header->Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE)) { fprintf(stderr, "File is not an executable image, aborting...\n"); return FALSE; } if (coff_header->Characteristics & IMAGE_FILE_DLL) { fprintf(stderr, "File is a dll, aborting...\n"); return FALSE; } return TRUE; } BOOL isPE32(struct CoffHeader* coff_header){ struct OptionalStandardHeader32* ret = (struct OptionalStandardHeader32*) ((char*) coff_header + sizeof(struct CoffHeader)); if (ret->Magic == OPTIONAL_HEADER_MAGIC_PE32) { return TRUE; } else{ return FALSE; } } /** * Checks whether file has a correct MZ and PE signature. * Returns the offset to the coff file header if signatures * are correct, otherwise a null pointer. */ struct CoffHeader* getCoffHeader(struct OpenFile* input_file){ if(sizeof(struct MZHeader) > input_file->size) { fprintf(stderr, "No valid executable\n"); return NULL; } //check MZ signature struct MZHeader* mz = (struct MZHeader*) input_file->file; if(memcmp(mz->signature, MZ_SIGNATURE, MZ_SIGNATURE_SIZE != 0)) { fprintf(stderr, "No valid MZ Signature\n"); return NULL; } verbose("Found valid MZ signature\n"); //get PE header verbose("Found pointer to PE Header: 0x%x\n", mz->ptrPE); //ptrPe out of bounds? if(input_file->file + mz->ptrPE >= input_file->file + input_file->size) { fprintf(stderr, "Pointer to PE in MZ header points to nowhere\n"); return NULL; } //no ptrPE? if (!(mz->ptrPE)) { fprintf(stderr, "Pointer to PE in MZ header is a null pointer\n"); return NULL; } uint8_t* pe_sig = mz->ptrPE + (uint8_t*) input_file->file; if(memcmp(pe_sig, PE_SIGNATURE, PE_SIGNATURE_SIZE) != 0) { fprintf(stderr, "No valid PE signature found\n"); return NULL; } verbose("Found valid PE signature\n"); return (struct CoffHeader*) (input_file->file + mz->ptrPE + PE_SIGNATURE_SIZE); } Hyperion-2.0/Src/Crypter/fasmoutput.h0000755000175000017500000000211313476706334017264 0ustar sophiesophie#define FASM_EXECUTABLE_FILENAME "Fasm\\FASM.EXE" #define CONTAINER32_DIR "Src\\Container\\32\\" #define CONTAINER64_DIR "Src\\Container\\64\\" #define INFILE_SIZE_LABEL "INFILE_SIZE" #define IMAGE_BASE_LABEL "IMAGE_BASE" #define IMAGE_SIZE_LABEL "IMAGE_SIZE" #define REAL_KEY_SIZE_LABEL "REAL_KEY_SIZE" #define REAL_KEY_RANGE_LABEL "REAL_KEY_RANGE" #define KEY_SIZE_FILENAME "key_size.inc" #define IMAGE_SIZE_FILENAME "image_size.inc" #define IMAGE_BASE_FILENAME "image_base.inc" #define INFILE_ARRAY_FILENAME "infile_array.inc" #define INFILE_SIZE_FILENAME "infile_size.inc" #define LOG_ENABLE_FILENAME "logfile_enable.asm" #define LOG_DISABLE_FILENAME "logfile_disable.asm" #define LOGFILE_SELECT_FILENAME "logfile_select.asm" #define CONTAINER_MAIN_FILENAME "main.asm" #define DECRYPTION_PAYLOAD_FILENAME "decryption_payload.asm" //AES PAYLOAD INCLUDES #define PAYLOAD32_AES_DIR "..\\..\\Payloads\\Aes\\32\\" #define PAYLOAD64_AES_DIR "..\\..