From 28362824682d9ddcba66ba393826448dbd057375 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 1 Aug 2024 11:26:03 -0400 Subject: [PATCH 1/2] Update the block API hashing algorithm The changes allow an IV to be set for the hashing algorithm and reuses the hash of the module name as the IV of the function name. This effetively changes the operation from `hash(mname) + hash(fname)` to `hash(mname + fname)`. Reusing the hash of the module name as the IV instead of adding the result makes the shellcode smaller. --- lib/rex/text/block_api.rb | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/lib/rex/text/block_api.rb b/lib/rex/text/block_api.rb index a1df02e..37b2c06 100644 --- a/lib/rex/text/block_api.rb +++ b/lib/rex/text/block_api.rb @@ -11,22 +11,25 @@ module Text # # @param mod [String] The name of the module containing the target function. # @param fun [String] The name of the function. + # @param iv [Integer] The 32-bit initialization vector (IV) to use for the hash operation # # @return [String] The hash of the mod/fun pair in string format - def self.block_api_hash(mod, func) + def self.block_api_hash(mod, func, iv: 0) unicode_mod = (mod.upcase + "\x00").unpack('C*').pack('v*') - mod_hash = self.ror13_hash(unicode_mod) - fun_hash = self.ror13_hash(func + "\x00") - "0x#{(mod_hash + fun_hash & 0xFFFFFFFF).to_s(16)}" + mod_hash = self.ror13_hash(unicode_mod, iv: iv) + fun_hash = self.ror13_hash(func + "\x00", iv: mod_hash) + "0x#{(fun_hash & 0xFFFFFFFF).to_s(16)}" end # # Calculate the ROR13 hash of a given string + # @param string [String] The string to hash + # @param iv [Integer] The 32-bit initialization vector (IV) to use for the hash operation # # @return [Integer] - def self.ror13_hash(name) - hash = 0 - name.unpack("C*").each {|c| hash = ror(hash, 13); hash += c } + def self.ror13_hash(string, iv: 0) + hash = (iv & 0xFFFFFFFF) + string.unpack("C*").each {|c| hash = ror(hash, 13); hash += c } hash end end From 924df44abb5118712920190d5c43e3a1f0e02483 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Thu, 21 Nov 2024 11:49:48 -0500 Subject: [PATCH 2/2] fix(block-api): updating block-api to not append null byte to module name --- lib/rex/text/block_api.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/text/block_api.rb b/lib/rex/text/block_api.rb index 37b2c06..54710dc 100644 --- a/lib/rex/text/block_api.rb +++ b/lib/rex/text/block_api.rb @@ -15,7 +15,7 @@ module Text # # @return [String] The hash of the mod/fun pair in string format def self.block_api_hash(mod, func, iv: 0) - unicode_mod = (mod.upcase + "\x00").unpack('C*').pack('v*') + unicode_mod = (mod.upcase).unpack('C*').pack('v*') mod_hash = self.ror13_hash(unicode_mod, iv: iv) fun_hash = self.ror13_hash(func + "\x00", iv: mod_hash) "0x#{(fun_hash & 0xFFFFFFFF).to_s(16)}"