//************************************** odfhex - objdump hex extractor by steve hanna v.01 vividmachines.com shanna@uiuc.edu you are free to modify this code but please attribute me if you change the code. bugfixes & additions are welcome please email me! to compile: g++ odfhex.cpp -o odfhex note: the XOR option works perfectly, but i haven't implemented the full x86 payload decoder yet. so that option is mostly useless. this program extracts the hex values from an "objdump -d <binaryname>". after doing this, it converts the hex into escaped hex for use in a c/c++ program. happy shellcoding! ***************************************/ #include <stdio.h> #include <unistd.h> #include <memory.h> #include <string.h> #include <stdlib.h> #include <math.h> #define HEX_PER_LINE 17 char symbols[37] = "0123456789abcdefghijklmnopqrstuvwxyz"; const int MAX_BASE = 36; int GetIndex(char * pString, char search); int BaseToDec(char* number, int base) { if( base < 2 || base > MAX_BASE) return 0; //Failed int NumLength = strlen(number); int PlaceValue, total = 0; PlaceValue = (int)pow(base,NumLength-1); for(int i=0;i<numlength br="" i=""> { total += GetIndex(symbols,*number)*PlaceValue; number++; PlaceValue /= base; //Next digit's place value (previous/base) } return total; } int GetIndex(char * pString, char search) { int index = 0; while(*pString != '0') { if(*pString==search) break; pString++; index++; } return index; } int main(int argc, char** argv) { FILE* dump = NULL; long length = 0; char* content; int i=0; int count =0; int total=0; int XORvalue=0; bool XORit = false; char HexNumber[3]={'\0'}; printf("\nOdfhex - object dump shellcode extractor - by steve hanna - v.01\n"); if(argc < 2) { printf("%s: <object dump="" file=""> [-x xor offset in decimal] \n",argv[0]); return -1; } dump = fopen(argv[1],"r"); if(!dump) { printf("Error: Couldn't open file.\n"); return -1; } fseek(dump,0,SEEK_END); length = ftell(dump); content = new char[length+1]; memset(content,0,sizeof(content)); printf("Trying to extract the hex of %s which is %d bytes long\n",argv[1],length); if (argc > 3 && !strcmp(argv[2],"-x")) { XORit =true; XORvalue = BaseToDec(argv[3],16); printf("XORing with 0x%02x\n",XORvalue); } fseek(dump,0,SEEK_SET); for(int i=0; i < length; i++) { content[i] = fgetc(dump); } fclose(dump); while(count !=4) { if(content[i] == ':') count++; i++; } count = 0; printf("\""); while(i < length) { if( (content[i-1] == ' ' || content[i-1]=='\t') && (content[i+2] == ' ' ) && (content[i] != ' ') && (content[i+1] != ' ') && ((content[i]>='0' && content[i]<='9') || (content[i]>='a' && content[i]<='f')) && ((content[i+1]>='0' && content[i+1]<='9') || (content[i+1]>='a' && content[i+1]<='f')) ) { if(XORit) { HexNumber[0] = content[i]; HexNumber[1] = content[i+1]; printf("\\x%02x",BaseToDec(HexNumber,16) ^ XORvalue); } else printf("\\x%c%c",content[i],content[i+1]); count++; total++; } if(i+1 == length) { printf("\";\n"); } else if(count == HEX_PER_LINE) { printf("\"\\\n\""); count =0; } i++; } delete[] content; printf("\n%d bytes extracted.\n\n",total); return 0; }