| skipped 47 lines |
48 | 48 | | return 0; |
49 | 49 | | } |
50 | 50 | | |
| 51 | + | DWORD foaToRVA(LPVOID lpBuffer, DWORD FOA) { |
| 52 | + | PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)lpBuffer; |
| 53 | + | PIMAGE_FILE_HEADER pFile; |
| 54 | + | PIMAGE_SECTION_HEADER pFirstSection; |
| 55 | + | |
| 56 | + | if (*(PWORD)((size_t)pDH + pDH->e_lfanew + 0x18) == IMAGE_NT_OPTIONAL_HDR32_MAGIC) |
| 57 | + | { |
| 58 | + | PIMAGE_NT_HEADERS32 pNtH32 = PIMAGE_NT_HEADERS32((size_t)pDH + pDH->e_lfanew); |
| 59 | + | PIMAGE_OPTIONAL_HEADER32 pOH32 = &pNtH32->OptionalHeader; |
| 60 | + | pFile = (PIMAGE_FILE_HEADER)((DWORD)pNtH32 + 4); |
| 61 | + | pFirstSection = PIMAGE_SECTION_HEADER((DWORD)pOH32 + pFile->SizeOfOptionalHeader); |
| 62 | + | |
| 63 | + | if (FOA < pOH32->SizeOfHeaders || pOH32->FileAlignment == pOH32->SectionAlignment) { |
| 64 | + | return FOA; |
| 65 | + | } |
| 66 | + | } |
| 67 | + | else { |
| 68 | + | PIMAGE_NT_HEADERS64 pNtH64 = PIMAGE_NT_HEADERS64((size_t)pDH + pDH->e_lfanew); |
| 69 | + | PIMAGE_OPTIONAL_HEADER64 pOH64 = &pNtH64->OptionalHeader; |
| 70 | + | pFile = (PIMAGE_FILE_HEADER)((DWORD)pNtH64 + 4); |
| 71 | + | pFirstSection = PIMAGE_SECTION_HEADER((DWORD)pOH64 + pFile->SizeOfOptionalHeader); |
| 72 | + | |
| 73 | + | if (FOA < pOH64->SizeOfHeaders || pOH64->FileAlignment == pOH64->SectionAlignment) { |
| 74 | + | return FOA; |
| 75 | + | } |
| 76 | + | } |
| 77 | + | |
| 78 | + | PIMAGE_SECTION_HEADER pSectionHeader = pFirstSection; |
| 79 | + | |
| 80 | + | for (int i = 0; pFile->NumberOfSections; i++) { |
| 81 | + | if (FOA >= pSectionHeader->PointerToRawData && |
| 82 | + | FOA < pSectionHeader->PointerToRawData + pSectionHeader->SizeOfRawData) { |
| 83 | + | /*获取FOA和节区文件地址的偏移*/ |
| 84 | + | DWORD relSectionFileAdd = FOA - pSectionHeader->PointerToRawData; |
| 85 | + | /*偏移加节区的VA得到RVA*/ |
| 86 | + | return relSectionFileAdd + pSectionHeader->VirtualAddress; |
| 87 | + | } |
| 88 | + | /*指向下一个节表*/ |
| 89 | + | pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pSectionHeader + IMAGE_SIZEOF_SECTION_HEADER); |
| 90 | + | } |
| 91 | + | |
| 92 | + | return 0; |
| 93 | + | } |
| 94 | + | |
51 | 95 | | bool containsIgnoreCase(const std::string& str1, const std::string& str2) { |
52 | 96 | | std::string str1Lower = str1; |
53 | 97 | | std::string str2Lower = str2; |
| skipped 6 lines |
60 | 104 | | return str1Lower.find(str2Lower) != std::string::npos; |
61 | 105 | | } |
62 | 106 | | |
63 | | - | BYTE* readRDataSection(BYTE* buffer, PDWORD rdataLength) { |
| 107 | + | BYTE* readSectionData(BYTE* buffer, PDWORD rdataLength, char* secName) { |
64 | 108 | | PIMAGE_DOS_HEADER dosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(buffer); |
65 | 109 | | if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) { |
66 | 110 | | std::cerr << "Invalid DOS header." << std::endl; |
| skipped 8 lines |
75 | 119 | | |
76 | 120 | | PIMAGE_SECTION_HEADER sectionHeader = IMAGE_FIRST_SECTION(ntHeaders); |
