NTHASH-FPC/uxor.pas at master · erwan2212/NTHASH-FPC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
unit uXor;

{$mode delphi}

interface

uses
   sysutils,utils,windows;

function xorfilev2(filein,fileout:string;encrypt:boolean=true):boolean;
function xorfile(filein,fileout:string;key:byte=255):boolean;

function xorbytes(buffer:pointer;size:dword;key:byte=255):boolean;


implementation

function xorbytes(buffer:pointer;size:dword;key:byte=255):boolean;
var
  c:dword;
  pIn:^byte;
begin
  result:=false;
  log('**** xorbytes ****');
  log('size:'+inttostr(size));
  //xor buffer here
  pIn:=buffer;
  for c:=0 to size {length(buffer)} -1 do
    begin
    pIn^:=pIn^ xor key;  //too easy, virustotal can id the file...
    inc(pIn);
    end;
  result:=true;
end;

function xorfilev2(filein,fileout:string;encrypt:boolean=true):boolean;
var
  dwread:dword=0;
  dwwrite:dword=0;
  c:dword;
  dwFileSize:dword;
  hfilein,hfileout:thandle;
  bufferIn,bufferOut:pointer;
  pIn,pOut:^byte;
  //
  key:array [0..2] of word=($400,$1000,$4000);
begin
  log('********* xorfilev2 **************');
  hFilein := CreateFile(pchar(filein),GENERIC_READ,0,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if hFilein=thandle(-1) then exit;
  hFileout := CreateFile(pchar(fileout),GENERIC_WRITE,0,nil,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
  if hFileout=thandle(-1) then exit;
  //
  dwFileSize := GetFileSize(hFilein,nil);
  log('dwFileSize:'+inttostr(dwFileSize));
  if dwFileSize = INVALID_FILE_SIZE then exit;
  bufferIn := AllocMem(dwFileSize);bufferOut := AllocMem(dwFileSize);
  while 1=1 do
  begin
  ReadFile(hFilein,bufferIn^,dwFileSize,dwRead,nil);
  if dwread=0 then break;
  //xor buffer here
  pIn:=bufferIn;pOut:=bufferOut;
  for c:=0 to dwread -1 do
    begin
    pOut^ := pIn^ xor (Key[2] shr 8);
    if encrypt
       then Key[2] := Byte(pIn^ + Key[2]) * Key[0] + Key[1]
       else Key[2] := byte(pOut^ + Key[2]) * Key[0] + Key[1];
    inc(pIn);inc(pOut);
    end;
  //
  //result:=WriteFile(hFileout, bufferIn^, dwread, dwwrite, nil);
  result:=WriteFile(hFileout, bufferOut^, dwread, dwwrite, nil);
  end;
  //
  if bufferIn<>nil then freemem(bufferIn);
  if bufferOut<>nil then freemem(bufferOut);
  closehandle(hFilein);
  closehandle(hFileout);
  log('done');
end;

function xorfile(filein,fileout:string;key:byte=255):boolean;
var
  dwread:dword=0;
  dwwrite:dword=0;
  c:dword;
  dwFileSize:dword;
  hfilein,hfileout:thandle;
  buffer:pointer;
  pIn:pbyte;
begin
  result:=false;
  log('********* xorfile **************');
  hFilein := CreateFile(pchar(filein),GENERIC_READ,0,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if hFilein=thandle(-1) then exit;
  hFileout := CreateFile(pchar(fileout),GENERIC_WRITE,0,nil,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
  if hFileout=thandle(-1) then exit;
  //
  dwFileSize := GetFileSize(hFilein,nil);
  log('dwFileSize:'+inttostr(dwFileSize));
  if dwFileSize = INVALID_FILE_SIZE then exit;
  buffer := AllocMem(dwFileSize);
  while 1=1 do
  begin
  ReadFile(hFilein,buffer^,dwFileSize,dwRead,nil);
  if dwread=0 then break;
  //xor buffer here
  xorbytes (buffer,dwread,key);
  {
  pIn:=buffer;
  for c:=0 to dwread -1 do
    begin
    pIn^:=pIn^ xor 255;  //too easy, virustotal can id the file...
    inc(pIn);
    end;
  }
  //
  //result:=WriteFile(hFileout, bufferIn^, dwread, dwwrite, nil);
  result:=WriteFile(hFileout, buffer^, dwread, dwwrite, nil);
  end;
  //
  if buffer<>nil then freemem(buffer);
  closehandle(hFilein);
  closehandle(hFileout);
  result:=true;
  log('done');
end;

end.