\\Payloads\\Aes\\64\\" #define AES_INC_FILENAME "aes.inc" #define AES_ASM_FILENAME "aes.asm" #define AES_DECRYPTION_FILENAME "decryptexecutable.asm" Hyperion-2.0/Src/Crypter/fileaccess.c0000755000175000017500000000414413476706334017157 0ustar sophiesophie#include "hyperion.h" #include #include BOOL fileToMem(const char* file_name, struct OpenFile* open_file){ //open input file verbose("Opening %s\n", file_name); FILE* f1 = fopen(file_name,"rb"); if(f1 == NULL) { fprintf(stderr, "Could not open %s\n", file_name); return FALSE; } /* obtain file size: */ fseek (f1, 0, SEEK_END); int f1_size = ftell (f1); rewind (f1); /* copy file to memory */ unsigned char* file1 = (unsigned char*) malloc(f1_size); if(file1 == NULL) { fprintf(stderr, "Could not allocate memory for input file size %d\n", f1_size); return FALSE; } size_t read_bytes = fread((void*) file1, 1, f1_size, f1); if(read_bytes != f1_size) { fprintf(stderr, "Could not copy input file into memory: %d %d\n", read_bytes, f1_size); fclose(f1); return FALSE; } /* close input files */ fclose(f1); //file opened successfully open_file->file = file1; open_file->size = f1_size; verbose("Successfully copied file to memory location: 0x%x\n", (unsigned long int) open_file->file); return TRUE; } BOOL memToFile(const char* file_name, char* content, unsigned long size, BOOL append){ FILE* f1 = NULL; if(!append) { f1 = fopen(file_name,"wb"); } else{ f1 = fopen(file_name,"ab"); } if(f1 == NULL) { fprintf(stderr, "Could not open %s\n", file_name); return FALSE; } size_t bytes_written = fwrite(content, sizeof(char), size, f1); if(bytes_written != size) { fclose(f1); fprintf(stderr, "Could not copy memory to output file: %d %d\n", bytes_written, size); return FALSE; } /* close input files */ fclose(f1); return TRUE; } Hyperion-2.0/Src/Crypter/pe.h0000755000175000017500000000702613476706334015471 0ustar sophiesophie#ifndef PE_H_INCLUDED #define PE_H_INCLUDED #include "stdint.h" #define MZ_SIGNATURE "MZ" #define MZ_SIGNATURE_SIZE 2 #define PE_SIGNATURE "PE\0\0" #define PE_SIGNATURE_SIZE 4 #define OPTIONAL_HEADER_MAGIC_PE32 0x10b #define OPTIONAL_HEADER_MAGIC_PE64 0x20b #define SECTION_NAME_SIZE 8 #define IMAGE_BASE_ALIGNMENT 0x10000 struct MZHeader { uint8_t signature[MZ_SIGNATURE_SIZE]; uint8_t data[0x3a]; uint32_t ptrPE; }; struct CoffHeader { uint16_t Machine; uint16_t NumberOfSections; uint32_t TimeDateStamp; uint32_t PointerToSymbolTable; uint32_t NumberOfSymbols; uint16_t SizeOfOptionalHeader; uint16_t Characteristics; }; struct OptionalStandardHeader32 { uint16_t Magic; uint8_t MajorLinkerVersion; uint8_t MinorLinkerVersion; uint32_t SizeOfCode; uint32_t SizeOfInitializedData; uint32_t SizeOfUninitializedData; uint32_t AddressOfEntryPoint; uint32_t BaseOfCode; uint32_t BaseOfData; }; struct OptionalStandardHeader64 { uint16_t Magic; uint8_t MajorLinkerVersion; uint8_t MinorLinkerVersion; uint32_t SizeOfCode; uint32_t SizeOfInitializedData; uint32_t SizeOfUninitializedData; uint32_t AddressOfEntryPoint; uint32_t BaseOfCode; }; struct OptionalWindowsHeader32 { uint32_t ImageBase; //plus uint32_t SectionAlignment; uint32_t FileAlignment; uint16_t MajorOperatingSystemVersion; uint16_t MinorOperatingSystemVersion; uint16_t MajorImageVersion; uint16_t MinorImageVersion; uint16_t MajorSubsystemVersion; uint16_t MinorSubsystemVersion; uint32_t Win32VersionValue; uint32_t SizeOfImage; uint32_t SizeOfHeaders; uint32_t CheckSum; uint16_t Subsystem; uint16_t DllCharacteristics; uint32_t SizeOfStackReserve; //plus uint32_t SizeOfStackCommit; //plus uint32_t SizeOfHeapReserve; //plus