{"id":114,"date":"2019-12-31T23:54:42","date_gmt":"2019-12-31T15:54:42","guid":{"rendered":"http:\/\/blog.73007300.xyz\/?p=114"},"modified":"2020-04-14T15:32:00","modified_gmt":"2020-04-14T07:32:00","slug":"hash-function-name-in-shellcode","status":"publish","type":"post","link":"https:\/\/blog.73007300.xyz\/?p=114","title":{"rendered":"Hash Function Name In Shellcode"},"content":{"rendered":"\n<p>\u5b66\u4e60\u300a\u52a0\u5bc6\u89e3\u5bc6\u300b\u7684\u65f6\u5019\uff0c\u7b2c\u5341\u56db\u7ae0\uff0c\u627e\u5230\u8fdb\u7a0b\u5757\u7684export table\u5bfc\u51fa\u8868\uff0c\u901a\u8fc7hash\u8fc7\u7684function name \uff0c\u548c\u5bfc\u51fa\u8868\u4e2d\u7684function name\u505ahash\u8fd0\u7b97\uff0c\u7136\u540e\u5bf9\u6bd4\u4e24\u4e2ahash\u503c\uff0c\u6700\u540e\u627e\u5230\u5bf9\u5e94\u7684funtion address\u3002<br> \u7531\u4e8e\u52a0\u5bc6\u89e3\u5bc6\u6ca1\u7ed9\u5982\u4f55hash function name,\u8fd9\u91cc\u901a\u8fc7\u7f51\u4e0a\u6574\u7406\u76f8\u5173\u4ee3\u7801\uff0c\u590d\u73b0\u4e86\u5176\u751f\u6210\u8fc7\u7a0b\uff1a <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#include &lt;stdio.h>  \n#include &lt;windows.h>  \n\/\/ hash function name\nDWORD GetHash(char *fun_name)  \n{  \n    DWORD digest = 0;  \n    while(*fun_name)  \n    {  \n\n        __asm__(\n            \".intel_syntax \\n\\t\"\n            \"mov ebx,%0 \\n\\t\"\n            \"ror ebx, 7 \\n\\t\"\n            \"mov %0,ebx \\n\\t\"\n            : \"=r\" (digest) \n            : \"r\" (digest)\n            : \n        );\n        \/\/ printf(\"ror     ebp, 7 is 0x%p\\n\", digest);\n        digest += *fun_name;  \n        \/\/ printf(\"digest += *fun_name is 0x%p\\n\", digest);\n        fun_name++;  \n    }  \n    return digest;  \n}  \n\n\/\/ print hashed function name \nvoid print_char_data(DWORD hash){\n    char char_hash&#91;8];\n    sprintf(char_hash, \"%.8x\", hash); \/\/ convert DWORD to CHAR\n    printf(\"\\\"\\\\x%c%c\\\\x%c%c\\\\x%c%c\\\\x%c%c\\\"\\n\",char_hash&#91;6],char_hash&#91;7],char_hash&#91;4],char_hash&#91;5],char_hash&#91;2],char_hash&#91;3],char_hash&#91;0],char_hash&#91;1]);\n    \n}\n\nint main(int argc, char *argv&#91;], char *envp&#91;])  \n{  \n\n    \/\/ for(int i=0;i&lt;argc;i++)\n    \/\/ {   \n    \/\/     DWORD hash;          \n    \/\/     hash = GetHash(argv&#91;i+1]);  \n    \/\/     printf(\"The hash of Function is 0x%.8x\\n\", hash);          \n    \/\/ }\n\n    printf(\"char Datas&#91;] =\\n\");\n    for(int i=0;i&lt;argc;i++)\n    {   \n        DWORD hash;          \n        hash = GetHash(argv&#91;i+1]);  \n        \/\/ printf(\"The hash of Function is 0x%.8x\\n\", hash);          \n        print_char_data(hash);\n    }\n\n\n     getchar();  \n    return 0;  \n}  \n<\/code><\/pre>\n\n\n\n<p>\u7f16\u8bd1\uff08MinGW\uff09\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\IEUser\\Desktop\\shellcode > g++.exe .\\hash.cpp -o hash -masm=intel<\/code><\/pre>\n\n\n\n<p>\u4f7f\u7528\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\IEUser\\Desktop\\shellcode > .\\hash.exe LoadLibraryA VirtualAlloc VirtualFree GetTempPathA WinExec Sleep TerminateProcess URLDownloadToFileA\nchar Datas&#91;] =\n\"\\x32\\x74\\x91\\x0c\"\n\"\\x67\\x59\\xde\\x1e\"\n\"\\x05\\xaa\\x44\\x61\"\n\"\\x39\\xe2\\x7d\\x83\"\n\"\\x51\\x2f\\xa2\\x01\"\n\"\\xa0\\x65\\x97\\xcb\"\n\"\\x8f\\xf2\\x18\\x61\"\n\"\\x80\\xd6\\xaf\\x9a\"\nCOMMANDO 12\/30\/2019 11:12:41 PM\nPS C:\\Users\\IEUser\\Desktop\\shellcode ><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1545\" height=\"656\" src=\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2019\/12\/image-15.png\" alt=\"\" class=\"wp-image-118\"\/><\/figure>\n\n\n\n<p>\u53ef\u4ee5\u770b\u5230\u548c \u52a0\u5bc6\u89e3\u5bc6 \u7684 hash data \u5b8c\u5168\u4e00\u81f4\u3002<\/p>\n\n\n\n<iframe loading=\"lazy\" src=\"https:\/\/open.spotify.com\/embed\/track\/2vRDFgdJiILUdDOLL8hLH3\" allowtransparency=\"true\" allow=\"encrypted-media\" width=\"300\" height=\"380\" frameborder=\"0\"><\/iframe>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5b66\u4e60\u300a\u52a0\u5bc6\u89e3\u5bc6\u300b\u7684\u65f6\u5019\uff0c\u7b2c\u5341\u56db\u7ae0\uff0c\u627e\u5230\u8fdb\u7a0b\u5757\u7684export table\u5bfc\u51fa\u8868\uff0c\u901a\u8fc7hash\u8fc7\u7684function name \uff0c\u548c\u5bfc\u51fa\u8868\u4e2d\u7684function name\u505ahash\u8fd0\u7b97\uff0c\u7136\u540e\u5bf9\u6bd4\u4e24\u4e2ahash\u503c\uff0c\u6700\u540e\u627e\u5230\u5bf9\u5e94\u7684funtion address\u3002 \u7531\u4e8e\u52a0\u5bc6\u89e3\u5bc6\u6ca1\u7ed9\u5982\u4f55hash function name,\u8fd9\u91cc\u901a\u8fc7\u7f51\u4e0a\u6574\u7406\u76f8\u5173\u4ee3\u7801\uff0c\u590d\u73b0\u4e86\u5176\u751f\u6210\u8fc7\u7a0b\uff1a \u7f16\u8bd1\uff08MinGW\uff09\uff1a \u4f7f\u7528\uff1a \u53ef\u4ee5\u770b\u5230\u548c \u52a0\u5bc6\u89e3\u5bc6 \u7684 hash data \u5b8c\u5168\u4e00\u81f4\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/114"}],"collection":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=114"}],"version-history":[{"count":9,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/114\/revisions"}],"predecessor-version":[{"id":346,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/114\/revisions\/346"}],"wp:attachment":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}