77 | 121 | | for (int i = 0; i < ntHeaders->FileHeader.NumberOfSections; ++i) { |
78 | | - | if (strcmp(".rdata", (char*)sectionHeader[i].Name) == 0) { |
| 122 | + | if (strcmp(secName, (char*)sectionHeader[i].Name) == 0) { |
79 | 123 | | *rdataLength = sectionHeader[i].SizeOfRawData; |
80 | 124 | | return reinterpret_cast<BYTE*>(buffer) + sectionHeader[i].PointerToRawData; |
81 | 125 | | } |
| skipped 25 lines |
107 | 151 | | |
108 | 152 | | void searchDll(BYTE* buffer, PResultInfo result, LPCWSTR filePath, char* dllsName, string fileDir) { |
109 | 153 | | DWORD rdataLength; |
110 | | - | BYTE* rdata = readRDataSection(buffer, &rdataLength); |
| 154 | + | BYTE* rdata = readSectionData(buffer, &rdataLength, ".rdata"); |
111 | 155 | | if (rdata != 0) { |
112 | 156 | | char fileFullPath[0x255] = { 0 }; |
113 | 157 | | strcat(fileFullPath, fileDir.c_str()); |
| skipped 57 lines |
171 | 215 | | return true; // 创建文件成功,目录有写权限 |
172 | 216 | | } |
173 | 217 | | |
174 | | - | void printImportTableInfo(BYTE* buffer, PResultInfo result, LPCWSTR filePath) |
| 218 | + | bool printImportTableInfo(BYTE* buffer, PResultInfo result, LPCWSTR filePath) |
175 | 219 | | { |
176 | 220 | | const char* known_dlls[] = {"kernel32", "wow64cpu", "wowarmhw", "xtajit", "advapi32", "clbcatq", "combase", "COMDLG32", "coml2", "difxapi", "gdi32", "gdiplus", "IMAGEHLP", "IMM32", "MSCTF", "MSVCRT", "NORMALIZ", "NSI", "ole32", "OLEAUT32", "PSAPI", "rpcrt4", "sechost", "Setupapi", "SHCORE", "SHELL32", "SHLWAPI", "user32", "WLDAP32", "wow64cpu", "wow64", "wow64base", "wow64con", "wow64win", "WS2_32", "xtajit64"}; |
177 | 221 | | string fileDir = GetDirectoryFromPath(ConvertWideToMultiByte(filePath)) + "\\"; |
| skipped 55 lines |
233 | 277 | | searchDll(buffer, result, filePath, dllsName, fileDir); |
234 | 278 | | break; |
235 | 279 | | } |
| 280 | + | else if (containsIgnoreCase(temp->Name, "CreateDialogParam") != NULL || containsIgnoreCase(temp->Name, "CreateWindow") != NULL || containsIgnoreCase(temp->Name, "CreateProcess") != NULL) |
| 281 | + | { |
| 282 | + | result->isCreateWindow = true; |
| 283 | + | break; |
| 284 | + | } |
236 | 285 | | } |
237 | 286 | | INT = PIMAGE_THUNK_DATA((PBYTE)INT + THUNK_DATA_SIZE);//INT在INT数组中下移 |
238 | 287 | | count++; |
| skipped 10 lines |
249 | 298 | | } |
250 | 299 | | |
251 | 300 | | free(dllsName); |
| 301 | + | |
| 302 | + | return true; |
252 | 303 | | } |
253 | 304 | | |
254 | 305 | | BOOL VerifyFileSignature(LPCWSTR filePath) { |
| skipped 56 lines |
311 | 362 | | ResultInfo* result = new ResultInfo; |
312 | 363 | | result->filePath = wstring2string(filePath); |
313 | 364 | | |
314 | | - | printImportTableInfo(pbFile, result, filePath); |
| 365 | + | bool ret = printImportTableInfo(pbFile, result, filePath); |
315 | 366 | | |
316 | | - | if (result->preLoadDlls.size() > 0 || result->postLoadDlls.size() > 0) { |