uint32_t SizeOfHeapCommit; //plus uint32_t LoaderFlags; uint32_t NumberOfRvaAndSizes; }; struct OptionalWindowsHeader64 { uint64_t ImageBase; //plus uint32_t SectionAlignment; uint32_t FileAlignment; uint16_t MajorOperatingSystemVersion; uint16_t MinorOperatingSystemVersion; uint16_t MajorImageVersion; uint16_t MinorImageVersion; uint16_t MajorSubsystemVersion; uint16_t MinorSubsystemVersion; uint32_t Win32VersionValue; uint32_t SizeOfImage; uint32_t SizeOfHeaders; uint32_t CheckSum; uint16_t Subsystem; uint16_t DllCharacteristics; uint64_t SizeOfStackReserve; //plus uint64_t SizeOfStackCommit; //plus uint64_t SizeOfHeapReserve; //plus uint64_t SizeOfHeapCommit; //plus uint32_t LoaderFlags; uint32_t NumberOfRvaAndSizes; }; struct ImageDataDirectory { uint32_t VirtualAddress; uint32_t Size; }; struct SectionHeader { uint8_t Name[SECTION_NAME_SIZE]; uint32_t VirtualSize; uint32_t VirtualAddress; uint32_t SizeOfRawData; uint32_t PointerToRawData; uint32_t PointerToRelocations; uint32_t PointerToLinenumbers; uint16_t NumberOfRelocations; uint16_t NumberOfLinenumbers; uint32_t Characteristics; }; #endif // PE_H_INCLUDED Hyperion-2.0/Src/Crypter/hyperion.h0000755000175000017500000000407113476706334016717 0ustar sophiesophie#ifndef __HYPERION_H__ #define __HYPERION_H__ #include #include #include "pe.h" #include "fasmoutput.h" #define TRUE 1 #define FALSE 0 #define MAX_CHAR_SIZE 1024 #define CHECKSUM_SIZE 4 #define AES_KEY_SIZE 16 #define AES_BLOCK_SIZE 16 #define AES_ENCRYPT_API "aesEncrypt" #define AES_DLL "Src\\Payloads\\Aes\\bin\\aes10.dll" struct OpenFile { unsigned char* file; int size; }; struct PEData { uint32_t ImageBase32; uint64_t ImageBase64; uint32_t SizeOfImage; }; //verbose api void verbose(const char *format, ...); //file api BOOL fileToMem(const char* file_name, struct OpenFile* open_file); BOOL memToFile(const char* file_name, char* content, unsigned long size, BOOL append); //pe api struct CoffHeader* getCoffHeader(struct OpenFile* input_file); BOOL isExecutable(struct CoffHeader* coff_header); BOOL isPE32(struct CoffHeader* coff_header); struct OptionalStandardHeader32* getOSH32(struct CoffHeader* coff_ptr); struct OptionalStandardHeader64* getOSH64(struct CoffHeader* coff_ptr); struct OptionalWindowsHeader32* getOWH32(struct OptionalStandardHeader32* os_ptr); struct OptionalWindowsHeader64* getOWH64(struct OptionalStandardHeader64* os_ptr); //fasm api BOOL fasmDefine(const char* output_dir, const char* filename, const char* label, uint64_t value, BOOL append); BOOL fasmInclude(const char* output_dir, const char* filename, const char* label, BOOL append); BOOL fasmEncryptOutput(const char* output_dir, struct OpenFile* input_file, unsigned int key_length, unsigned int key_space); //encryption api uint32_t getChecksum(unsigned char* data, unsigned int size); BOOL encryptFile(uint8_t* input_file, unsigned int file_size, unsigned int key_length, unsigned int key_space); BOOL encryptAES(uint8_t* input, unsigned int size, uint8_t* key); //decryption api BOOL decryptAES(BOOL pe32); //secure string size_t strlcat(char *dst, const char *src, size_t size); size_t strlcpy(char *dst, const char *src, size_t size); #endif Hyperion-2.0/Src/Crypter/aes.c0000755000175000017500000000267313476706334015633 0ustar sophiesophie#include "hyperion.h" #include "fasmoutput.h" //include '..