brutforcer_3.cpp

#include <stdio.h>

#include "peconv.h"

BYTE *g_Buffer = NULL;
const size_t g_BufferLen = 0x79;

BYTE g_Buffer2[g_BufferLen] = { 0 };

WORD (*calc_checksum) (BYTE *decoded_buffer, size_t buf_size) = NULL;

bool test_val(BYTE xor_val)
{
    for (size_t i = 0; i < g_BufferLen; i++) {
        BYTE val = g_Buffer[i];
        g_Buffer2[i] = (xor_val ^ val) + 0x22;
    }
    WORD checksum = calc_checksum(g_Buffer2, g_BufferLen);
    if (checksum == 0xfb5e) {
        return true;
    }
    return false;
}

BYTE brutforce()
{
    BYTE xor_val = 0;
    do {
      xor_val++;
    } while (!test_val(xor_val));
    return xor_val;
}
//---

int main(int argc, char *argv[])
{
#ifdef _WIN64
    printf("Compile the loader as 32bit!\n");
    system("pause");
    return 0;
#endif
    char default_path[] = "greek_to_me.exe";
    char *path = default_path;
    if (argc > 2) {
        path = argv[1];
    }
    size_t v_size = 0;

    BYTE* loaded_pe = peconv::load_pe_executable(path, v_size);
    if (!loaded_pe) {
        printf("Loading module failed!\n");
        system("pause");
        return 0;
    }

    g_Buffer = (BYTE*) (0x107C + (ULONGLONG) loaded_pe);

    ULONGLONG func_offset = 0x11e6 + (ULONGLONG) loaded_pe;
    calc_checksum =  ( WORD (*) (BYTE *, size_t ) ) func_offset;

    BYTE found = brutforce();
    printf("Found: %x\n", found);

    // Deploy the payload!
    // read the Entry Point from the headers:
    ULONGLONG ep_va = peconv::get_entry_point_rva(loaded_pe) + (ULONGLONG) loaded_pe;

    //make pointer to the entry function:
    int (*loaded_pe_entry)(void) = (int (*)(void)) ep_va;

    //call the loaded PE's ep:
    printf("Calling the Entry Point of the loaded module:\n");
    int res = loaded_pe_entry();
    printf("Finished: %d\n", res);
    system("pause");
    return 0;
}