Using hash algorithm to payload slimming

Theoretical basis:

• Assuming you need to eject a messagebox, you need to use at least the following APIs or modules:
• GetProcAddress ()------>14byte
• Loadlibraryexa ()------->14byte
• ExitProcess ()------------->11byte
• User32.dll ()--------------->10byte
• MessageBox ()----------->11byte
• Just a simple MessageBox has 60 logically unrelated bytes involved and must be optimized
• Method: Through the algorithm into a 32-bit hash summary

Algorithm Design:Note: You should useHash Algorithmavoid the occurrence of 0x00 and 0x0a (truncation of input) as much as possible in the generated digestSpecific implementation:

#include"stdafx.h"//pay attention to the length of the code, the middle call function should pay special attention to whether it is complete. View in ODCharBshellcode[] = "\x83\xec\x20\xeb\x0b\x55\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00\xe8\x00\x00\x00\x00\x5b" "\xe8\x31\x00\x00\x00\x50\x68\x87\x32\xd8\xc0\xe8\x92\x00\x00\x00\x56\x8b\xf0\x8d\x43\xf0" "\x6a\x00\x6a\x00\x50\xff\xd6\x50\x68\x6a\x0a\x38\x1e\xe8\x7a\x00\x00\x00\x6a\x00\x6a\x00" "\x6a\x00\x6a\x00\xff\xd0\x8b\xe5\x5d\xc3\x55\x8b\xec\x83\xec\x0c\x64\xa1\x30\x00\x00\x00" "\x8b\x40\x0c\x8b\x40\x0c\x8b\x00\x8b\x00\x3e\x8b\x40\x18\x8b\xe5\x5d\xc3\x55\x8b\xec\x83" "\xec\x04\xc7\x45\xfc\x00\x00\x00\x00\x53\x51\x52\x8b\x75\x08\x33\xc9\x33\xc0\x8a\x04\x0e" "\x84\xc0\x74\x16\x8b\x5d\xfc\xc1\xe3\x19\x8b\x55\xfc\xc1\xea\x07\x0b\xda\x03\xd8\x89\x5d" "\xfc\x41\xeb\xe3\x8b\x5d\x0c\x8b\x55\xfc\x33\xc0\x3b\xda\x75\x05\xb8\x01\x00\x00\x00\x5a" "\x59\x5b\x8b\xe5\x5d\xc2\x08\x00\x55\x8b\xec\x83\xec\x0c\x52\x8b\x55\x0c\x8b\x72\x3c\x8d" "\x34\x32\x8b\x76\x78\x8d\x34\x32\x8b\x7e\x1c\x8d\x3c\x3a\x89\x7d\xfc\x8b\x7e\x20\x8d\x3c" "\x3a\x89\x7d\xf8\x8b\x7e\x24\x8d\x3c\x3a\x89\x7d\xf4\x33\xc9\xeb\x01\x41\x8b\x75\xf8\x8b" "\x34\x8e\x8b\x55\x0c\x8d\x34\x32\xff\x75\x08\x56\xe8\x67\xff\xff\xff\x85\xc0\x74\xe6\x8b" "\x75\xf4\x33\xff\x66\x8b\x3c\x4e\x8b\x55\xfc\x8b\x34\xba\x8b\x55\x0c\x8d\x04\x32\x5a\x8b" "\xe5\x5d\xc2\x08\x00";intMain () {__asm {LEA EAX, bshellcode;        PUSH EAX;    RET; }    return 0;}

//**********************************************//Hash Digest algorithm (fetch summary)//argument is a function name string//return value: hash value//*********************************************intHash_getdigest (Char*strfunname) {unsignedintNdigest =0;  while(*strfunname) {        //move left 25 bit, move right 7 bit, bitwise ORNdigest = ((Ndigest << -) | (Ndigest >>7)); Ndigest= ndigest + *Strfunname; Strfunname++; }    returnndigest;}intHash_loadlibrary = Hash_getdigest ("Loadlibraryexa");//0xc0d83287intHash_messbox = Hash_getdigest ("MessageBoxA");//0x1e380a6a

<textarea style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;" tabindex="0" readonly="">summary)</textarea>

Using hash algorithm to payload slimming