\..\Payloads\Aes\32\aes.inc' //include '..\..\Payloads\Aes\32\aes.asm' //include '..\..\Payloads\Aes\32\decryptexecutable.asm' BOOL decryptAES(BOOL pe32){ const char* payload_directory; const char* container_directory; //select destination paths if(pe32){ payload_directory = PAYLOAD32_AES_DIR; container_directory = CONTAINER32_DIR; } else{ payload_directory = PAYLOAD64_AES_DIR; container_directory = CONTAINER64_DIR; } //create file names char aes_inc[MAX_CHAR_SIZE]; aes_inc[0] = 0; strlcat(aes_inc, payload_directory, MAX_CHAR_SIZE); strlcat(aes_inc, AES_INC_FILENAME, MAX_CHAR_SIZE); char aes_asm[MAX_CHAR_SIZE]; aes_asm[0] = 0; strlcat(aes_asm, payload_directory, MAX_CHAR_SIZE); strlcat(aes_asm, AES_ASM_FILENAME, MAX_CHAR_SIZE); char decrypter_asm[MAX_CHAR_SIZE]; decrypter_asm[0] = 0; strlcat(decrypter_asm, payload_directory, MAX_CHAR_SIZE); strlcat(decrypter_asm, AES_DECRYPTION_FILENAME, MAX_CHAR_SIZE); //create include file to use aes algorithm if(!fasmInclude(container_directory, DECRYPTION_PAYLOAD_FILENAME, aes_inc, FALSE)) { return FALSE; } if(!fasmInclude(container_directory, DECRYPTION_PAYLOAD_FILENAME, aes_asm, TRUE)) { return FALSE; } if(!fasmInclude(container_directory, DECRYPTION_PAYLOAD_FILENAME, decrypter_asm, TRUE)) { return FALSE; } return TRUE; } Hyperion-2.0/Src/Crypter/secure_string.c0000755000175000017500000000361313476706334017732 0ustar sophiesophie/* * Code from http://stackoverflow.com/users/2193455/kangear */ #ifndef HAVE_STRLCAT #include #include #include /* * '_cups_strlcat()' - Safely concatenate two strings. */ size_t /* O - Length of string */ strlcat(char *dst, /* O - Destination string */ const char *src, /* I - Source string */ size_t size) /* I - Size of destination string buffer */ { size_t srclen; /* Length of source string */ size_t dstlen; /* Length of destination string */ /* * Figure out how much room is left... */ dstlen = strlen(dst); size -= dstlen + 1; if (!size) return (dstlen); /* No room, return immediately... */ /* * Figure out how much room is needed... */ srclen = strlen(src); /* * Copy the appropriate amount... */ if (srclen > size) srclen = size; memcpy(dst + dstlen, src, srclen); dst[dstlen + srclen] = '\0'; return (dstlen + srclen); } #endif /* !HAVE_STRLCAT */ #ifndef HAVE_STRLCPY /* * '_cups_strlcpy()' - Safely copy two strings. */ size_t /* O - Length of string */ strlcpy(char *dst, /* O - Destination string */ const char *src, /* I - Source string */ size_t size) /* I - Size of destination string buffer */ { size_t srclen; /* Length of source string */ /* * Figure out how much room is needed... */ size--; srclen = strlen(src); /* * Copy the appropriate amount... */ if (srclen > size) srclen = size; memcpy(dst, src, srclen); dst[srclen] = '\0'; return (srclen); } #endif /* !HAVE_STRLCPY */ Hyperion-2.0/Src/Crypter/hyperion.c0000644000175000017500000002411113476706334016704 0ustar sophiesophie#include #include #include #include #include #include "hyperion.h" extern BOOL display_verbose; int main(int argc, char *argv[]){ if(argc<3) { printf("Hyperion PE-Crypter\n"); printf("Version 2.0 by Christian Ammann\n"); printf("Http://www.phobosys.de/hyperion\n"); printf("\n"); printf("Usage: hyperion.exe \n"); printf("List of available options:\n"); printf(" -k \t Length of random AES key in bytes.