Simple Loader (Content Transformations)
This is a Simple DLL Loader with a modular interface to apply encode and mask transforms to a DLL
Project Files
How to use
cpl link loader.spec /path/to/file.dll out.bin %transforms="modules/xor/xor.spec, modules/base64/base64.spec"
Notes
This project demonstrates Crystal Palace's content transforms in a modular way. This project acts on 0 or more modules specified in the %transforms variable. Each module is a spec file with init and apply targets.
loader.spec uses foreach %transforms: call %_ "apply" to run each module's apply target when our DLL capability is on the program stack. This allows each module to transform the DLL in the order they're specified. The apply target is called after init and may use global variables set during init.
The init targets initialize the module. loader.spec runs foreach %transforms: call %_ "init" while the loader is on the program stack. Each module init merges content recovery logic into the loader and uses redirect to layer over loader.c's recover function. loader.c's empty recover function exists as a set place to hook content recovery logic into the program.
redirect "A" "B" updates calls to function A to instead call function B. There's one exception to this. The call to function A within function B is not touched. This allows the next A redirect to take-over the untouched A call in B. This lets us dynamically chain multiple functions together and get back the original payload.
To make some sense of the above, below is a diagram that shows how the xor and base64 modules affect loader.c's call to recover(), the code in our loader, and our DLL content.
This project has a module for each encode and mask option in Crystal Palace. For fun, try running all of them together in ridiculous orders.
Conversation
- CyberChef (The Cyber Swiss Army Knife) by GHCQ is a a web app for encryption, encoding, compression and data analysis. It's a go-to tool for unwrapping layers of content transforms like the ones here.
- Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking (2023) by Robert Bearsby is a survey of various obfuscation and masking techniques used-in-the-wild, how they interact with defense analytics, and the engineering details of adopting them into a Cobalt Strike UDRL.
License
This project is licensed under the BSD License.