1

I need the bytes of a BIN file converted to a unsigned int, in this format (JavaScript):

    p.write4(shellcode.add32(0x00000000), 0x00000be9);
    p.write4(shellcode.add32(0x00000004), 0x90909000);
    p.write4(shellcode.add32(0x00000008), 0x90909090);
    p.write4(shellcode.add32(0x0000000c), 0x90909090);
    p.write4(shellcode.add32(0x00000010), 0x0082b955);
    p.write4(shellcode.add32(0x00000014), 0x8948c000);
    p.write4(shellcode.add32(0x00000018), 0x415741e5);
    p.write4(shellcode.add32(0x0000001c), 0x41554156);
    p.write4(shellcode.add32(0x00000020), 0x83485354);
    p.write4(shellcode.add32(0x00000024), 0x320f18ec);
    p.write4(shellcode.add32(0x00000028), 0x89d58949);
    p.write4(shellcode.add32(0x0000002c), 0x64b948c0);
    p.write4(shellcode.add32(0x00000030), 0x77737069);
    p.write4(shellcode.add32(0x00000034), 0x49000000);
    p.write4(shellcode.add32(0x00000038), 0x4120e5c1);
    p.write4(shellcode.add32(0x0000003c), 0x000200bc);
    p.write4(shellcode.add32(0x00000040), 0xc5094900);
    p.write4(shellcode.add32(0x00000044), 0xd0b58d4d);
    p.write4(shellcode.add32(0x00000048), 0x49ffcf14);
    p.write4(shellcode.add32(0x0000004c), 0x8a509d8d);
    p.write4(shellcode.add32(0x00000050), 0x81490003);
    p.write4(shellcode.add32(0x00000054), 0x030b50c5);
    p.write4(shellcode.add32(0x00000058), 0x868d4901);
    p.write4(shellcode.add32(0x0000005c), 0x001d18d0);
    p.write4(shellcode.add32(0x00000060), 0x00c68149);
    p.write4(shellcode.add32(0x00000064), 0x48001d17);
    p.write4(shellcode.add32(0x00000068), 0x48c04589);
    p.write4(shellcode.add32(0x0000006c), 0xad0000a1);
    p.write4(shellcode.add32(0x00000070), 0x000000de);
    p.write4(shellcode.add32(0x00000074), 0x45894800);
    p.write4(shellcode.add32(0x00000078), 0x888948c8);
    p.write4(shellcode.add32(0x0000007c), 0x000000e0);
    p.write4(shellcode.add32(0x00000080), 0xf080c748);
    p.write4(shellcode.add32(0x00000084), 0x00000000);
    p.write4(shellcode.add32(0x00000088), 0x48000000);
    p.write4(shellcode.add32(0x0000008c), 0x00f880c7);
    p.write4(shellcode.add32(0x00000090), 0x00000000);
    p.write4(shellcode.add32(0x00000094), 0x1aeb0000);
    p.write4(shellcode.add32(0x00000098), 0x00841f0f);
    p.write4(shellcode.add32(0x0000009c), 0x00000000);
    p.write4(shellcode.add32(0x000000a0), 0x4cee894c);
    p.write4(shellcode.add32(0x000000a4), 0x8b48ff89);
    p.write4(shellcode.add32(0x000000a8), 0xd0ffc045);
    p.write4(shellcode.add32(0x000000ac), 0x01ec8341);
    p.write4(shellcode.add32(0x000000b0), 0x02ba2774);
    p.write4(shellcode.add32(0x000000b4), 0x4c000000);
    p.write4(shellcode.add32(0x000000b8), 0x80bfee89);
    p.write4(shellcode.add32(0x000000bc), 0x41000001);
    p.write4(shellcode.add32(0x000000c0), 0x8d48d6ff);
    p.write4(shellcode.add32(0x000000c4), 0x00006f3d);
    p.write4(shellcode.add32(0x000000c8), 0xc7894900);
    p.write4(shellcode.add32(0x000000cc), 0x31c68948);
    p.write4(shellcode.add32(0x000000d0), 0x4cd3ffc0);
    p.write4(shellcode.add32(0x000000d4), 0x75c87d39);
    p.write4(shellcode.add32(0x000000d8), 0xe43145c7);
    p.write4(shellcode.add32(0x000000dc), 0xc8758b48);
    p.write4(shellcode.add32(0x000000e0), 0x5f3d8d48);
