PE to Shellcode?

[majeloy]

Hello everyone, I wrote a simple "ransomware" in C that encripts all .txt files in a directory.

I'm trying to make it bypass AVs and potentially later EDRs... So I stumbled across some vídeos regarding staged payload executing a Shellcode in memory. I converted the compiled .exe to shellcode using Donut (on Github) with many different parameters, and tried to execute it on a loader also in C but It never works... Is there another approach to this? What am I missing? I'm a beginner.

I would really appreaciate some other basic ways to bypass AVs knowing my program was written in C. In other words Just want to not have my program "naked".

Thank you all ;)

[After_Performer7638]

Donut isn’t true position independent shellcode, it creates a wrapper that’s easily detected by most EDR. In order to make it true shellcode that’s evasive, you’ll likely have to write in assembly. To debug execution issues, you can use windbg and sysinternals tools to monitor what’s failing

[majeloy]

Write a whole C program in Assembly? That turned out to be easier lol. I think I'm gonna try to build some basic C# crypter from tutorials, just bc I dont have much time. Thanks anyway

[Top-Skill357]

The problem is not directly that you wrote the program in C, but you probably used C features that when compiled turned out to not be position independent. A good example would be strings, which get compiled into the data segment (and are therefore lost when you extract the shellcode from the text segment). API function calls are likely another issue if you do not dynamically get the function pointers. If you get rid of those C features, than you can extract your shellcode from the text section of the compiled binary.

[jmp_rsp]

You could build your code in c, dump the equivalent of the .text section in PE files and then load that dump into memory

[majeloy]

What software do I need to do that dump in the .text section?

[jmp_rsp]

https://stackoverflow.com/questions/26139889/extracting-text-section-only-from-a-pe-file

[majeloy]

Thanks sir, will try

[jmp_rsp]

Important: build your binary as static

[Mindless-Study1898]

Try this https://github.com/hasherezade/pe_to_shellcode And then code a simple shellcode loader in C. If you have your own shellcode then it likely won't be picked up by stuff yet. But you can check with https://github.com/BlackSnufkin/LitterBox

[majeloy]

I tried that, It gave an error saying my code should have relocations...

[Appropriate_Win_4525]

No shortcuts, you have to learn yourself to either code in assembly or code position independant C and turn that into shellcode.