| 367 | + | if (ret && result->preLoadDlls.size() > 0 || result->postLoadDlls.size() > 0) { |
317 | 368 | | { |
318 | 369 | | std::lock_guard<std::mutex> lock(mtx); |
319 | 370 | | results.push_back(result); |
| skipped 44 lines |
364 | 415 | | outFile.close(); |
365 | 416 | | } |
366 | 417 | | |
367 | | - | int fixExportTable(string targetFilePath, string sourceFilePath) |
368 | | - | { |
369 | | - | char* targetBuffer; |
370 | | - | DWORD fileSize = readFileContext(targetFilePath, &targetBuffer); |
| 418 | + | void str_to_lower(char* str) { |
| 419 | + | while (*str) { |
| 420 | + | *str = tolower((unsigned char)*str); |
| 421 | + | str++; |
| 422 | + | } |
| 423 | + | } |
| 424 | + | |
| 425 | + | std::vector<std::string> splitStringWithSemicolon(const std::string& str) { |
| 426 | + | std::istringstream iss(str); |
| 427 | + | std::vector<std::string> result; |
| 428 | + | std::string token; |
| 429 | + | |
| 430 | + | while (std::getline(iss, token, ';')) { |
| 431 | + | if (!token.empty()) { |
| 432 | + | result.push_back(token); |
| 433 | + | } |
| 434 | + | } |
| 435 | + | |
| 436 | + | return result; |
| 437 | + | } |
| 438 | + | |
| 439 | + | DWORD getImportFuncAddr(char* buffer, PIMAGE_IMPORT_DESCRIPTOR ImportTable, char* name, int bit, bool isExeFile) { |
| 440 | + | int THUNK_DATA_SIZE = 4; |
| 441 | + | if (bit == 64) |
| 442 | + | THUNK_DATA_SIZE = 8; |
| 443 | + | |
| 444 | + | PIMAGE_THUNK_DATA INT = PIMAGE_THUNK_DATA(rvaToFOA(buffer, ImportTable->OriginalFirstThunk) + buffer); |
| 445 | + | //导入表地址 |
| 446 | + | PIMAGE_THUNK_DATA IAT = PIMAGE_THUNK_DATA(rvaToFOA(buffer, ImportTable->FirstThunk) + buffer); |
| 447 | + | PIMAGE_IMPORT_BY_NAME temp = { 0 }; |
| 448 | + | int count = 0; |
| 449 | + | int index = 0; |
| 450 | + | int hookNameLength = strlen(name); |
| 451 | + | char* str = ""; |
| 452 | + | std::vector<std::string> functionList = splitStringWithSemicolon(name); |
371 | 453 | | |
372 | | - | PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)targetBuffer; |
373 | | - | PIMAGE_NT_HEADERS pNtH = (PIMAGE_NT_HEADERS)((DWORD)pDH + pDH->e_lfanew); |
374 | | - | PIMAGE_OPTIONAL_HEADER pOH = &pNtH->OptionalHeader; |
375 | | - | IMAGE_DATA_DIRECTORY exportDirectory; |
| 454 | + | while (INT->u1.AddressOfData)//当遍历到的是最后一个是时候是会为0,所以随便遍历一个就好 |
| 455 | + | { |
| 456 | + | if (!(INT->u1.Ordinal & 0x80000000)) |
| 457 | + | { |
| 458 | + | temp = (PIMAGE_IMPORT_BY_NAME)(rvaToFOA(buffer, INT->u1.AddressOfData) + buffer); |
| 459 | + | |
| 460 | + | for (const auto& func : functionList) { |
| 461 | + | if (containsIgnoreCase(temp->Name, func) != 0) |
| 462 | + | { |
| 463 | + | return foaToRVA(buffer, (DWORD)IAT - (DWORD)buffer + count * THUNK_DATA_SIZE); |
| 464 | + | } |
| 465 | + | } |
| 466 | + | |
| 467 | + | if (strlen(temp->Name) >= hookNameLength) { |
| 468 | + | index = count; |
| 469 | + | str = temp->Name; |
| 470 | + | } |
| 471 | + | } |
| 472 | + | INT = PIMAGE_THUNK_DATA((PBYTE)INT + THUNK_DATA_SIZE);//INT在INT数组中下移 |
