Return to Question

EDIT Nasm code. XORed shellcode.

    bits 64
    section .text
    global start

    start:
            jmp find_address

    decoder:
            pop rdi
            xor rcx, rcx
            add cx, 260
    decode:
            xor byte [rdi], 0xAA
            inc rdi
            loop decode

            jmp short encoded_shellcode

    find_address:
            call decoder


            encoded_shellcode: 0xe2,0x29,0x46,0x82,0xe2,0x29,0x4e,0x5a,0xcf,0xe6,0x21,0x8e,0x8f,0xca,0xaa,0xaa,0xaa,0xe7,0x21,0xce,0x8e,0xb2,0xe7,0x21,0xce,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xd6,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xce,0x8e,0x8a,0x10,0x24,0xe4,0xa4,0x46,0xe6,0x23,0x4b,0x42,0xc2,0xaa,0xaa,0xaa,0x41,0x9e,0xf3,0x55,0x7a,0x10,0x02,0x08,0xe7,0x16,0xe2,0x23,0x6b,0x42,0xfc,0xaa,0xaa,0xaa,0xe2,0x23,0x69,0xe7,0x9b,0x63,0x41,0x94,0xeb,0xf2,0x41,0x82,0xf0,0xe2,0x9b,0x63,0x55,0x79,0x10,0xda,0x67,0x95,0x87,0xe6,0x23,0x53,0x42,0x9d,0xaa,0xaa,0xaa,0xe2,0x9b,0x63,0x55,0x7a,0x42,0x6d,0x55,0x55,0x55,0xdf,0xd9,0xcf,0xd8,0x99,0x98,0x84,0xce,0xc6,0xc6,0x42,0x79,0x55,0x55,0x55,0xfe,0xc2,0xc3,0xd9,0x8a,0xc3,0xd9,0x8a,0xcc,0xdf,0xc4,0x8b,0xaa,0x42,0x17,0x55,0x55,0x55,0x9a,0xd2,0xce,0xcf,0xcb,0xce,0xc8,0xcf,0xcf,0xcc,0xe3,0x23,0x67,0xcd,0xeb,0x21,0xef,0x96,0xcd,0xef,0x21,0x1e,0xaf,0x22,0xaa,0xaa,0xaa,0xef,0xab,0x44,0xcd,0xef,0x21,0xfc,0xb2,0xcd,0xeb,0x21,0xf4,0x8a,0xee,0xab,0x41,0xcd,0x49,0x95,0xeb,0x55,0x60,0xcd,0xe8,0x21,0x9e,0x39,0xee,0xab,0x44,0x9b,0x55,0x9b,0x6a,0x56,0x06,0x2e,0x6a,0xde,0xad,0x6b,0x65,0xa7,0xab,0x6d,0x41,0x5e,0x93,0x7d,0xdf,0x77,0xcd,0xeb,0x21,0xf4,0x8e,0xee,0xab,0x41,0x9b,0x63,0xcc,0xcd,0xe8,0x21,0xa6,0xf9,0xcd,0xeb,0x21,0xf4,0xb6,0xee,0xab,0x41,0xcd,0x21,0xae,0x21,0xee,0xab,0x42,0x69

EDIT:

Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
xordecoder2+0x1009:
00000000`00401009 8037aa          xor     byte ptr [rdi],0AAh ds:00000000`00401018=e7
0:000> t
ds:00000000`00401018=e7
0:000> t

EDIT1:

Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
xordecoder2+0x1009:
00000000`00401009 8037aa          xor     byte ptr [rdi],0AAh ds:00000000`00401018=e7
0:000> t
ds:00000000`00401018=e7
0:000> t

Edit2. Following the advice from Igor below, I edited the EXE to have the .text section writeable. Apparently the .text section is not writeable for a windows EXE. Error changed to this now:

    (1f08.1af0): Unknown exception - code c0000096 (first chance)
    (1f08.1af0): Unknown exception - code c0000096 (!!! second chance !!!)
    *** ERROR: Module load completed but symbols could not be loaded for C:\data_section_xorencoder7.exe
    data_section_xorencoder7+0x1016:
    00000000`00401016 e7ff            out     0FFh,eax

Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. xordecoder2+0x1009: 0000000000401009 8037aa xor byte ptr [rdi],0AAh ds:0000000000401018=e7 0:000> t ds:00000000`00401018=e7 0:000> t

Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
xordecoder2+0x1009:
00000000`00401009 8037aa          xor     byte ptr [rdi],0AAh ds:00000000`00401018=e7
0:000> t
ds:00000000`00401018=e7
0:000> t