klezVirus / inceptor

Template-Driven AV/EDR Evasion Framework
Other
1.58k stars 260 forks source link

zlib encoder error - Could not load file or assembly Zlib.Portable #34

Open bestrocker221 opened 2 years ago

bestrocker221 commented 2 years ago

Describe the bug zlib module should work

To Reproduce python3 .\chain-validate.py -l cs -e zlib

Expected behavior Working

Output

[*] Validating encoder chain for CSHARP

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'Zlib.Portable, Version=1.11.0.0, Culture=neutral, PublicKeyToken=431cba815f6a8b5b' or one of its dependencies. The system cannot find the file specified.
   at Test.ZlibEncoder.Decode(Byte[] data)
   at Test.Test.Main(String[] args)
[-] Failed to execute test
klezVirus commented 2 years ago

Hi @bestrocker221, thanks for that. Fixed by 159e22622542b915c4b83ca1e2dcf30ac481adc9.

On a side note, consider that the shellcode retrieval module implementaion broke the chain-validate.py utility in the dev branch.

bestrocker221 commented 2 years ago

Hi! Thanks for fixing! I was wondering how is it possible to compress the final executable as much as possible. I see that I cannot chain the zlib encoder after the hex (for example), but can do the opposite. What way do you suggest?

Also, unfortunately, the zlib import works, but there is another issue. When chained with any other encoder, inceptor returns [*] Phase 5: Compiling [-] Error: temp\tmpwb0e49yb.cs(30,16): error CS0103: The name 'Ionic' does not exist in the current context

this happens for example if I do -e zlib -e hex

With -e zlib only it returns the error CS1034: Compiler limit exceeded: Line cannot exceed 16777214 characters as mentioned in the other issue

klezVirus commented 2 years ago

Hi @bestrocker221, zlib operates on bytes, while hex transforms the shellcode into string format, this is why you can't use it in the hex -> zlib order. I'll try to fix the issue on the size asap so you can retry.