polymorphic-shellcode/dico.json at main · Cebago/polymorphic-shellcode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
    "values": {
        "set0": [
            "xor ${VAL1}, ${VAL1}\n",
            "\npush ${REG}\nxor ${REG}, ${REG} \nmov ${VAL1},${REG} \npop ${REG}\n",
            "\nmov ${VAL1}, 0xFFFFFFFFFFFFFFFF \nsub ${VAL1}, 0xFFFFFFFFFFFFFFFF\n",
            "\nmov ${VAL1}, 0x0000000000000001 \ndec ${VAL1}\n",
            "\npush 0xFF \npop ${VAL1} \nsub ${VAL1}, 0xFF \n"
        ],
        "add": [
            "add ${VAL1}, ${VAL2}\n",
            "\npush ${REG}\nmov ${REG}, ${VAL1}\nadd ${REG}, ${VAL2}\nmov ${VAL1}, ${REG}\npop ${REG}\n",
            "\npush ${REG}\nmov ${REG}, ${VAL2}\nadd ${REG}, ${VAL1}\nmov ${VAL1}, ${REG}\npop ${REG}\n",
            "\npush ${REG}\npush ${VAL1}\npop ${REG}\nadd ${REG}, ${VAL2}\nadd ${VAL1}, ${REG}\npop ${REG}\n"
        ],
        "sub": [
            "sub ${VAL1}, ${VAL2}\n",
            "\npush ${REG}\nmov ${REG}, ${VAL1}\nsub ${REG}, ${VAL2}\nmov ${VAL1}, ${REG}\npop ${REG}\n",
            "\npush ${REG}\nmov ${REG}, ${VAL2}\nsub ${REG}, ${VAL1}\nmov ${VAL1}, ${REG}\npop ${REG}\n",
            "\npush ${REG}\npush ${VAL1}\npop ${REG}\nsub ${REG}, ${VAL2}\nadd ${VAL1}, ${REG}\npop ${REG}\n"

        ],
        "setVal": [
            "mov ${VAL1}, ${VAL2}\n",
            "\npush ${VAL2}\npop ${VAL1}\n",
            "\npush ${REG}\npush ${VAL2}\npop ${REG}\nmov ${VAL1}, ${REG}\npop ${REG}\n",
            "\npush ${REG}\nmov ${REG}, ${VAL2}\nmov ${VAL1}, ${REG}\npop ${REG}\n"
        ],
        "interupt": [
            "\nmov ${REG}, 80\nint ${REG}\n"
        ]

    },
    "searches": {
        "xor ${VAL1}, ${VAL1}": "set0",
        "add ${VAL1}, ${VAL2}": "add",
        "sub ${VAL1}, ${VAL2}": "sub",
        "mov ${VAL1}, ${VAL2}": "setVal",
        "int 80": "interupt"
    }
}