| 473 | + | count++; |
| 474 | + | } |
| 475 | + | |
| 476 | + | if (!isExeFile && index > 0) { |
| 477 | + | memset(str, 0, strlen(str)); |
| 478 | + | strcpy(str, name); |
| 479 | + | return foaToRVA(buffer, (DWORD)IAT - (DWORD)buffer + index * THUNK_DATA_SIZE); |
| 480 | + | } |
| 481 | + | |
| 482 | + | return 0; |
| 483 | + | } |
| 484 | + | |
| 485 | + | void repairReloc(char* buffer, DWORD* dataRva, int count, DWORD isClearEnd) |
| 486 | + | { |
| 487 | + | PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)buffer; |
| 488 | + | PIMAGE_DATA_DIRECTORY pRelocDir; |
376 | 489 | | |
377 | 490 | | if (*(PWORD)((size_t)pDH + pDH->e_lfanew + 0x18) == IMAGE_NT_OPTIONAL_HDR32_MAGIC) |
378 | 491 | | { |
379 | 492 | | PIMAGE_NT_HEADERS32 pNtH32 = PIMAGE_NT_HEADERS32((size_t)pDH + pDH->e_lfanew); |
380 | 493 | | PIMAGE_OPTIONAL_HEADER32 pOH32 = &pNtH32->OptionalHeader; |
381 | 494 | | |
382 | | - | exportDirectory = pOH32->DataDirectory[0]; |
| 495 | + | pRelocDir = &(pOH32->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]); |
383 | 496 | | } |
384 | 497 | | else { |
385 | 498 | | PIMAGE_NT_HEADERS64 pNtH64 = PIMAGE_NT_HEADERS64((size_t)pDH + pDH->e_lfanew); |
386 | 499 | | PIMAGE_OPTIONAL_HEADER64 pOH64 = &pNtH64->OptionalHeader; |
387 | 500 | | |
388 | | - | exportDirectory = pOH64->DataDirectory[0]; |
| 501 | + | pRelocDir = &(pOH64->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]); |
389 | 502 | | } |
390 | 503 | | |
391 | | - | IMAGE_EXPORT_DIRECTORY* exportDir = (IMAGE_EXPORT_DIRECTORY*)(targetBuffer + rvaToFOA(targetBuffer, exportDirectory.VirtualAddress)); |
| 504 | + | int index = 0; |
392 | 505 | | |
393 | | - | DWORD* nameRVAs = (DWORD*)(targetBuffer + rvaToFOA(targetBuffer, exportDir->AddressOfNames)); |
| 506 | + | if (pRelocDir->VirtualAddress != 0 && pRelocDir->Size != 0) { |
| 507 | + | PIMAGE_BASE_RELOCATION pRelocBlock = (PIMAGE_BASE_RELOCATION)(buffer + rvaToFOA(buffer, pRelocDir->VirtualAddress)); |
| 508 | + | while (pRelocBlock->VirtualAddress != 0 && pRelocBlock->SizeOfBlock != 0) { |
| 509 | + | WORD* pRelocEntry = reinterpret_cast<WORD*>(reinterpret_cast<BYTE*>(pRelocBlock) + sizeof(IMAGE_BASE_RELOCATION)); |
394 | 510 | | |
395 | | - | char* sourceBuffer; |
396 | | - | readFileContext(sourceFilePath, &sourceBuffer); |
| 511 | + | DWORD numRelocs = (pRelocBlock->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD); |
| 512 | + | for (DWORD i = 0; i < numRelocs; i++) { |
| 513 | + | WORD relocType = (pRelocEntry[i] & 0xF000) >> 12; |
| 514 | + | WORD relocOffset = pRelocEntry[i] & 0x0FFF; |
397 | 515 | | |
398 | | - | pDH = (PIMAGE_DOS_HEADER)sourceBuffer; |
399 | | - | pNtH = (PIMAGE_NT_HEADERS)((DWORD)pDH + pDH->e_lfanew); |
400 | | - | pOH = &pNtH->OptionalHeader; |
| 516 | + | if (isClearEnd > 0) |
| 517 | + | { |
| 518 | + | if (dataRva[0] <= pRelocBlock->VirtualAddress + relocOffset && pRelocBlock->VirtualAddress + relocOffset <= isClearEnd) |
