> For the complete documentation index, see [llms.txt](https://wbglil.gitbook.io/cobalt-strike/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-yuan-li-jie-shao/beacon-nei-cun-hun-xiao.md).

# Beacon动态内存加密

这个其实也没太多可说的，C2配置里有一个选项是Beacon在回连后进入sleep前先将Beacon自身所在内存的区域加密待sleep结束后重新解密内存开始回连

![加密前](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MLrJbgR_coWAC4Ur82k%2F-MLrf21AwMZwNAFhor8W%2Fimage.png?alt=media\&token=0aa044cb-9e10-4386-8d56-3c8d36ec2202)

![加密后](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MLrJbgR_coWAC4Ur82k%2F-MLrfCSU34j1DVi9tIda%2Fimage.png?alt=media\&token=bc052841-12e2-493a-aa8f-dd301ed272a1)

执行加密解密的函数，其中密钥的产生有两种方法当第一种失败时会自动调用第二种方法\
1.使用Win API CryptGenRandom生成随机密钥\
2.使用作者自己编写的一个函数生成随机密钥

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MLrJbgR_coWAC4Ur82k%2F-MLrfm4gJhbcYIk3kfq4%2Fimage.png?alt=media\&token=f7ced46c-6d0f-4951-82b1-6924af0b86b4)