main.cpp

#include "pefile.h"
#include "RC4.h"

DWORD searchNreplace(BYTE *haystack, const BYTE *needle, DWORD dwNeedleSize, DWORD dwHayStackSize, BYTE *replacement)
{
    DWORD counter = 0;
    for(DWORD i = 0; i < dwHayStackSize; i++)
        if(haystack[i] == needle[counter])
        {
            counter++;
            if(counter == dwNeedleSize)
            {
                for(DWORD j = 0; j < dwNeedleSize; j++)
                    haystack[(i - dwNeedleSize + 1) + j] = replacement[j];
                return i - dwNeedleSize + 1;
            }
        }
        else
            counter = 0;
}

int main(int argc, char **argv)
{
    printf("+--------------------------------------------+\n");
    printf("|                JustCrypt                   |\n");
    printf("|             Coded by Cardano               |\n");
    printf("+--------------------------------------------+\n");

    if(argc < 2)
    {
        printf("Bitte uebergeben Sie den Namen einer zu bearbeitenden Datei:\n");
        printf("\t%s <path/filename>.exe\n", argv[0]);
        system("pause");
        exit(0);
    }

    BYTE key[] =      { '\x6c', '\x2f', '\xc4', '\x32', '\x7d', '\x70', '\x58', '\x65',
                        '\x24', '\x2f', '\xfc', '\x62', '\x6c', '\x79', '\x58', '\x72',
                        '\x77', '\x58', '\x70', '\x56', '\x56', '\x49', '\x3b', '\x56',
                        '\x2f', '\x59', '\x3e', '\x42', '\x2e', '\x45', '\x78', '\x41'};

    BYTE rc4code[] =  { '\x9C', '\x60', '\xBE', '\xAA', '\xAA', '\xAA', '\xAA', '\xBF',
                        '\xDD', '\xDD', '\xDD', '\xDD', '\x33', '\xC0', '\xB0', '\xFF',
                        '\x88', '\x04', '\x30', '\xFE', '\xC8', '\x75', '\xF9', '\x33',
                        '\xDB', '\x50', '\x99', '\x66', '\xB9', '\xCC', '\xCC', '\x66',
                        '\xF7', '\xF1', '\x58', '\x02', '\x1C', '\x30', '\x02', '\x9A',
                        '\xBB', '\xBB', '\xBB', '\xBB', '\x8A', '\x0C', '\x30', '\x86',
                        '\x0C', '\x33', '\x88', '\x0C', '\x30', '\xFE', '\xC0', '\x75',
                        '\xE0', '\x33', '\xDB', '\x33', '\xC9', '\xFE', '\xC0', '\x02',
                        '\x1C', '\x30', '\x8A', '\x14', '\x30', '\x86', '\x14', '\x33',
                        '\x88', '\x14', '\x30', '\x32', '\xD2', '\x8A', '\x14', '\x30',
                        '\x02', '\x14', '\x33', '\x8A', '\x14', '\x32', '\x32', '\x14',
                        '\x39', '\x88', '\x14', '\x39', '\x41', '\x81', '\xF9', '\xEE',
                        '\xEE', '\xEE', '\xEE', '\x7C', '\xD8', '\x68', '\xFF', '\xFF',
                        '\xFF', '\xFF', '\xC3'};

    BYTE copycode[] = { '\xBE', '\x11', '\x11', '\x11', '\x11', '\xBF', '\x22', '\x22',
                        '\x22', '\x22', '\xB9', '\x33', '\x33', '\x33', '\x33', '\x32',
                        '\xC0', '\x86', '\x44', '\x31', '\xFF', '\x86', '\x44', '\x39',
                        '\xFF', '\xE2', '\xF4', '\x61', '\x9D', '\x68', '\x44', '\x44',
                        '\x44', '\x44', '\xC3'};

    RC4 *rc4 = new RC4(key, sizeof(key));
    PEFile *pefile = new PEFile(argv[1]);

    DWORD dwImageBase = pefile->getNTHeaders()->OptionalHeader.ImageBase;
    pefile->getNTHeaders()->OptionalHeader.DllCharacteristics ^= IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLLCHARACTERISTICS_NX_COMPAT;

    int iNewSecId = pefile->getSectionIdByRVA(pefile->getNTHeaders()->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
    DWORD rvaOEP = pefile->getNTHeaders()->OptionalHeader.AddressOfEntryPoint;
    DWORD roOEP = pefile->getRawOffsetByRVA(rvaOEP);
    DWORD vaOEP = rvaOEP + pefile->getNTHeaders()->OptionalHeader.ImageBase;
    IMAGE_SECTION_HEADER *ishNew;
    IMAGE_SECTION_HEADER *ishToCrypt = pefile->getSectionHeaderById(pefile->getSectionIdByRVA(rvaOEP));

    printf("[*] Bevorzugte ImageBase der Datei: 0x%08x\n", dwImageBase);
    printf("[*] RO Adresse des OEP: 0x%08x\n", roOEP);
    printf("[*] Name der Section des OEP: %8s\n", ishToCrypt->Name);

    if(iNewSecId != -1)
    {
        printf("[*] Es wurde eine RelocationSection gefunden\n");
        if(pefile->getSectionHeaderById(iNewSecId - 1)->Characteristics & IMAGE_SCN_MEM_WRITE)
        {
            printf("[*] Die Section vor der RelocSec. hat Schreibberechtigungen\n");
            printf("[*] Die Sections: %8s und %8s werden fusioniert\n", pefile->getSectionHeaderById(iNewSecId), pefile->getSectionHeaderById(iNewSecId-1));
            pefile->getNTHeaders()->OptionalHeader.SizeOfImage -= Align(pefile->getSectionHeaderById(iNewSecId - 1)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.SectionAlignment);
            pefile->setFileSize(pefile->getFileSize() - pefile->getSectionHeaderById(iNewSecId - 1)->SizeOfRawData);
            pefile->getSectionHeaderById(iNewSecId - 1)->Misc.VirtualSize += sizeof(key) + sizeof(rc4code) + 256;
            pefile->getSectionHeaderById(iNewSecId - 1)->SizeOfRawData = Align(pefile->getSectionHeaderById(iNewSecId - 1)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.FileAlignment);
            pefile->getNTHeaders()->OptionalHeader.SizeOfImage += Align(pefile->getSectionHeaderById(iNewSecId - 1)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.SectionAlignment);
            pefile->setFileSize(pefile->getFileSize() + pefile->getSectionHeaderById(iNewSecId - 1)->SizeOfRawData);
            pefile->deleteSectionById(iNewSecId);
            iNewSecId--;
            pefile->getNTHeaders()->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress = 0x00000000;
            pefile->getNTHeaders()->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size = 0x00000000;
        }
        else
        {
            printf("[*] Die Section vor der RelocSec. hat keine Schreibberechtigungen\n");
            printf("[*] Die RelocSec. wird den Beduerfnissen der Stub(s) angepasst\n");
            pefile->getNTHeaders()->OptionalHeader.SizeOfImage -= Align(pefile->getSectionHeaderById(iNewSecId)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.SectionAlignment);
            pefile->setFileSize(pefile->getFileSize() - pefile->getSectionHeaderById(iNewSecId)->SizeOfRawData);
            pefile->getSectionHeaderById(iNewSecId)->Misc.VirtualSize += sizeof(key) + sizeof(rc4code) + 256;
            pefile->getSectionHeaderById(iNewSecId)->SizeOfRawData = Align(pefile->getSectionHeaderById(iNewSecId)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.FileAlignment);
            pefile->getSectionHeaderById(iNewSecId)->Characteristics |= IMAGE_SCN_MEM_WRITE;
            pefile->getNTHeaders()->OptionalHeader.SizeOfImage += Align(pefile->getSectionHeaderById(iNewSecId)->Misc.VirtualSize, pefile->getNTHeaders()->OptionalHeader.SectionAlignment);
            pefile->setFileSize(pefile->getFileSize() + pefile->getSectionHeaderById(iNewSecId)->SizeOfRawData);
            pefile->getNTHeaders()->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress = 0x00000000;
            pefile->getNTHeaders()->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size = 0x00000000;
        }
    }
    else
    {
        iNewSecId = pefile->addSection(".misc", sizeof(key) + sizeof(rc4code) + 256, IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_CNT_INITIALIZED_DATA);
        printf("[*] Es ist keine RelocSec. vorhanden\n");
        printf("[*] Es wurde eine neue Section mit dem Namen %8s angelegt\n", ".misc");
    }

    ishNew = pefile->getSectionHeaderById(iNewSecId);
    BYTE *pNewSection = pefile->getPointerToDataByRO(ishNew->PointerToRawData);

    // Überprüfen ob am Ende von .text noch Platz für die Copystub ist
    bool bEnoughSpaceForCopyStub = false;
    CODE_CAVE *ccEndText = pefile->getSecEndCCByName((const char *) ishToCrypt->Name);
    if(ccEndText != NULL)
        if(ccEndText->dwCaveSize > sizeof(copycode))
        {
            bEnoughSpaceForCopyStub = true;
            printf("[*] Es wurde ein %d Byte grosses Codecave am Ende von %8s gefunden\n", ccEndText->dwCaveSize, ishToCrypt->Name);
            printf("[*] Dieses wird fuer die CopyStub verwendet\n");
        }

