View source

{{Tree|{{PAGENAME}}}}

Below is the assembler source for the [[ALPHA3]] alphanumeric [[Hacking/Shellcode/Alphanumeric/ALPHA3/x86/ASCII/Mixedcase/Decoder|mixedcase ASCII shellcode decoder]] for x86. This implementation requires that <CODE>[EAX]</CODE> will contain the address of the first instruction of this code (its base address).

<BIG><PRE>
BITS 32

; XOR [ESP], ESI and XOR ESI, [ESP] can be encoded in two ways, one of which is
; alphanumeric. NASM chooses the wrong one, which is why we have these:
%define xor_esp_esi db 0x31, 0x34, 0x64
%define xor_esi_esp db 0x33, 0x34, 0x64

start:
  XOR     [EAX], ESI              ; [ESI] = base address ^ ESI
  XOR     ESI, [EAX]              ; ESI = base address ^ ESI ^ ESI = base address
  PUSH    ESI                     ; [ESP0] = base address 
	POP     ECX                     ; ECX = [ESP0] = base address 

  PUSH    0x66666666
  ; IMUL  ESI, [ESP], 0x69
          db 0x6B, 0x34, 0x64, 0x69

esi_value equ -0x2A ; -Something

decode_loop:
	INC     ESI
	IMUL    EAX, [BYTE ECX + 2*ESI + jnz_marker + 1 - ((esi_value+1)*2)], BYTE 0x30
	XOR     AL,  [BYTE ECX + 2*ESI + jnz_marker + 2 - ((esi_value+1)*2)]
	XOR     [BYTE ECX + ESI + jnz_marker + 1 - (esi_value+1)], AL

jnz_marker:
; Jump back 0x10 bytes => F0, this must be encoded
; Assume byte1 is 0x4? and byte2 is 0x4?
; Working back: the offset is eventually stored by XORing over byte1, so the
; decoded value must be F0 ^ 4? => B?. Before that the value is XORed with
; byte2, so the value before this must be B? ^ 4? => F?. F0 can be created 
; using 0x?5 * 0x30 => 0xF0, so byte1 must be 0x45.
; Working back again, using the knowledge that byte1 must be 0x45: the offset is
; eventually stored by XORing over byte1, so the decoded value must be F0 ^ 45
; => B5. Before that the value is XORed with byte2 to and the result of that
; must be F0. B5 ^ F0 => 0x45, so byte2 must be 0x45 as well.

	db      0x75                    ; JNZ
	db      0x45                    ; high nibble of offset to decode_loop
	db      0x45                    ; low nibble of offset to decode_loop
</PRE></BIG>

Assembled, the code is 32 bytes and looks like this:
:'''<BIG><CODE>1030VYhffffk4diFkDqp02Dqq0D1GuEE</CODE></BIG>'''

{{ALPHA3 footer}}