PoC code to bypass flare/floss by mandiant

main.c

/*
main.c - Demonstrate how easy it is to bypass flare-floss with a single line

Compile with:
 
x86_64-w64-mingw32-gcc main.c -o main.exe -masm=intel
*/

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <immintrin.h>

#ifndef ARRAYSIZE
#define ARRAYSIZE(a) (sizeof(a) / sizeof(*(a)))
#endif

void uncrackable_xor(char *input, size_t size, char *output, char key) {
  // That's it ;)  
  asm volatile(
        "RDSEED  rax"
    );

    // Actual XOR algo
    for (int i = 0; i < size; i++) {
        output[i] = input[i] ^ key;  // XOR each character with the key
    }
    output[strlen(input)] = '\0'; // Null-terminate the output string
  
}

void crackable_xor(char *input, size_t size, char *output, char key) {
    // Actual XOR algo
    for (int i = 0; i < size; i++) {
        output[i] = input[i] ^ key;  // XOR each character with the key
    }
    output[strlen( input)] = '\0'; // Null-terminate the output string

}

int main() {
    char crackable_msg[] = {0xE2, 0xCF, 0xC6, 0xC6, 0xC5, 0x86, 0x8A, 0xFD  , 0xC5, 0xD8, 0xC6, 0xCE, 0x8B};
    char uncrackable_msg[] = {0xF3, 0xC5, 0xDF, 0x8A, 0xC9, 0xCB, 0xC4, 0xDE, 0x8A, 0xD9, 0xCF, 0xCF, 0x8A, 0xC7, 0xCF, 0x8B};

    char decrypted[100] = {0};
    char key = 0xAA; // XOR key, can be any byte value

    printf("Crackable Encrypted message: ");
    for (int i = 0; i < ARRAYSIZE(crackable_msg); i++) {
        printf("\\x%02X", (unsigned char)crackable_msg[i]);  // Print in hex
    }
    printf("\n");

    // Decrypt the message using the crackable XOR - floss will recover this
    crackable_xor(crackable_msg, ARRAYSIZE(crackable_msg),decrypted, key);
    printf("Decrypted message: %s\n", decrypted);

    // Reset memory 
    memset(decrypted, 0, 100);

    printf("Uncrackable Encrypted message: ");
    for (int i = 0; i < ARRAYSIZE(uncrackable_msg); i++) {
        printf("\\x%02X", (unsigned char)uncrackable_msg[i]);  // Print in hex
    }
    printf("\n");
    
    // Decrypt the message using the crackable XOR - floss will recover this
    uncrackable_xor(uncrackable_msg, ARRAYSIZE(uncrackable_msg),decrypted, key);
    printf("Decrypted message: %s\n", decrypted);



    return 0;
}