Module 3: RC4 Encryption in Evasion

An undocumented Windows API that gives you free RC4 — no custom crypto needed.

1. Why RC4 for Sleep Obfuscation?

Several encryption algorithms could theoretically be used to encrypt an implant's memory during sleep. Ekko specifically uses RC4 (Rivest Cipher 4), and the choice is deliberate for several reasons:

Cryptographic strength is not the primary goal here. Sleep obfuscation only needs the encrypted data to be unrecognizable to signature scanners and memory analysis tools. RC4 with a random 16-byte key more than satisfies this requirement, even though RC4 is considered broken for protocols like TLS.

2. How RC4 Works

RC4 operates in two phases: Key Scheduling Algorithm (KSA) and Pseudo-Random Generation Algorithm (PRGA).

Phase 1: Key Scheduling Algorithm (KSA)

KSA initializes a 256-byte permutation array (S-box) using the key:

C// RC4 Key Scheduling Algorithm (conceptual)
unsigned char S[256];
int j = 0;

// Initialize S-box to identity permutation
for (int i = 0; i < 256; i++)
    S[i] = i;

// Permute S-box using the key
for (int i = 0; i < 256; i++) {
    j = (j + S[i] + key[i % key_length]) % 256;
    // Swap S[i] and S[j]
    unsigned char tmp = S[i];
    S[i] = S[j];
    S[j] = tmp;
}

Phase 2: Pseudo-Random Generation Algorithm (PRGA)

PRGA generates a keystream byte-by-byte and XORs each with a plaintext byte:

C// RC4 PRGA - generates keystream and XORs with data
int i = 0, j = 0;

for (int n = 0; n < data_length; n++) {
    i = (i + 1) % 256;
    j = (j + S[i]) % 256;

    // Swap S[i] and S[j]
    unsigned char tmp = S[i];
    S[i] = S[j];
    S[j] = tmp;

    // Generate keystream byte and XOR with data
    unsigned char K = S[(S[i] + S[j]) % 256];
    data[n] ^= K;  // XOR: encrypt or decrypt
}

3. SystemFunction032 — The Undocumented RC4

SystemFunction032 is an undocumented function exported by advapi32.dll (internally implemented in cryptsp.dll on modern Windows). It provides a complete RC4 encryption/decryption operation in a single function call.

C// SystemFunction032 - undocumented RC4 implementation
// Exported by advapi32.dll
//
// NTSTATUS SystemFunction032(
//     PUSTRING Data,    // Buffer to encrypt/decrypt in place
//     PUSTRING Key      // RC4 key
// );
//
// Returns STATUS_SUCCESS (0) on success

// Ekko resolves it at runtime:
PVOID SysFunc032 = GetProcAddress(
    LoadLibraryA("Advapi32"),
    "SystemFunction032"
);

The function takes two parameters, both pointers to USTRING structures. It performs RC4 encryption in-place — the data buffer is modified directly, with no separate output buffer needed.

4. The USTRING Structure

Both the data and key are passed to SystemFunction032 using a structure called USTRING (sometimes called UNICODE_STRING in some implementations, though it is used here as a generic buffer descriptor):

C// USTRING structure - Ekko's definition from Ekko.h
typedef struct {
    DWORD  Length;           // Current length of data in buffer
    DWORD  MaximumLength;    // Maximum capacity of buffer
    PVOID  Buffer;           // Pointer to the actual data
} USTRING;

Ekko sets up two USTRING structures — one for the image data to encrypt and one for the RC4 key:

C// From Ekko.c - Setting up the encryption parameters

// The RC4 key: 16 bytes of 0x55 (hardcoded in the PoC)
CHAR KeyBuf[16] = { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
                    0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55 };

USTRING Key = { 0 };
USTRING Img = { 0 };

// Key setup
Key.Buffer         = KeyBuf;
Key.Length          = 16;
Key.MaximumLength  = 16;