| 519 | + | pRelocEntry[i] = pRelocEntry[i] & 0xfff; |
| 520 | + | } |
| 521 | + | else |
| 522 | + | { |
| 523 | + | if (pRelocBlock->VirtualAddress + relocOffset >= dataRva[index]) |
| 524 | + | { |
| 525 | + | if (index < count) |
| 526 | + | { |
| 527 | + | pRelocEntry[i] = (dataRva[index] % 0x1000) | 0x3000; |
| 528 | + | index++; |
| 529 | + | } |
| 530 | + | } |
| 531 | + | } |
| 532 | + | } |
| 533 | + | pRelocBlock = reinterpret_cast<PIMAGE_BASE_RELOCATION>((reinterpret_cast<BYTE*>(pRelocBlock)) + pRelocBlock->SizeOfBlock); |
| 534 | + | } |
| 535 | + | } |
| 536 | + | } |
| 537 | + | |
| 538 | + | int fixFile(string targetFilePath, DWORD exitCode) |
| 539 | + | { |
| 540 | + | bool isExeFile = targetFilePath.back() == 'e' ? true : false; |
| 541 | + | |
| 542 | + | char* targetBuffer; |
| 543 | + | DWORD fileSize = readFileContext(targetFilePath, &targetBuffer); |
| 544 | + | |
| 545 | + | PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)targetBuffer; |
| 546 | + | PIMAGE_NT_HEADERS pNtH = (PIMAGE_NT_HEADERS)((DWORD)pDH + pDH->e_lfanew); |
| 547 | + | PIMAGE_OPTIONAL_HEADER pOH = &pNtH->OptionalHeader; |
| 548 | + | IMAGE_DATA_DIRECTORY importDirectory; |
| 549 | + | int bit; |
| 550 | + | DWORD imageBase = 0; |
| 551 | + | DWORD oep = 0; |
401 | 552 | | |
402 | 553 | | if (*(PWORD)((size_t)pDH + pDH->e_lfanew + 0x18) == IMAGE_NT_OPTIONAL_HDR32_MAGIC) |
403 | 554 | | { |
404 | 555 | | PIMAGE_NT_HEADERS32 pNtH32 = PIMAGE_NT_HEADERS32((size_t)pDH + pDH->e_lfanew); |
405 | 556 | | PIMAGE_OPTIONAL_HEADER32 pOH32 = &pNtH32->OptionalHeader; |
406 | 557 | | |
407 | | - | exportDirectory = pOH32->DataDirectory[0]; |
| 558 | + | importDirectory = pOH32->DataDirectory[1]; |
| 559 | + | bit = 32; |
| 560 | + | imageBase = pOH32->ImageBase; |
| 561 | + | oep = pOH32->AddressOfEntryPoint; |
408 | 562 | | } |
409 | 563 | | else { |
410 | 564 | | PIMAGE_NT_HEADERS64 pNtH64 = PIMAGE_NT_HEADERS64((size_t)pDH + pDH->e_lfanew); |
411 | 565 | | PIMAGE_OPTIONAL_HEADER64 pOH64 = &pNtH64->OptionalHeader; |
412 | 566 | | |
413 | | - | exportDirectory = pOH64->DataDirectory[0]; |
| 567 | + | importDirectory = pOH64->DataDirectory[1]; |
| 568 | + | bit = 64; |
| 569 | + | oep = pOH64->AddressOfEntryPoint; |
414 | 570 | | } |
415 | 571 | | |
416 | | - | IMAGE_EXPORT_DIRECTORY* exportDir_source = (IMAGE_EXPORT_DIRECTORY*)(sourceBuffer + rvaToFOA(sourceBuffer, exportDirectory.VirtualAddress)); |
| 572 | + | size_t oep_foa_addr = (size_t)targetBuffer + rvaToFOA(targetBuffer, oep); |
| 573 | + | DWORD clear[1] = { oep }; |
| 574 | + | DWORD improtFunc; |
| 575 | + | DWORD addr; |
| 576 | + | bool isHook = false; |
417 | 577 | | |
418 | | - | DWORD* nameRVAs_source = (DWORD*)(sourceBuffer + rvaToFOA(sourceBuffer, exportDir_source->AddressOfNames)); |
| 578 | + | PIMAGE_IMPORT_DESCRIPTOR ImportTable = PIMAGE_IMPORT_DESCRIPTOR((DWORD)targetBuffer + rvaToFOA(targetBuffer, importDirectory.VirtualAddress)); |