\n"); printf(" \t Default value is 6.\n"); printf(" -s \t Each byte of the key has a range between\n"); printf(" \t 0 and . Default value is 4.\n"); printf(" -l, --logile \t The packed executable generates a log.txt\n"); printf(" \t on startup for debugging purpose\n"); printf(" -v, --verbose\t Print verbose informations while running.\n"); return EXIT_SUCCESS; } //command line options unsigned int key_length = 6; unsigned int key_space = 4; BOOL create_log = FALSE; char* infile_name = 0; char* output_name = 0; //parse commandline parameters for(int i=1; i 16 || key_length<1) { fprintf(stderr, "Key length has to be a value between 1 and 16\n"); return EXIT_FAILURE; } if(key_space > 255 || key_space<2) { fprintf(stderr, "Key space has to be a value between 2 and 255\n"); return EXIT_FAILURE; } //open input file verbose("\n"); verbose(" -------------------------------\n"); verbose("| Stage 1: Analyzing input file |\n"); verbose(" -------------------------------\n"); verbose("\n"); struct OpenFile open_file; if(!fileToMem(infile_name, &open_file)) { return EXIT_FAILURE; } //check whether it's a valid executable and collect data struct CoffHeader* coff_header = getCoffHeader(&open_file); if(!coff_header) { goto error; } if(!isExecutable(coff_header)) { goto error; } //we need these later when we generate the asm code struct PEData pe_data; const char* container_directory; BOOL pe32 = isPE32(coff_header); if(pe32) { verbose("Found 32 bit binary\n"); struct OptionalStandardHeader32* osh32 = getOSH32(coff_header); struct OptionalWindowsHeader32* owh32 = getOWH32(osh32); verbose("Image base is 0x%x\n", owh32->ImageBase); verbose("Image size is 0x%x\n", owh32->SizeOfImage); pe_data.ImageBase32 = owh32->ImageBase; pe_data.SizeOfImage = owh32->SizeOfImage; container_directory = CONTAINER32_DIR; } else{ verbose("Found 64 bit binary\n"); struct OptionalStandardHeader64* osh64 = getOSH64(coff_header); struct OptionalWindowsHeader64* owh64 = getOWH64(osh64); verbose("Image base is 0x%" PRIx64 "\n", owh64->ImageBase); verbose("Image size is 0x%" PRIx64 "\n", owh64->SizeOfImage); pe_data.ImageBase64 = owh64->ImageBase; pe_data.SizeOfImage = owh64->SizeOfImage; container_directory = CONTAINER64_DIR; } //create decryption stub verbose("\n"); verbose(" -------------------------------\n"); verbose("| Stage 2: Generating ASM files |\n"); verbose(" -------------------------------\n"); verbose("\n"); //encrypt input file and create fasm array if(!fasmEncryptOutput(container_directory, &open_file, key_length, key_space)) { goto error; } //create image base asm representation and write it to IMAGE_BASE_INC if(!fasmDefine(container_directory, IMAGE_BASE_FILENAME, IMAGE_BASE_LABEL, pe32 ? pe_data.ImageBase32 : pe_data.ImageBase64, FALSE)) { goto error; } //create image size asm representation and write it to IMAGE_SIZE_INC if(!fasmDefine(container_directory, IMAGE_SIZE_FILENAME, IMAGE_SIZE_LABEL, pe_data.SizeOfImage, FALSE)) { goto