peldr/hash.py at main · vk-candpython/peldr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#=================================#
# [ OWNER ]
#     CREATOR  : Vladislav Khudash
#     AGE      : 17
#     LOCATION : Ukraine
#
# [ PINFO ]
#     DATE     : 18.05.2026
#     PROJECT  : PELDR-HASH
#     PLATFORM : ANY
#=================================#


from sys     import argv
from os.path import basename


def HashStr(s: bytes, k: int, *, _A=b'A'[0], _Z=b'Z'[0]) -> str:
    h = k

    for c in s:
        if _A <= c <= _Z: c |= 0x20
        h = (( (h << 4) - h ) + c) & 0xFFFFFFFF

    return f'0x{h:08X}'


def main():
    try:
        k = int(argv[1]) & 0xFFFFFFFF
    except (IndexError, ValueError):
        print(
            f'Usage: python {basename(__file__)} <int:hash_key>'
            '  <->  '
            'Generate #define Hash-Functions For loader.c'
        )
        return


    print(f'#define KEY_HASH_STR {"":<20} {k}')

    for n in (
        b'EtwEventWrite',
        b'NtAllocateVirtualMemory',
        b'NtFreeVirtualMemory',
        b'NtProtectVirtualMemory',
        b'LdrLoadDll',
        b'LdrGetProcedureAddress',
        b'RtlAddFunctionTable',
        b'NtQueryInformationProcess',
        b'NtSetInformationProcess',
        b'NtSetInformationThread',
        b'NtOpenFile',
        b'NtReadFile',
        b'NtClose',
        b'NtQueryInformationFile',
        b'NtTerminateProcess'
    ): print(f'#define HASH_{n.decode():<28} {HashStr(n, k)}')


if __name__ == '__main__': main()