419 | 579 | | |
420 | | - | for (int i = 0; i < exportDir_source->NumberOfNames; i++) |
| 580 | + | while (ImportTable->Name) |
421 | 581 | | { |
422 | | - | DWORD nameRVA_source = nameRVAs_source[i]; |
423 | | - | char* exportFunctionName_source = sourceBuffer + rvaToFOA(sourceBuffer, nameRVA_source); |
| 582 | + | char* pName = rvaToFOA(targetBuffer, ImportTable->Name) + targetBuffer; |
| 583 | + | str_to_lower(pName); |
| 584 | + | |
| 585 | + | if (isExeFile) { |
| 586 | + | if (strstr(pName, "user32.dll") != NULL || strstr(pName, "kernel32.dll") != NULL) { |
| 587 | + | addr = getImportFuncAddr(targetBuffer, ImportTable, "CreateDialogParam;CreateWindow;CreateProcess", bit, isExeFile); |
| 588 | + | if (addr != 0) { |
| 589 | + | DWORD textLength; |
| 590 | + | BYTE* textData = readSectionData((BYTE*)targetBuffer, &textLength, ".text"); |
| 591 | + | for (int i = 0; i < textLength; i++) { |
| 592 | + | if (*(PWORD)((PBYTE)textData + i) == 0x15FF) { |
| 593 | + | DWORD value = *(PDWORD)((PBYTE)textData + i + 2); |
| 594 | + | if (bit == 64) { |
| 595 | + | if (value = addr - foaToRVA(targetBuffer, ((size_t)textData + i + 6))) |
| 596 | + | memset(textData + i, 0x90, 6); |
| 597 | + | } |
| 598 | + | else { |
| 599 | + | if (value == imageBase + addr) |
| 600 | + | memset(textData + i, 0x90, 6); |
| 601 | + | } |
| 602 | + | } |
| 603 | + | } |
| 604 | + | } |
| 605 | + | } |
| 606 | + | } |
| 607 | + | else { |
| 608 | + | if (!isHook && strstr(pName, "kernel32.dll") != NULL) { |
| 609 | + | addr = getImportFuncAddr(targetBuffer, ImportTable, "ExitProcess", bit, isExeFile); |
| 610 | + | if (addr != 0) { |
| 611 | + | repairReloc(targetBuffer, clear, 0, oep + 11); |
| 612 | + | |
| 613 | + | if (bit == 64) { |
| 614 | + | unsigned char hook_data[] = { 0xB9, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x15, 0xC8, 0xEF, 0x00, 0x00 }; |
| 615 | + | improtFunc = addr - (oep + 11); |
| 616 | + | memcpy((char*)oep_foa_addr, hook_data, 11); |
| 617 | + | } |
| 618 | + | else { |
| 619 | + | unsigned char hook_data[] = { 0x68, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x15, 0x08, 0x20, 0x40, 0x00 }; |
| 620 | + | improtFunc = imageBase + addr; |
| 621 | + | memcpy((char*)oep_foa_addr, hook_data, 11); |
| 622 | + | |
| 623 | + | DWORD dataRva[] = { oep + 7 }; |
| 624 | + | repairReloc(targetBuffer, dataRva, 1, 0); |
| 625 | + | } |
| 626 | + | |
| 627 | + | *(PDWORD)(oep_foa_addr + 1) = exitCode; |
| 628 | + | *(PDWORD)(oep_foa_addr + 7) = improtFunc; |
| 629 | + | isHook = true; |
| 630 | + | } |
| 631 | + | } |
| 632 | + | else if (!isHook && strstr(pName, "ntdll.dll") != NULL) { |
| 633 | + | addr = getImportFuncAddr(targetBuffer, ImportTable, "NtTerminateProcess", bit, isExeFile); |
| 634 | + | if (addr != 0) { |
| 635 | + | repairReloc(targetBuffer, clear, 0, oep + 16); |
424 | 636 | | |
425 | | - | DWORD nameRVA = nameRVAs[i]; |
