Windows Python / Custom Encoding

Author Thomas Roccia (fr0gger)
Platform Windows
Language Python
Technique Custom Encoding

Description:

The original message is first encrypted using a custom XOR encryption algorithm. The encrypted message is then encoded using a custom Base64 algorithm. The resulting encoded message is then printed to the screen. This encoded message can then be decrypted and decoded using the same custom algorithms in order to access the original message. This example demonstrates how a malware author could use custom encoding schemes to conceal their payloads.

Code

# Define the original message to be encoded
message = "Hello, world!"

# Encrypt the message using a custom XOR encryption algorithm
encrypted_message = ""
for i in range(len(message)):
  encrypted_message += chr(ord(message[i]) ^ 0x5)

# Encode the encrypted message using a custom Base64 algorithm
encoded_message = ""
base64_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
for i in range(0, len(encrypted_message), 3):
  b1 = ord(encrypted_message[i])
  b2 = ord(encrypted_message[i + 1]) if i + 1 < len(encrypted_message) else 0
  b3 = ord(encrypted_message[i + 2]) if i + 2 < len(encrypted_message) else 0

  c1 = b1 >> 2
  c2 = ((b1 & 0x3) << 4) | (b2 >> 4)
  c3 = ((b2 & 0xf) << 2) | (b3 >> 6)
  c4 = b3 & 0x3f

  encoded_message += base64_chars[c1] + base64_chars[c2] + base64_chars[c3] + base64_chars[c4]

# Print the resulting encoded message
print(encoded_message)
Download Raw
Created

December 13, 2022

Last Revised

April 22, 2024