error; } //store aes key length and space in include file if(!fasmDefine(container_directory, KEY_SIZE_FILENAME, REAL_KEY_SIZE_LABEL, key_length, FALSE)) { goto error; } if(!fasmDefine(container_directory, KEY_SIZE_FILENAME, REAL_KEY_RANGE_LABEL, key_space, TRUE)) { goto error; } //enable/disable crypter log meachanism if(create_log && !fasmInclude(container_directory, LOGFILE_SELECT_FILENAME, LOG_ENABLE_FILENAME, FALSE)) { goto error; } else if(!create_log && !fasmInclude(container_directory, LOGFILE_SELECT_FILENAME, LOG_DISABLE_FILENAME, FALSE)) { goto error; } //activate aes decryption payload decryptAES(pe32); //get current directory char current_directory[MAX_CHAR_SIZE]; if(!GetCurrentDirectory(MAX_CHAR_SIZE, current_directory)) { fprintf(stderr, "Could not receive current directory\n"); goto error; } //start fasm to generate a packed executable verbose("\n"); verbose(" --------------------------------\n"); verbose("| Stage 3: Generating Executable |\n"); verbose(" --------------------------------\n"); verbose("\n"); char cmd_line[MAX_CHAR_SIZE]; cmd_line[0] = 0; strlcat(cmd_line, FASM_EXECUTABLE_FILENAME, MAX_CHAR_SIZE); strlcat(cmd_line, " ", MAX_CHAR_SIZE); strlcat(cmd_line, (pe32 ? CONTAINER32_DIR : CONTAINER64_DIR), MAX_CHAR_SIZE); strlcat(cmd_line, CONTAINER_MAIN_FILENAME, MAX_CHAR_SIZE); strlcat(cmd_line, " ", MAX_CHAR_SIZE); strlcat(cmd_line, output_name, MAX_CHAR_SIZE); //init necessary structs for createprocess PROCESS_INFORMATION process_info; STARTUPINFO startup_info; ZeroMemory( &startup_info, sizeof(startup_info) ); startup_info.cb = sizeof(startup_info); //redirect stdin to somewhere else if(!display_verbose) { HANDLE g_hChildStd_OUT_Rd = NULL; HANDLE g_hChildStd_OUT_Wr = NULL; SECURITY_ATTRIBUTES saAttr; saAttr.nLength = sizeof(SECURITY_ATTRIBUTES); saAttr.bInheritHandle = TRUE; saAttr.lpSecurityDescriptor = NULL; BOOL cp_ret = CreatePipe(&g_hChildStd_OUT_Rd, &g_hChildStd_OUT_Wr, &saAttr, 0); BOOL shi_ret = SetHandleInformation(g_hChildStd_OUT_Rd, HANDLE_FLAG_INHERIT, 0); if ( !cp_ret || !shi_ret ) { fprintf(stderr, "Warning: Couldn't create pipe for FASM output\n"); } else{ startup_info.hStdError = g_hChildStd_OUT_Wr; startup_info.hStdOutput = g_hChildStd_OUT_Wr; startup_info.dwFlags |= STARTF_USESTDHANDLES; } } verbose("Starting FASM with the following parameters:\n"); verbose("Commandline: %s\n", cmd_line); verbose("FASM Working Directory: %s\n", current_directory); if(!CreateProcess(FASM_EXECUTABLE_FILENAME, cmd_line, 0, 0, FALSE, 0, 0, current_directory, &startup_info, &process_info)) { fprintf(stderr, "Could not start fasm.exe\n"); fprintf(stderr, "Error Code: 0x%x\n", GetLastError()); goto error; } //wait for process to terminate WaitForSingleObject( process_info.hProcess, INFINITE ); // Get the exit code DWORD exitCode = 0; GetExitCodeProcess(process_info.hProcess, &exitCode); if(exitCode!