Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request - multiline char/byte array obfuscation #24

Open
S3cur3Th1sSh1t opened this issue Sep 14, 2022 · 4 comments
Open

Feature Request - multiline char/byte array obfuscation #24

S3cur3Th1sSh1t opened this issue Sep 14, 2022 · 4 comments

Comments

@S3cur3Th1sSh1t
Copy link

Hey,

it would be nice to also have support for multiline char or byte array obfuscation. E.g. Shellcode bytes in the source are not obfuscated at the moment.

In addition, the strings "hid_" could be used for signatures at the moment. Using random strings here instead would make the resulting code even less detectable.

Greetings

@loneicewolf
Copy link

Could you give an example of what you specifically mean by multiline char ? Do you mean something like a wide character ?
Can you provide a example of it to make it a bit clear :)

@loneicewolf
Copy link

I know it was awhile ago but just curious @S3cur3Th1sSh1t ; 👍🏻 no rush and I'm still waiting
Have a great night!

@S3cur3Th1sSh1t
Copy link
Author

On the one hand side it's about char arrays such as:

static const char *z_errmsg[10] = {
"need dictionary",     /* Z_NEED_DICT       2  */
"stream end",          /* Z_STREAM_END      1  */
"",                    /* Z_OK              0  */
"file error",          /* Z_ERRNO         (-1) */
"stream error",        /* Z_STREAM_ERROR  (-2) */
"data error",          /* Z_DATA_ERROR    (-3) */
"insufficient memory", /* Z_MEM_ERROR     (-4) */
"buffer error",        /* Z_BUF_ERROR     (-5) */
"incompatible version",/* Z_VERSION_ERROR (-6) */
""};

Also ones with only one entry:

char deflate_copyright[] = " deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly ";

Also strings like this:

z->msg = (char*)"oversubscribed dynamic bit lengths tree";

Greetings

@loneicewolf
Copy link

@S3cur3Th1sSh1t I see I think;
thanks;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants