Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- format PE GUI 4.0 DLL
- entry DllEntryPoint
- ;***************** !!! ******************************
- include 'win32a.inc' ;<<<<<<--------- macros and constants !!!
- ;***************** !!! ******************************
- section '.code' code readable executable
- macro makejmp offset, addr
- {
- local .copy, .end
- jmp .end
- .copy:
- mov eax, addr
- jmp eax
- .end:
- stdcall memcpy, .copy, offset, .end-.copy }
- macro eaxcall addr
- { mov eax, addr
- call eax }
- proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
- invoke VirtualProtect, 400100h, 0fc1000h, 0x40, lpflOldProtect ; Remove write protection from executable section
- makejmp 1296FCFh, ExtendStageTable
- ; patch access to stage table
- mov dword[0D40076h], newStageTable
- mov dword[0D401FEh], newStageTable
- mov dword[0D41239h], newStageTable
- mov dword[0D56D13h], newStageTable
- mov dword[0D56D2Ah], newStageTable
- ;mov dword[0D56D4Ch], newStageTable ; need to check this function later
- mov dword[0D5785Ah], newStageTable
- mov dword[0D5A17Eh], newStageTable
- mov dword[0D92656h], newStageTable
- mov dword[0D96030h], newStageTable
- mov dword[1067B0Ch], newStageTable
- mov dword[107C5C8h], newStageTable
- invoke VirtualProtect, 401000h, 0fc1000h, [lpflOldProtect], lpflOldProtect
- mov eax,TRUE
- ret
- endp
- proc ExtendStageTable
- stageTable = 1E66B48h
- StringContainer = 6621A0h
- stdcall memcpy, stageTable, newStageTable, 80h ; copy original stage table
- ; As a test, modify stage 2 (cpz100) to be ghz100
- push ghz100
- mov ecx, newStageTable + 2 * 4
- eaxcall StringContainer
- ; Slots for stages 19-26 are probably left unused
- ; Set stage 20 to be myk100 as example
- push myk100
- mov ecx, newStageTable + 20 * 4
- eaxcall StringContainer
- ; Original MakeStageTable (sub_1296DE0) function tail
- push 13C05C0h
- eaxcall 0A68D92h
- pop ecx
- ret
- endp
- proc memcpy, lpSource, lpDest, Count
- push esi edi ecx
- mov esi, [lpSource]
- mov edi, [lpDest]
- mov ecx, [Count]
- .copy_loop:
- mov al, byte [esi]
- mov byte [edi], al
- inc edi
- inc esi
- dec ecx
- test ecx, ecx
- jnz .copy_loop
- pop ecx edi esi
- ret
- endp
- section '.data' readable writable
- lpflOldProtect dd ?
- align 4
- newStageTable db 100h dup ? ; original one is 80h, but we plan on adding more stages, right?
- ghz100 db 'ghz100',0
- myk100 db 'myk100',0
- section '.idata' import data readable writeable
- library kernel32,'KERNEL32.DLL',\
- user32,'USER32.DLL'
- include 'api/kernel32.inc'
- include 'api/user32.inc'
- section '.reloc' fixups data readable discardable
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement