1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
| #define _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<windows.h>
#include <stdbool.h>
#include<winnt.h>
HANDLE X1(char* x, unsigned char** pbuf)
{
HANDLE X;
DWORD FileSize;
LPDWORD IFFileSize=0;
LPDWORD IFReadFile=0;
X = CreateFileA(x,
GENERIC_READ,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
DWORD err= GetLastError();
if (X == INVALID_HANDLE_VALUE)
{
printf("未能打开文件%d", err);
exit(0);
}
FileSize = GetFileSize(X, IFFileSize);
if (IFFileSize == -1)
{
printf("未能得到文件尺寸");
exit(0);
}
*pbuf =(unsigned char *)malloc(sizeof(unsigned char)* FileSize);
ZeroMemory(*pbuf, FileSize);
ReadFile(X, *pbuf, FileSize, IFReadFile, NULL);
if (IFReadFile == -1)
{
printf("未能复制文件");
exit(0);
}
}
VOID MAIN1(unsigned char* pbuf) {
printf("这是个64进制文件\n");
Sleep(500);
PIMAGE_DOS_HEADER DOS = (PIMAGE_DOS_HEADER)pbuf;
PIMAGE_NT_HEADERS64 NT = (PIMAGE_NT_HEADERS64)(pbuf + DOS->e_lfanew);
DWORD SizeOfImage = NT->OptionalHeader.SizeOfImage;
LPVOID Alloc;
if (NT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress != 0)
Alloc = VirtualAlloc(NULL, SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
else
Alloc = VirtualAlloc(NT->OptionalHeader.ImageBase, SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
ZeroMemory(Alloc, SizeOfImage);
CopyMemory(Alloc, pbuf, NT->OptionalHeader.SizeOfHeaders);
DWORD SectionNumber = NT->FileHeader.NumberOfSections;
for (DWORD n=0; n < SectionNumber; n++)
{
PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((char*)NT+sizeof(IMAGE_NT_HEADERS64)+ sizeof(IMAGE_SECTION_HEADER)*n);
if (SectionHead->PointerToRawData!=0)
CopyMemory(SectionHead->VirtualAddress + (PCHAR)Alloc, pbuf + SectionHead->PointerToRawData, SectionHead->SizeOfRawData);
else
{
ZeroMemory(SectionHead->VirtualAddress + (PCHAR)Alloc, SectionHead->Misc.VirtualSize);
}
}
if (NT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress != 0)
{
PIMAGE_BASE_RELOCATION ReLoc = (PIMAGE_BASE_RELOCATION)(NT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress + (PCHAR)Alloc);
while (ReLoc->SizeOfBlock != 0)
{
PCHAR ReV = ReLoc->VirtualAddress + (PCHAR)Alloc;
int NumberOfBlock = (ReLoc->SizeOfBlock - 8) / 2;
for (int n = 0; n < NumberOfBlock; n++)
{
PWORD ChangByte = (PWORD)(ReLoc + 1);
char Type = ChangByte[n] >> 12;
if (Type == 10)
{
PDWORD64 Offest = (PDWORD64*)((ChangByte[n] & 0xfff) + ReV);
*Offest = *Offest + (ULONGLONG)Alloc - NT->OptionalHeader.ImageBase;
}
}
ReLoc = (PIMAGE_SECTION_HEADER)((PCHAR)ReLoc + ReLoc->SizeOfBlock);
}
}
PIMAGE_IMPORT_DESCRIPTOR IntImport = (PIMAGE_IMPORT_DESCRIPTOR)(NT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + (PCHAR)Alloc);
while (IntImport->Name!=0)
{
HMODULE DllHandle;
char DllName[50];
strncpy(DllName,IntImport->Name+(PCHAR)Alloc,49);
DllHandle = LoadLibraryA(DllName);
PIMAGE_THUNK_DATA64 INT = IntImport->OriginalFirstThunk + (PCHAR)Alloc;
PIMAGE_THUNK_DATA64 IAT = IntImport->FirstThunk + (PCHAR)Alloc;
while (INT->u1.AddressOfData != 0)
{
if (INT->u1.Ordinal & IMAGE_ORDINAL_FLAG64)
{
IAT->u1.AddressOfData = GetProcAddress(DllHandle, INT->u1.Ordinal);
}
else
{
PIMAGE_IMPORT_BY_NAME Fcn = (PIMAGE_IMPORT_BY_NAME)(INT->u1.AddressOfData + (PCHAR)Alloc);
IAT->u1.AddressOfData = GetProcAddress(DllHandle, Fcn->Name);
int l = 1;
}
INT++;
IAT++;
}
IntImport++;
}
FARPROC EOP = (FARPROC)((LPBYTE)Alloc + NT->OptionalHeader.AddressOfEntryPoint);
EOP();
free(pbuf);
free(Alloc);
return 0;
}
int main(int argc,char* argv[])
{
unsigned char* pbuf=NULL;
X1(argv[1],&pbuf);
PIMAGE_DOS_HEADER DOS = (PIMAGE_DOS_HEADER)pbuf;
if (*(PWORD)pbuf == 0x5A4D)
printf("这是个PE文件\n");
WORD Magic = *(WORD*)(pbuf + (DOS->e_lfanew + 6 * 4));
if (Magic == 0x20b)
MAIN1(pbuf);
}
|