=0 && !display_verbose){ fprintf(stderr, "FASM returned an error, see --verbose for details\n"); } else if(exitCode==0 && display_verbose){ printf("\nDone :-)\n"); } // Close the handles. CloseHandle( process_info.hProcess ); CloseHandle( process_info.hThread ); free(open_file.file); return EXIT_SUCCESS; error: free(open_file.file); return EXIT_FAILURE; } Hyperion-2.0/Src/Crypter/fasmoutput.c0000644000175000017500000001420013476706334017254 0ustar sophiesophie#include "hyperion.h" #include #include #include #include /** * Calculates the checksum of input_file, encrypts checksum+input_file, * converts checksum+input_file to a FASM byte array and writes it to filename. * Furthermore, a FASM include is generated which contains the previously * calculated file size. */ BOOL fasmEncryptOutput(const char* output_dir, struct OpenFile* input_file, unsigned int key_length, unsigned int key_space){ //calculate size the size of encrypted input file and create a FASM include unsigned int encrypted_size = input_file->size + CHECKSUM_SIZE; encrypted_size+=AES_BLOCK_SIZE - (encrypted_size%AES_BLOCK_SIZE); verbose("Input file size + Checksum: 0x%x\n", input_file->size + CHECKSUM_SIZE); verbose("Rounded up to a multiple of key size: 0x%x\n", encrypted_size); if(!fasmDefine(output_dir, INFILE_SIZE_FILENAME, INFILE_SIZE_LABEL, encrypted_size, FALSE)) { return FALSE; } //allocate memory for checksum+input_file uint8_t* encrypted_input = calloc(encrypted_size, sizeof(uint8_t)); if(!encrypted_input) { fprintf(stderr, "Could not allocate memory for encrypted input file\n"); return FALSE; } memcpy(&(encrypted_input[CHECKSUM_SIZE]), input_file->file, input_file->size); uint32_t checksum = getChecksum(input_file->file, input_file->size); verbose("Generated checksum: 0x%x\n", checksum); *((uint32_t*) encrypted_input) = checksum; //encrypt checksum+input_file if(!encryptFile(encrypted_input, encrypted_size, key_length, key_space)) { return FALSE; } /* * fasm byte array which contains the encrypted file. Size is calculated: * 3 for initial "db ", 61 per 10 encrypted bytes, 2 additional lines * just to be save ;) */ unsigned int fasm_output_size = 3 + (encrypted_size/10)*63 + 2*63; char* fasm_output = calloc(fasm_output_size, sizeof(char)); if(!fasm_output) { fprintf(stderr, "Could not allocate memory for encrypted fasm array\n"); free(encrypted_input); return FALSE; } strlcat(fasm_output, "db ", fasm_output_size); unsigned int fasm_output_pointer = strlen(fasm_output); for(unsigned int i=0; i equ " and stores the result * in an output file */ BOOL fasmDefine(const char* output_dir, const char* file_name, const char* label, uint64_t value, BOOL append){ //create output char output_buffer[MAX_CHAR_SIZE]; output_buffer[0] = 0; strlcat(output_buffer, label, MAX_CHAR_SIZE); strlcat(output_buffer, " equ 0x", MAX_CHAR_SIZE); char hex_value[MAX_CHAR_SIZE]; hex_value[0] = 0; snprintf(hex_value, MAX_CHAR_SIZE, "%I64x", value); strlcat(output_buffer, hex_value, MAX_CHAR_SIZE); strlcat(output_buffer, "\r\n", MAX_CHAR_SIZE); //write output to file char full_output_name[MAX_CHAR_SIZE]; full_output_name[0] = 0; strlcat(full_output_name, output_dir, MAX_CHAR_SIZE); strlcat(full_output_name, file_name, MAX_CHAR_SIZE); if(!memToFile(full_output_name, output_buffer, strlen(output_buffer), append)) { fprintf(stderr, "Could not write include file %s\n", full_output_name, append); return FALSE; } else{ verbose("%s written to %s\n", output_buffer, full_output_name); return TRUE; } } /** * Declares a FASM include "include