426 | | - | char* exportFunctionName = targetBuffer + rvaToFOA(targetBuffer, nameRVA); |
| 637 | + | if (bit == 64) { |
| 638 | + | unsigned char hook_data[] = { 0xBA, 0x00, 0x00, 0x00, 0x00, 0xB9, 0xff, 0xff, 0xff, 0xff, 0xFF, 0x15, 0xC8, 0xEF, 0x00, 0x00 }; |
| 639 | + | improtFunc = addr - (oep + 16); |
| 640 | + | memcpy((char*)oep_foa_addr, hook_data, 16); |
| 641 | + | } |
| 642 | + | else { |
| 643 | + | unsigned char hook_data[] = { 0x68, 0x00, 0x00, 0x00, 0x00, 0x68, 0xff, 0xff, 0xff, 0xff, 0xFF, 0x15, 0x08, 0x20, 0x40, 0x00 }; |
| 644 | + | improtFunc = imageBase + addr; |
| 645 | + | memcpy((char*)oep_foa_addr, hook_data, 16); |
427 | 646 | | |
428 | | - | memcpy(exportFunctionName, exportFunctionName_source, strlen(exportFunctionName_source)+1); |
| 647 | + | DWORD dataRva[] = { oep + 12 }; |
| 648 | + | repairReloc(targetBuffer, dataRva, 1, 0); |
| 649 | + | } |
| 650 | + | |
| 651 | + | *(PDWORD)(oep_foa_addr + 1) = exitCode; |
| 652 | + | *(PDWORD)(oep_foa_addr + 12) = improtFunc; |
| 653 | + | isHook = true; |
| 654 | + | } |
| 655 | + | } |
| 656 | + | } |
| 657 | + | ImportTable++; |
429 | 658 | | } |
430 | 659 | | |
431 | 660 | | saveFile(targetFilePath, targetBuffer, fileSize); |
432 | 661 | | |
433 | 662 | | delete[] targetBuffer; |
434 | | - | delete[] sourceBuffer; |
435 | 663 | | |
436 | 664 | | return 0; |
437 | 665 | | } |
| skipped 42 lines |
480 | 708 | | return result; |
481 | 709 | | } |
482 | 710 | | |
483 | | - | string CopyFileToFolder(const std::string& sourceFilePath, const std::string& targetFolderPath, bool isNeedHook, bool isPreDll, int bit) { |
| 711 | + | string CopyFileToFolder(const std::string& sourceFilePath, const std::string& targetFolderPath, bool isNeedHook, DWORD exitCode) { |
484 | 712 | | std::string targetFilePath = targetFolderPath + "\\" + sourceFilePath.substr(sourceFilePath.find_last_of("\\/") + 1); |
485 | 713 | | |
486 | | - | if (isNeedHook) { |
487 | | - | std::string hookFilePath = GetCurrentPath() + "\\TestLoad_x86.dll"; |
488 | | - | if (bit == 64) |
489 | | - | hookFilePath = GetCurrentPath() + "\\TestLoad_x64.dll"; |
| 714 | + | CopyFileA(sourceFilePath.c_str(), targetFilePath.c_str(), FALSE); |
490 | 715 | | |
491 | | - | if (isPreDll) { |
492 | | - | CopyFileA(hookFilePath.c_str(), targetFilePath.c_str(), FALSE); |
493 | | - | fixExportTable(targetFilePath, sourceFilePath); |
494 | | - | } |
495 | | - | else { |
496 | | - | CopyFileA(hookFilePath.c_str(), targetFilePath.c_str(), FALSE); |
497 | | - | } |
498 | | - | } |
499 | | - | else { |
500 | | - | CopyFileA(sourceFilePath.c_str(), targetFilePath.c_str(), FALSE); |
501 | | - | } |
| 716 | + | if (isNeedHook) |
| 717 | + | fixFile(targetFilePath, exitCode); |
502 | 718 | | |
503 | 719 | | return targetFilePath; |
504 | 720 | | } |
| skipped 56 lines |
561 | 777 | | nullptr, // 指定新进程的当前目录 |
562 | 778 | | &si, // STARTUPINFO 结构体 |
563 | 779 | | &pi)) { // 接收新进程信息的 PROCESS_INFORMATION 结构体 |
