Notice, as an unrelated side note, that in c++ you can't pass full
arrays to functions as you would in managed languages, you have to pass a
pointer to the first byte of an array to be processed and the return
a pointer to the first byte of the resulting processed array. The
function copies the chunks of high entropy code to a new array and
inserts a pattern of ascending bytes starting by a initial random byte.
Not all bytes can be random because the entropy would not be reduced, so
only the first one is. There rest will follow a pattern and here of
course you can select many different patterns. For this example I
used a simple incremental pattern.
PBYTE restore_original(PBYTE high_ent_payload)
{
constexpr int payload_size = (payload_size_after_entropy_reduction + 1) / 2; // re-calculate the original payload size
BYTE low_entropy_payload_holder[payload_size_after_entropy_reduction] = {0}; // create a new array to hold the bytes to be processed
memcpy_s(low_entropy_payload_holder, sizeof low_entropy_payload_holder, high_ent_payload, payload_size_after_entropy_reduction); // move the array to be processed to the newly created array
// Create an empty array which will contain the restored data
static BYTE restored_payload[payload_size] = {0};
int offset_of_hi_entropy_payload = 0;
int offset_of_original_payload = 0;
// Because high and low entropy chunks are of the same size, then simply copy the high entropy ones to the restored array and skip the low entropy ones
for (size_t i = 0; i < number_of_chunks; i++)
{
for (size_t j = 0; j < chunk_size; j++)
{
restored_payload[offset_of_original_payload] = low_entropy_payload_holder[offset_of_hi_entropy_payload];
offset_of_hi_entropy_payload++;
offset_of_original_payload++;
}
for (size_t k = 0; k < chunk_size; k++)
{
offset_of_hi_entropy_payload++;
}
}
// Copy the remaining bytes
if (remaining_bytes)
{
for (size_t i = 0; i < sizeof remaining_bytes; i++)
{
restored_payload[offset_of_original_payload++] = high_ent_payload[offset_of_hi_entropy_payload++];
}
}
return restored_payload;
}