// Image data setup - the entire process image
ImageBase = GetModuleHandleA( NULL );
ImageSize = ((PIMAGE_NT_HEADERS)(ImageBase +
    ((PIMAGE_DOS_HEADER)ImageBase)->e_lfanew))->
    OptionalHeader.SizeOfImage;

Img.Buffer         = ImageBase;
Img.Length          = ImageSize;
Img.MaximumLength  = ImageSize;

5. How Ekko Passes Arguments to SystemFunction032

Ekko does not call SystemFunction032 directly. Instead, it sets up a CONTEXT structure with the registers configured as if calling the function, then uses NtContinue to "jump" into it. On x64 Windows, the first four integer/pointer arguments are passed in RCX, RDX, R8, R9:

C// Setting up the CONTEXT to call SystemFunction032(&Img, &Key)
// (encrypt the image with the RC4 key)

RopMemEnc.Rsp -= 8;           // Stack alignment (explained in Module 6)
RopMemEnc.Rip  = SysFunc032;  // RIP = SystemFunction032 address
RopMemEnc.Rcx  = &Img;        // Arg 1: pointer to data USTRING
RopMemEnc.Rdx  = &Key;        // Arg 2: pointer to key USTRING

// When NtContinue loads this context:
//   RIP jumps to SystemFunction032
//   RCX = &Img (first argument)
//   RDX = &Key (second argument)
// Result: SystemFunction032 encrypts the image in-place with RC4

The decrypt step is identical — same function, same arguments. Because RC4 is symmetric, calling SystemFunction032 again with the same key on the already-encrypted data produces the original plaintext:

C// Decrypt context - identical to encrypt
RopMemDec.Rsp -= 8;
RopMemDec.Rip  = SysFunc032;  // Same function
RopMemDec.Rcx  = &Img;        // Same data buffer (now encrypted)
RopMemDec.Rdx  = &Key;        // Same key
// Result: encrypted data XOR keystream = original plaintext

6. The Image Region Being Encrypted

Ekko encrypts the entire process image — from the base address to base + SizeOfImage. This covers:

C// Getting the image base and size
ImageBase = GetModuleHandleA( NULL );  // Base of current process

// Parse PE headers to get SizeOfImage
ImageSize = ((PIMAGE_NT_HEADERS)(
    (PBYTE)ImageBase +
    ((PIMAGE_DOS_HEADER)ImageBase)->e_lfanew
))->OptionalHeader.SizeOfImage;

7. RC4 Limitations & Operational Considerations

While RC4 is excellent for sleep masking, there are limitations to be aware of:

8. Standalone SystemFunction032 Example

Here is a complete standalone example demonstrating SystemFunction032 usage outside of Ekko's timer chain:

C#include <windows.h>
#include <stdio.h>

typedef struct {
    DWORD  Length;
    DWORD  MaximumLength;
    PVOID  Buffer;
} USTRING;

typedef NTSTATUS (WINAPI* fnSystemFunction032)(
    PUSTRING Data,
    PUSTRING Key
);

int main() {
    // Resolve SystemFunction032
    fnSystemFunction032 SystemFunction032 =
        (fnSystemFunction032)GetProcAddress(
            LoadLibraryA("advapi32.dll"),
            "SystemFunction032");

    // Sample data to encrypt
    char data[] = "Hello from Ekko course!";
    char key[]  = "MySecretKey12345";  // 16-byte key

    USTRING Data = { sizeof(data)-1, sizeof(data)-1, data };
    USTRING Key  = { sizeof(key)-1,  sizeof(key)-1,  key  };

    printf("Original:  %s\n", data);

    // Encrypt
    SystemFunction032(&Data, &Key);
    printf("Encrypted: ");
    for (int i = 0; i < Data.Length; i++)
        printf("%02x ", (unsigned char)data[i]);
    printf("\n");

    // Decrypt (same call, same key - RC4 symmetry)
    SystemFunction032(&Data, &Key);
    printf("Decrypted: %s\n", data);

    return 0;
}