564 | | - | std::cerr << "Failed to create process. Error code: " << GetLastError() << std::endl; |
565 | | - | return 1; |
| 780 | + | return 0; |
566 | 781 | | } |
567 | 782 | | |
568 | 783 | | // 等待进程结束 |
| skipped 5 lines |
574 | 789 | | DWORD exitCode; |
575 | 790 | | GetExitCodeProcess(pi.hProcess, &exitCode); |
576 | 791 | | |
577 | | - | // 输出退出码 |
578 | | - | std::cout << runFilePath << " Process exited with code: " << exitCode << std::endl; |
579 | | - | |
580 | 792 | | // 关闭进程和线程句柄 |
581 | 793 | | CloseHandle(pi.hProcess); |
582 | 794 | | CloseHandle(pi.hThread); |
583 | 795 | | |
584 | | - | return 0; |
| 796 | + | Sleep(500); |
| 797 | + | |
| 798 | + | return exitCode; |
585 | 799 | | } |
586 | 800 | | |
587 | 801 | | void RunPE() { |
588 | 802 | | std::string currentPath = GetCurrentPath(); |
589 | 803 | | |
590 | | - | for (const auto& result : results) { |
| 804 | + | for (auto it = results.begin(); it != results.end();) { |
| 805 | + | PResultInfo result = *it; |
| 806 | + | |
591 | 807 | | string folderPath = CreateRandomFolder(currentPath); |
592 | 808 | | |
593 | | - | string runFilePath = CopyFileToFolder(result->filePath, folderPath, false, false, result->bit); |
| 809 | + | string runFilePath = CopyFileToFolder(result->filePath, folderPath, result->isCreateWindow, NULL); |
594 | 810 | | |
| 811 | + | map<DWORD, std::string> hookDllMap; |
595 | 812 | | bool flag; |
| 813 | + | DWORD exitCode = 0x22222222; |
596 | 814 | | if (result->preLoadDlls.size() > 0) { |
597 | 815 | | flag = result->preLoadDlls.size() <= c.dllCount ? true : false; |
598 | 816 | | |
599 | 817 | | for (const auto& dll : result->preLoadDlls) { |
600 | | - | CopyFileToFolder(result->fileDir + dll, folderPath, flag, true, result->bit); |
| 818 | + | CopyFileToFolder(result->fileDir + dll, folderPath, flag, exitCode); |
| 819 | + | hookDllMap[exitCode] = dll; |
| 820 | + | exitCode++; |
601 | 821 | | } |
602 | 822 | | } |
603 | 823 | | |
| skipped 1 lines |
605 | 825 | | flag = result->postLoadDlls.size() <= c.dllCount ? true : false; |
606 | 826 | | |
607 | 827 | | for (const auto& dll : result->postLoadDlls) { |
608 | | - | CopyFileToFolder(result->fileDir + dll, folderPath, flag, false, result->bit); |
| 828 | + | CopyFileToFolder(result->fileDir + dll, folderPath, flag, exitCode); |
| 829 | + | hookDllMap[exitCode] = dll; |
| 830 | + | exitCode++; |
609 | 831 | | } |
610 | 832 | | } |
611 | 833 | | |
612 | | - | TestCreateProcess(runFilePath); |
| 834 | + | DWORD retExitCode = TestCreateProcess(runFilePath); |
| 835 | + | result->exploitDllPath = hookDllMap[retExitCode]; |
613 | 836 | | |
614 | | - | DeleteDirectory(folderPath.c_str()); |
| 837 | + | //DeleteDirectory(folderPath.c_str()); |
| 838 | + | |
| 839 | + | if (result->exploitDllPath == "") |
| 840 | + | it = results.erase(it); |
| 841 | + | else { |
| 842 | + | ++it; |
| 843 | + | DeleteDirectory(folderPath.c_str()); |
| 844 | + | } |
615 | 845 | | } |
616 | 846 | | } |