    p.write4(shellcode.add32(0x000000e4), 0x31000000);
    p.write4(shellcode.add32(0x000000e8), 0x0fd3ffc0);
    p.write4(shellcode.add32(0x000000ec), 0x0000441f);
    p.write4(shellcode.add32(0x000000f0), 0x0000a148);
    p.write4(shellcode.add32(0x000000f4), 0x0000dead);
    p.write4(shellcode.add32(0x000000f8), 0x89440000);
    p.write4(shellcode.add32(0x000000fc), 0x3d8d48e6);
    p.write4(shellcode.add32(0x00000100), 0x0000005c);
    p.write4(shellcode.add32(0x00000104), 0x20148b4a);
    p.write4(shellcode.add32(0x00000108), 0x08c48349);
    p.write4(shellcode.add32(0x0000010c), 0xd3ffc031);
    p.write4(shellcode.add32(0x00000110), 0x80fc8149);
    p.write4(shellcode.add32(0x00000114), 0x75000001);
    p.write4(shellcode.add32(0x00000118), 0x3d8d48d7);
    p.write4(shellcode.add32(0x0000011c), 0x00000060);
    p.write4(shellcode.add32(0x00000120), 0xd3ffc031);
    p.write4(shellcode.add32(0x00000124), 0x18c48348);
    p.write4(shellcode.add32(0x00000128), 0x415bc031);
    p.write4(shellcode.add32(0x0000012c), 0x415d415c);
    p.write4(shellcode.add32(0x00000130), 0x5d5f415e);
    p.write4(shellcode.add32(0x00000134), 0x909090c3);
    p.write4(shellcode.add32(0x00000138), 0x6f6c6c41);
    p.write4(shellcode.add32(0x0000013c), 0x30203a63);
    p.write4(shellcode.add32(0x00000140), 0x786c2578);
    p.write4(shellcode.add32(0x00000144), 0x624f000a);
    p.write4(shellcode.add32(0x00000148), 0x7463656a);
    p.write4(shellcode.add32(0x0000014c), 0x6d754420);
    p.write4(shellcode.add32(0x00000150), 0x78302070);
    p.write4(shellcode.add32(0x00000154), 0x0a786c25);
    p.write4(shellcode.add32(0x00000158), 0x00000000);
    p.write4(shellcode.add32(0x0000015c), 0x00000000);
    p.write4(shellcode.add32(0x00000160), 0x6265443c);
    p.write4(shellcode.add32(0x00000164), 0x203e6775);
    p.write4(shellcode.add32(0x00000168), 0x656a624f);
    p.write4(shellcode.add32(0x0000016c), 0x2b207463);
    p.write4(shellcode.add32(0x00000170), 0x25783020);
    p.write4(shellcode.add32(0x00000174), 0x3a783330);
    p.write4(shellcode.add32(0x00000178), 0x25783020);
    p.write4(shellcode.add32(0x0000017c), 0x000a786c);
    p.write4(shellcode.add32(0x00000180), 0x6265443c);
    p.write4(shellcode.add32(0x00000184), 0x203e6775);
    p.write4(shellcode.add32(0x00000188), 0x7473754a);
    p.write4(shellcode.add32(0x0000018c), 0x726f4620);
    p.write4(shellcode.add32(0x00000190), 0x7468203a);
    p.write4(shellcode.add32(0x00000194), 0x3a737074);
    p.write4(shellcode.add32(0x00000198), 0x77772f2f);
    p.write4(shellcode.add32(0x0000019c), 0x6f792e77);
    p.write4(shellcode.add32(0x000001a0), 0x62757475);
    p.write4(shellcode.add32(0x000001a4), 0x6f632e65);
    p.write4(shellcode.add32(0x000001a8), 0x61772f6d);
    p.write4(shellcode.add32(0x000001ac), 0x3f686374);
    p.write4(shellcode.add32(0x000001b0), 0x4a563d76);
    p.write4(shellcode.add32(0x000001b4), 0x6d6c5247);
    p.write4(shellcode.add32(0x000001b8), 0x4c6c6133);
    p.write4(shellcode.add32(0x000001bc), 0x00000a59);

I assume the first hex in add32 is the count, and the last hex are the bytes of the file. I've made a small concept for this, but it doesn't work correctly. Note this code is not for production purposes.

#include <stdio.h>

int main(void) {
    FILE *f = fopen("loader", "rb");
    fseek(f, 0, SEEK_END);
    int s = ftell(f);
    rewind(f);

    FILE *o = fopen("loader.txt", "wb");

    int i;
    for(i = 0; i < s / 4; i++) {
        unsigned int u;
        fread(&u, sizeof(u), 1, f);
        fprintf(o, "p.write4(shellcode.add32(0x%08x), 0x%08x);\n", i, u);
    }

    fclose(o);
    fclose(f);

    return 0;
}

That code partially works and outputs the following:

p.write4(shellcode.add32(0x00000000), 0x00067be9);
p.write4(shellcode.add32(0x00000001), 0x0f2e6600);
p.write4(shellcode.add32(0x00000002), 0x0000841f);
p.write4(shellcode.add32(0x00000003), 0x90000000);
p.write4(shellcode.add32(0x00000004), 0x000082b9);
p.write4(shellcode.add32(0x00000005), 0x0f5741c0);
p.write4(shellcode.add32(0x00000006), 0xd1894832);
p.write4(shellcode.add32(0x00000007), 0xc1485641);
p.write4(shellcode.add32(0x00000008), 0x554120e1);
p.write4(shellcode.add32(0x00000009), 0x41c10948);
p.write4(shellcode.add32(0x0000000a), 0x8d485554);
p.write4(shellcode.add32(0x0000000b), 0xcf14d0a9);
p.write4(shellcode.add32(0x0000000c), 0x894953ff);
p.write4(shellcode.add32(0x0000000d), 0xec8348f6);
p.write4(shellcode.add32(0x0000000e), 0x858d4848);
p.write4(shellcode.add32(0x0000000f), 0x00286cf0);
p.write4(shellcode.add32(0x00000010), 0x50998d48);
p.write4(shellcode.add32(0x00000011), 0x4800038a);
p.write4(shellcode.add32(0x00000012), 0x20244489);
p.write4(shellcode.add32(0x00000013), 0xd0a18d4c);
p.write4(shellcode.add32(0x00000014), 0x310005a9);
p.write4(shellcode.add32(0x00000015), 0x28bf48c0);
p.write4(shellcode.add32(0x00000016), 0x0926204b);
p.write4(shellcode.add32(0x00000017), 0x4c000000);
p.write4(shellcode.add32(0x00000018), 0x71b8ad8b);
p.write4(shellcode.add32(0x00000019), 0xd3ff01fe);
p.write4(shellcode.add32(0x0000001a), 0x8948c031);
p.write4(shellcode.add32(0x0000001b), 0x50bf48ee);
p.write4(shellcode.add32(0x0000001c), 0x0926204b);
p.write4(shellcode.add32(0x0000001d), 0xff000000);
p.write4(shellcode.add32(0x0000001e), 0x468b49d3);

The problem of this code is, it doesn't display the first hex (the add32 one) correctly like the first code example. How do I make it so it is exactly like the first code example?

Any help is absolutely appreciated!

8
  • You need (i * 4) since it's the file offset and that's sizeof int32.
    – Dave S
    Jan 20, 2018 at 22:49
  • What does this have to do with JavaScript?
    – Herohtar
    Jan 20, 2018 at 22:54
  • @DaveS So if I understand you correctly I should do for(i = 0; i * 4; i++) {?
    – J. Doe
    Jan 20, 2018 at 22:55
  • @Herohtar The output is javascript.
    – J. Doe
    Jan 20, 2018 at 22:55
  • @J.Doe no do the i*4 in the printf, not in the loop
    – Pablo
    Jan 20, 2018 at 23:08

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.