encoders

README

Encoders

General purpose data encoders, these are the server-side versions. Due to the build process of implants it's tricky for server/encoders and sliver/encoders to share the same code, however it's imperative these two packages are interoperable, though some encode/decode operations may only be used on one side (e.g., the implant can decode English but not encode to it). This is because certain encoders (like the English encoder) may require external files that we don't want to bundle with the implant.

There are two interfaces, both can encode arbitrary binary data but the outputs differ:

• BinaryEncoder - Encodes binary data and outputs other binary data formats (e.g., encoding data into a PNGs/images)
• ASCIIEncoder - Encode/decode binary data and only outputs valid ASCII (e.g., base64 or english text)

Encoders

Base64

Encodes data using base64 encoding with a custom alphabet so that it's not interoperable with standard Base64 encoding.

Hex

Encodes data to ASCII/hex

English

Encodes arbitrary binary data into English text, this requires a dictionary file when encoding (one is provided in assets/). This is designed to be an inefficient encoder but the amount of inefficiency can be adjusted based off of the length of the words in the dictionary used during the encoding process.

Documentation

Index

• Constants
• Variables
• func B58Decode(b string) []byte
• func B58Encode(b []byte) string
• func GunzipBuf(data []byte) []byte
• func GzipBuf(data []byte) ([]byte, error)
• func GzipBufBestCompression(data []byte) []byte
• func RemoveTrafficEncoder(name string) error
• func SaveTrafficEncoder(name string, wasmBin []byte) error
• func SetEnglishDictionary(dictionary []string)
• func SumWord(word string) int
• func UUID() string
• type Base32
  • func (e Base32) Decode(data []byte) ([]byte, error)
  • func (e Base32) Encode(data []byte) ([]byte, error)
• type Base58
  • func (e Base58) Decode(data []byte) ([]byte, error)
  • func (e Base58) Encode(data []byte) ([]byte, error)
• type Base64
  • func (e Base64) Decode(data []byte) ([]byte, error)
  • func (e Base64) Encode(data []byte) ([]byte, error)
• type Encoder
  • func EncoderFromNonce(nonce uint64) (uint64, Encoder, error)
  • func RandomEncoder() (uint64, Encoder)
• type EncoderFS
• type English
  • func (e English) Decode(words []byte) ([]byte, error)
  • func (e English) Encode(data []byte) ([]byte, error)
• type Gzip
  • func (g Gzip) Decode(data []byte) ([]byte, error)
  • func (g Gzip) Encode(data []byte) ([]byte, error)
• type Hex
  • func (e Hex) Decode(data []byte) ([]byte, error)
  • func (e Hex) Encode(data []byte) ([]byte, error)
• type NoEncoder
  • func (n NoEncoder) Decode(data []byte) ([]byte, error)
  • func (n NoEncoder) Encode(data []byte) ([]byte, error)
• type PNGEncoder
  • func (p PNGEncoder) Decode(data []byte) ([]byte, error)
  • func (p PNGEncoder) Encode(data []byte) ([]byte, error)
• type PassthroughEncoderFS
  • func (p PassthroughEncoderFS) Open(name string) (fs.File, error)
  • func (p PassthroughEncoderFS) ReadDir(_ string) ([]fs.DirEntry, error)
  • func (p PassthroughEncoderFS) ReadFile(name string) ([]byte, error)

Constants

const (

	// EncoderModulus - The modulus used to calculate the encoder ID from a C2 request nonce
	// *** IMPORTANT *** ENCODER IDs MUST BE LESS THAN THE MODULUS
	EncoderModulus = uint64(65537)
	MaxN           = uint64(9999999)

	// These were chosen at random other than the "No Encoder" ID (0)
	Base32EncoderID  = uint64(65)
	Base58EncoderID  = uint64(43)
	Base64EncoderID  = uint64(131)
	EnglishEncoderID = uint64(31)
	GzipEncoderID    = uint64(49)
	HexEncoderID     = uint64(92)
	PNGEncoderID     = uint64(22)
	NoEncoderID      = uint64(0)
)

Variables

var (
	TrafficEncoderFS = PassthroughEncoderFS{}
	PNG              = PNGEncoder{}
	Nop              = NoEncoder{}
)

var EncoderMap = map[uint64]Encoder{
	Base64EncoderID:  Base64{},
	Base58EncoderID:  Base58{},
	Base32EncoderID:  Base32{},
	HexEncoderID:     Hex{},
	EnglishEncoderID: English{},
	GzipEncoderID:    Gzip{},
	PNGEncoderID:     PNG,
}

EncoderMap - A map of all available encoders (native and traffic/wasm)

var FastEncoderMap = map[uint64]Encoder{
	Base64EncoderID: Base64{},
	Base58EncoderID: Base58{},
	Base32EncoderID: Base32{},
	HexEncoderID:    Hex{},
	GzipEncoderID:   Gzip{},
}

FastEncoderMap - Keeps track of fast native encoders that can be used for large messages

var TrafficEncoderMap = map[uint64]*traffic.TrafficEncoder{}

TrafficEncoderMap - Keeps track of the loaded traffic encoders (i.e., wasm-based encoder functions)

