phra / PEzor

I reported it in this issue TheWover/donut#81 and I made a PR but since PEzor uses the release we will have to wait for the deployment or compile it.

The details are explained in the issue but in PEzor it occurs when sgn is not used and the generated shellcode has a certain size.

For those who don't want to compile their own I implemented a dirty trick:

After the shellcode is generated

PEzor/PEzor.sh

Line 286 in 40829f4

(donut $BLOB -f 3 -o $TMP_DIR/shellcode.cpp.donut "$@" || exit 1) &&

add these lines:

sed -i 's/\\x00;/\\x00";\n/' $TMP_DIR/shellcode.cpp.donut
sed -i ':a;N;$!ba;s/"\n";/";\n/' $TMP_DIR/shellcode.cpp.donut

i think i had the same problem during development but only on specific formats, anyway the builtin output formatter can be replaced with the following line (as used in the else branch):

PEzor/PEzor.sh

Line 309 in 40829f4

    
           od -vtx1 $TMP_DIR/shellcode.bin | sed -e 's/^[0-9]* //' -e '$d' -e 's/^/ /' -e 's/ /\\x/g' | tr -d '\n' >> $TMP_DIR/shellcode.cpp &&

do you mind sending a PR to replace the builtin formatter with the proposed solution?

Hi! yes, it happens with the c format, which is used when the sgn parameter is not used and the output has a certain size. The output is not a binary file so od is not needed to parse it.

I opened the issue in case it happens to someone so they know why and how to fix it quickly.

As the issue comes from donut and the PR is already accepted I wasn't planning to implement the dirty fix in PEzor, but it doesn't take me any effort if you want it. Although I think it's too dirty to be included as an official fix in the project xD.

@jarilaos can you please check if #32 fixes the problem? thanks.

yes, fixed!

i think a similar fix can be implemented for the dotnet case:

PEzor/PEzor.sh

Line 397 in 40829f4

(donut $BLOB -f 7 -o $TMP_DIR/shellcode.cs "$@" || exit 1) &&

For the dotnet case it is not needed because it always works well.

ok, so i will merge #32 as is.

Donut fails in certain conditions