bad-char-avoid.py

#!/usr/bin/python

###############################################################################
# A script to help find combinations of hex values that subtract or add to a
# given number to aid in the development of custom encoded shellcode.
#
# It's pretty quick and dirty and there are probably better ways to do some
# things. This worked, so I'm sticking to it.
#
# By: Conor Richard
# @xenoscr
###############################################################################

import sys
import argparse
import struct
import ctypes
import itertools
import re
from random import randint

def twosComp(number):
	twosComp = (~number) + 1
	return twosComp

def findCombos(number, badChars, numCount):
	numberRange = range(0, 255)
	goodSets = []
	isZero = False

	for x in range(0, 4):
		q, r = divmod(number, 0x100)
			
		q1, r1 = divmod(r, 3)

		goodSubSets = []
		
		if isZero == True:
			if (r == 0):
				r = 0x100
			else:
				r -= 1
				isZero = False

		print('Wroking on byte: {0} with value: {1}'.format(x, hex(r)))

		if (r == 0):
			r = 0x100
			isZero = True

		for seq in itertools.combinations(numberRange, numCount):
			if (sum(seq) == r and len(seq) == numCount):
				badFound = False
				for i in range(0, len(seq)):
					if seq[i] in badChars:
						badFound = True
				if badFound == False:
					goodSubSets.append(seq)
		#print('Total: {0}'.format(sum(goodSubSets[0])))
		if len(goodSubSets) == 0:
			raise SystemExit('Unable to locate a set of numbers that avoids bad characaters and equals the target number.')

		goodSets.append(goodSubSets)
		number = q
	return goodSets

def findFinalCombos(goodSets, numCount):
	numPos = numCount
	finalNums = []

	for x in range(0, len(goodSets)):
		numSet = []
		randomSet = randint(0, len(goodSets[x]))
		for p in range(0, numCount):
			#print('{0} {1} {2}'.format(x, randomSet, p))
			numSet.append(goodSets[x][randomSet][p])
		finalNums.append(numSet)
	return finalNums

def printFinalNums(finalNums, numCount):
	for x in range(0, numCount):
		total = 0
		for y in range(3, -1, -1):
			total += finalNums[y][x]
			if y > 0:
				total *= 0x100
		print(hex(total))

def printFinalNumsRev(finalNums, numCount):
	for x in range(0, numCount):
		total = ''
		for y in range(0, 4, 1):
			total += str(hex(finalNums[y][x])[2:].zfill(2).replace('0x',''))
		print(total)

def main(number, badchars, process, numCount):
	#numConvert = "0000000012345678"

	print('Generating hex values that avoid {0} bad characters.'.format(len(badchars)))

	print('Converting: {0}'.format(hex(number)))

	if process == 'subtract':
		twosCompliment = twosComp(number)
		print('Finding combinations to subtract to Two\'s-Compliment: 0x{0}'.format(str(hex((twosCompliment & 0xFFFFFFFF)))[2:].upper()))
		goodSets = findCombos(twosCompliment, badchars, numCount)
	else:
		print('Finding combinations to add to: 0x{0}'.format(str(hex(number))))
		goodSets = findCombos(number, badchars, numCount)
	
	finalCombos = findFinalCombos(goodSets, numCount)
	print('\r\nHere are the hex values:')
	printFinalNums(finalCombos, numCount)
	print('\r\nNow in opcode format:')
	printFinalNumsRev(finalCombos, numCount)

if __name__ == "__main__":
	parser = argparse.ArgumentParser(description = 'Find 3 hex numbers that add/subract to equal the provided hex value')
	parser.add_argument("-n", "--number", type=str, help="The target number in hex")
	parser.add_argument("-b", "--badchars", type=str, help="Bad characters to avoid.")
	parser.add_argument("-p", "--process", type=str, choices=['add', 'subtract'], help='Should the values add or subtract to equal the target number?')
	parser.add_argument("-t", "--totalnums", type=int, help="Total number of values to add or subtract to equal the target number")
	args = parser.parse_args()
	if args.process:
		process = args.process
	else:
		process = 'subtract'

	if args.totalnums:
		numCount = args.totalnums
	else:
		numCount = 3

	if args.number:
		if args.badchars:
			badchars = re.sub('0(x|X)', '', args.badchars)
			badchars = re.sub('[^a-fA-F\d\s:]', '', badchars)
			main(int(args.number, 16), bytearray.fromhex(badchars), process, numCount)
		else:
			empty = bytearray([0x00])
			main(int(args.number, 16), empty, process, numCount)
	else:
		parser.print_help(sys.stderr)