Functions

func B58Decode

func B58Decode(b string) []byte

B58Decode decodes a modified base58 string to a byte slice.

func B58Encode

func B58Encode(b []byte) string

B58Encode encodes a byte slice to a modified base58 string.

func GunzipBuf

func GunzipBuf(data []byte) []byte

GunzipBuf - Gunzip a buffer

func GzipBuf

func GzipBuf(data []byte) ([]byte, error)

GzipBuf - Gzip a buffer

func GzipBufBestCompression

func GzipBufBestCompression(data []byte) []byte

GzipBufBestCompression - Gzip a buffer using the best compression setting

func RemoveTrafficEncoder

func RemoveTrafficEncoder(name string) error

RemoveTrafficEncoder - Save a traffic encoder to the filesystem

func SaveTrafficEncoder

func SaveTrafficEncoder(name string, wasmBin []byte) error

SaveTrafficEncoder - Save a traffic encoder to the filesystem

func SetEnglishDictionary

func SetEnglishDictionary(dictionary []string)

func SumWord

func SumWord(word string) int

SumWord - Sum the ASCII values of a word

func UUID

func UUID() string

Types

type Base32

type Base32 struct{}

Base32 Encoder

func (Base32) Decode

func (e Base32) Decode(data []byte) ([]byte, error)

Decode - Base32 Decode

func (Base32) Encode

func (e Base32) Encode(data []byte) ([]byte, error)

Encode - Base32 Encode

type Base58

type Base58 struct{}

Base58 Encoder

func (Base58) Decode

func (e Base58) Decode(data []byte) ([]byte, error)

Decode - Base58 Decode

func (Base58) Encode

func (e Base58) Encode(data []byte) ([]byte, error)

Encode - Base58 Encode

type Base64

type Base64 struct{}

Base64 Encoder

func (Base64) Decode

func (e Base64) Decode(data []byte) ([]byte, error)

Decode - Base64 Decode

func (Base64) Encode

func (e Base64) Encode(data []byte) ([]byte, error)

Encode - Base64 Encode

type Encoder

type Encoder interface {
	Encode([]byte) ([]byte, error)
	Decode([]byte) ([]byte, error)
}

Encoder - Can losslessly encode arbitrary binary data

func EncoderFromNonce

func EncoderFromNonce(nonce uint64) (uint64, Encoder, error)

EncoderFromNonce - Convert a nonce into an encoder

func RandomEncoder

func RandomEncoder() (uint64, Encoder)

RandomEncoder - Get a random nonce identifier and a matching encoder

type EncoderFS

type EncoderFS interface {
	Open(name string) (fs.File, error)
	ReadDir(name string) ([]fs.DirEntry, error)
	ReadFile(name string) ([]byte, error)
}

EncoderFS - Generic interface to read wasm encoders from a filesystem

type English

type English struct{}

English Encoder - An ASCIIEncoder for binary to english text

func (English) Decode

func (e English) Decode(words []byte) ([]byte, error)

Decode - English => Binary

func (English) Encode

func (e English) Encode(data []byte) ([]byte, error)

Encode - Binary => English

type Gzip

type Gzip struct{}

Gzip - Gzip compression encoder

func (Gzip) Decode

func (g Gzip) Decode(data []byte) ([]byte, error)

Decode - Uncompressed data with gzip

func (Gzip) Encode

func (g Gzip) Encode(data []byte) ([]byte, error)

Encode - Compress data with gzip

type Hex

type Hex struct{}

Hex Encoder

func (Hex) Decode

func (e Hex) Decode(data []byte) ([]byte, error)

Decode - Hex Decode

func (Hex) Encode

func (e Hex) Encode(data []byte) ([]byte, error)

Encode - Hex Encode

type NoEncoder

type NoEncoder struct{}

NoEncoder - A NOP encoder

func (NoEncoder) Decode

func (n NoEncoder) Decode(data []byte) ([]byte, error)

Decode - Don't do anything

func (NoEncoder) Encode

func (n NoEncoder) Encode(data []byte) ([]byte, error)

Encode - Don't do anything

type PNGEncoder

type PNGEncoder struct{}

PNGEncoder - PNG image object

func (PNGEncoder) Decode

func (p PNGEncoder) Decode(data []byte) ([]byte, error)

Decode reads a encoded PNG to get the original binary data

func (PNGEncoder) Encode

func (p PNGEncoder) Encode(data []byte) ([]byte, error)

Encode outputs a valid PNG file

type PassthroughEncoderFS

type PassthroughEncoderFS struct {
	// contains filtered or unexported fields
}

PassthroughEncoderFS - Creates an encoder.EncoderFS object from a single local directory

func (PassthroughEncoderFS) Open

func (p PassthroughEncoderFS) Open(name string) (fs.File, error)

func (PassthroughEncoderFS) ReadDir

func (p PassthroughEncoderFS) ReadDir(_ string) ([]fs.DirEntry, error)

func (PassthroughEncoderFS) ReadFile

func (p PassthroughEncoderFS) ReadFile(name string) ([]byte, error)