    // Bestimmen der virtuellen Addressen und Größen für die Platzhalter
    DWORD vaNewSection = ishNew->VirtualAddress + dwImageBase;
    DWORD vaSBOX = ishNew->VirtualAddress + sizeof(rc4code) + sizeof(key) + dwImageBase;
    DWORD vaKeyAddress = ishNew->VirtualAddress + sizeof(rc4code) + dwImageBase;
    WORD wKeyLen = sizeof(key);
    DWORD vaMessageAddress = vaOEP + sizeof(rc4code);
    DWORD dwMessageLen =  ishToCrypt->VirtualAddress + ishToCrypt->Misc.VirtualSize - ((bEnoughSpaceForCopyStub)?ccEndText->dwCaveSize:0) - rvaOEP;
    DWORD vaNextInstr = ((bEnoughSpaceForCopyStub)
                            ? (pefile->getRVAByRawOffset(ccEndText->RawOffset) + dwImageBase)
                            : (vaSBOX + 256)
                        );

    BYTE *pOEP = pefile->getPointerToDataByRO(pefile->getRawOffsetByRVA(rvaOEP));

    // Füllen der Platzhalter im RC4-Shellcode
    searchNreplace(rc4code, (const BYTE *) "\xAA\xAA\xAA\xAA", sizeof(DWORD), sizeof(rc4code), (BYTE *) &vaSBOX);
    searchNreplace(rc4code, (const BYTE *) "\xBB\xBB\xBB\xBB", sizeof(DWORD), sizeof(rc4code), (BYTE *) &vaKeyAddress);
    searchNreplace(rc4code, (const BYTE *) "\xCC\xCC", sizeof(WORD), sizeof(rc4code), (BYTE *) &wKeyLen);
    searchNreplace(rc4code, (const BYTE *) "\xDD\xDD\xDD\xDD", sizeof(DWORD), sizeof(rc4code), (BYTE *) &vaMessageAddress);
    searchNreplace(rc4code, (const BYTE *) "\xEE\xEE\xEE\xEE", sizeof(DWORD), sizeof(rc4code), (BYTE *) &dwMessageLen);
    searchNreplace(rc4code, (const BYTE *) "\xFF\xFF\xFF\xFF", sizeof(DWORD), sizeof(rc4code), (BYTE *) &vaNextInstr);


    // Füllen der Platzhalter im Copy-Shellcode
    DWORD dwSizeRC4Code = sizeof(rc4code);
    searchNreplace(copycode, (const BYTE *) "\x11\x11\x11\x11", sizeof(DWORD), sizeof(copycode), (BYTE *) &vaNewSection);
    searchNreplace(copycode, (const BYTE *) "\x22\x22\x22\x22", sizeof(DWORD), sizeof(copycode), (BYTE *) &vaOEP);
    searchNreplace(copycode, (const BYTE *) "\x33\x33\x33\x33", sizeof(DWORD), sizeof(copycode), (BYTE *) &dwSizeRC4Code);
    searchNreplace(copycode, (const BYTE *) "\x44\x44\x44\x44", sizeof(DWORD), sizeof(copycode), (BYTE *) &vaOEP);

    printf("[*] RO Beginn der Encryption: 0x%08x\n", roOEP + sizeof(rc4code));
    printf("[*] RO Ende der Encryption: 0x%08x\n", roOEP + dwMessageLen);
    printf("[*] Anzahl der zu verschl. Bytes: 0x%08x\n", dwMessageLen);

    rc4->encrypt(pOEP + sizeof(rc4code), dwMessageLen);

    printf("[*] RO der RC4 Stub: 0x%08x\n", roOEP);

    if(bEnoughSpaceForCopyStub)
    {
        memcpy(pNewSection, pOEP, sizeof(rc4code));
        memcpy(pOEP, rc4code, sizeof(rc4code));
        memcpy(pNewSection + sizeof(rc4code), key, sizeof(key));
        for(DWORD i = 0; i < 256; i++)
            pNewSection[sizeof(rc4code) + sizeof(key) + i] = 0x00;
        memcpy(pefile->getPointerToDataByRO(ccEndText->RawOffset), copycode, sizeof(copycode));
        printf("[*] RO der CopyStub: 0x%08x\n", ccEndText->RawOffset);
    }
    else
    {
        memcpy(pNewSection, pOEP, sizeof(rc4code));
        memcpy(pOEP, rc4code, sizeof(rc4code));
        memcpy(pNewSection + sizeof(rc4code), key, sizeof(key));
        for(DWORD i = 0; i < 256; i++)
            pNewSection[sizeof(rc4code) + sizeof(key) + i] = 0x00;
        memcpy(pNewSection + sizeof(rc4code) + sizeof(key) + 256, copycode, sizeof(copycode));
        printf("[*] RO der CopyStub: 0x%08x\n", ishNew->PointerToRawData + sizeof(rc4code) + sizeof(key) + 256);
    }

    ishToCrypt->Characteristics |= IMAGE_SCN_MEM_WRITE;
    pefile->writePEFile("crypted.exe");
    pefile->~PEFile();
    printf("[*] Ausgabedatei: %s\n", "crypted.exe");
    system("pause");
    return 0;
}