5

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue persists.here It has been suggested that in the assembly decoder, the .text section is not writeable in windows. How can I make this assembly decoder execute and decode/XOR from the .text section in windows as an exe?

Steps to convert encoder to win 7 64

  1. nasm -fwin64 Workingwin7messageBoxassembly.nasm -o xorencoder.obj
  2. Extract shellcode from obj file
  3. Insert into encoder.nasm
  4. Assemble encoder nasm -fwin64 encoder.nasm -o xorencoder.obj
  5. On Windows use golink to create exe. golink \console xorencoder.obj
  6. run exe and crash.

Tools above have been verified to work to assemble the Workingwin7messageBoxassembly.nasm and create a working exe from golink.

This approach breaks when I include the extracted shellcode from the assembled/linked Workingwin7messageBoxassembly.nasm and try to have the decoder below call and decode the shellcode. The shellcode below in the encoded_shellcode: section is a XORed version of a win 7-64 message box found here. This method has an access violation when trying to XOR the contents of encoded_shellcode:.

    bits 64
    section .text
    global start

    start:
            jmp find_address

    decoder:
            pop rdi
            xor rcx, rcx
            add rax, 260
    decode:
            xor byte [rdi], 0xAA
            inc rdi
            loop decode

            jmp short encoded_shellcode

    find_address:
            call decoder

            encoded_shellcode: db 0xe2,0x29,0x46,0x82,0xe2,0x29,0x4e,0x5a,0xcf,0xe6,0x21,0x8e,0x8f,0xca,0xaa,0xaa,0xaa,0xe7,0x21,0xce,0x8e,0xb2,0xe7,0x21,0xce,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xd6,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xce,0x8e,0x8a,0x10,0x24,0xe4,0xa4,0x46,0xe6,0x23,0x4b,0x42,0xc2,0xaa,0xaa,0xaa,0x41,0x9e,0xf3,0x55,0x7a,0x10,0x02,0x08,0xe7,0x16,0xe2,0x23,0x6b,0x42,0xfc,0xaa,0xaa,0xaa,0xe2,0x23,0x69,0xe7,0x9b,0x63,0x41,0x94,0xeb,0xf2,0x41,0x82,0xf0,0xe2,0x9b,0x63,0x55,0x79,0x10,0xda,0x67,0x95,0x87,0xe6,0x23,0x53,0x42,0x9d,0xaa,0xaa,0xaa,0xe2,0x9b,0x63,0x55,0x7a,0x42,0x6d,0x55,0x55,0x55,0xdf,0xd9,0xcf,0xd8,0x99,0x98,0x84,0xce,0xc6,0xc6,0x42,0x79,0x55,0x55,0x55,0xfe,0xc2,0xc3,0xd9,0x8a,0xc3,0xd9,0x8a,0xcc,0xdf,0xc4,0x8b,0xaa,0x42,0x17,0x55,0x55,0x55,0x9a,0xd2,0xce,0xcf,0xcb,0xce,0xc8,0xcf,0xcf,0xcc,0xe3,0x23,0x67,0xcd,0xeb,0x21,0xef,0x96,0xcd,0xef,0x21,0x1e,0xaf,0x22,0xaa,0xaa,0xaa,0xef,0xab,0x44,0xcd,0xef,0x21,0xfc,0xb2,0xcd,0xeb,0x21,0xf4,0x8a,0xee,0xab,0x41,0xcd,0x49,0x95,0xeb,0x55,0x60,0xcd,0xe8,0x21,0x9e,0x39,0xee,0xab,0x44,0x9b,0x55,0x9b,0x6a,0x56,0x06,0x2e,0x6a,0xde,0xad,0x6b,0x65,0xa7,0xab,0x6d,0x41,0x5e,0x93,0x7d,0xdf,0x77,0xcd,0xeb,0x21,0xf4,0x8e,0xee,0xab,0x41,0x9b,0x63,0xcc,0xcd,0xe8,0x21,0xa6,0xf9,0xcd,0xeb,0x21,0xf4,0xb6,0xee,0xab,0x41,0xcd,0x21,0xae,0x21,0xee,0xab,0x42,0x69

I edited the .text section using LordPE to make the .text section in the exe writeable to allow the decoder to read from the .text section to decode. It still fails. How do I get this assembly decoder to decode?

  • I don't understand why there are two posts about the same question. – conio Sep 6 '17 at 11:24
  • This question is specifically about making the .text section writeable. The other question is pretty broad in general terms. – hexhatchet Sep 6 '17 at 13:18
1

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that.

link /SUBSYSTEM:CONSOLE /ENTRY:start xor.obj /SECTION:.text,RWE

After that if you display memory map in xdbg you'll see the change:

enter image description here

After that, you encoder can modify the code in it

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.