-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathevasion.c
107 lines (88 loc) · 3.04 KB
/
evasion.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
/**
* evasion.h
* 512-bit block pseudo-rand gen
* Author Kucheruavyu Ilya (kojiba@protonmail.com)
* 06/02/2015 Ukraine Kharkiv
* _ _ _ _
* | | (_|_) |
* | | _____ _ _| |__ __ _
* | |/ / _ \| | | '_ \ / _` |
* | < (_) | | | |_) | (_| |
* |_|\_\___/| |_|_.__/ \__,_|
* _/ |
* |__/
**/
#include "evasion.h"
#include <string.h>
#pragma GCC push_options
#pragma GCC optimize ("O0")
typedef uint8_t byte;
#define forAll(iterator, count) for(iterator = 0; iterator < (count); ++iterator)
// 64 circular shift (rotates)
#define rotateLeft(data, shift) (((data) << shift) | ((data) >> (64 - shift)))
#define sawSwap(array) temp = array[7]; \
array[7] = array[2]; \
array[2] = array[5]; \
array[5] = array[0]; \
array[0] = temp; \
temp = 0
uint64_t substituteEvasion(uint64_t data, const byte *block) {
union bytesTo64 {
uint64_t number;
byte bytes[8];
};
union bytesTo64 wrapper;
wrapper.number = data;
wrapper.bytes[0] = block[wrapper.bytes[0]];
wrapper.bytes[1] = block[wrapper.bytes[1]];
wrapper.bytes[2] = block[wrapper.bytes[2]];
wrapper.bytes[3] = block[wrapper.bytes[3]];
wrapper.bytes[4] = block[wrapper.bytes[4]];
wrapper.bytes[5] = block[wrapper.bytes[5]];
wrapper.bytes[6] = block[wrapper.bytes[6]];
wrapper.bytes[7] = block[wrapper.bytes[7]];
return wrapper.number;
}
void rotateBytesEvasion(byte *data, byte count) {
if(count % evasionBytesCount) {
byte diff = (byte) (evasionBytesCount - count);
byte temp[evasionBytesCount];
memcpy(temp, data, count);
memcpy(data, data + count, diff);
memcpy(data + diff, temp, count);
memset(temp, 0, evasionBytesCount);
}
}
void evasionRand(uint64_t data[8]) {
byte iterator;
uint64_t temp;
forAll(iterator, evasionRoundsCount) {
// amplification
data[0] += evasionAmplificationConstants[0];
data[1] ^= evasionAmplificationConstants[1];
data[2] += evasionAmplificationConstants[2];
data[3] ^= evasionAmplificationConstants[3];
data[4] += evasionAmplificationConstants[4];
data[5] ^= evasionAmplificationConstants[5];
data[6] += evasionAmplificationConstants[6];
data[7] ^= evasionAmplificationConstants[7];
// round
data[1] += data[0];
data[3] += data[2];
data[5] += data[4];
data[7] += data[6];
data[0] = rotateLeft(data[0], 7);
data[2] ^= data[1];
data[4] ^= data[3];
data[6] ^= data[5];
data[7] = rotateLeft(data[0], 13);
// subs
data[1] = substituteEvasion(data[1], evasionSubstitutionBlock);
data[3] = substituteEvasion(data[3], evasionSubstitutionBlock);
data[5] = substituteEvasion(data[5], evasionSubstitutionBlock);
sawSwap(data);
// rotate
rotateBytesEvasion((byte *) data, (byte) (iterator + 1));
}
}
#pragma GCC pop_options