In this module, another obfuscation technique is covered which converts shellcode to a Universally Unique IDentifier (UUID) string. UUID is a 36-character alphanumeric string that can be used to identify information.
UUIDFuscation follows the same encode-and-pad approach used in the previous obfuscation modules, where shellcode bytes are converted into UUID strings.
A UUID is a 128-bit value commonly written as 32 hexadecimal characters separated into five groups using the 8-4-4-4-12 layout. For example: 801B18F0-8320-4ADA-BB13-41EA1C886B87.
The image below illustrates the UUID layout.
On Windows, this textual format corresponds to the GUID structure, which is defined using four fields:
Data1 - A 4-byte integer.Data2 - A 2-byte integer.Data3 - A 2-byte integer.Data4 - An 8-byte array.The first three fields are stored in memory using little-endian byte order. When they are written as a UUID string, however, each numeric field is displayed with its most significant hexadecimal digits first. This causes the byte order of Data1, Data2, and Data3 to appear reversed relative to the original byte buffer. Data4 is stored as a byte array and is written without reordering.
Because of this, converting raw shellcode into a UUID string is not a direct byte-for-byte formatting operation. Consider the following 16-byte sequence:
FC 48 83 E4 F0 E8 C0 00 00 00 41 51 41 50 52 51
A direct grouping would produce:
FC4883E4-F0E8-C000-0000-415141505251
However, the correctly formatted UUID is:
E48348FC-E8F0-00C0-0000-415141505251
The conversion occurs as follows: