Advertisement
ZxZ666

Untitled

Feb 20th, 2012
104
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // Get VA
  2. #define RVATOVA( base, offset )(((DWORD)(base) + (DWORD)(offset)))
  3.  
  4. // Move program's memory
  5. void __CopyMemoryAcrossProcesses( HANDLE hProcess, char* pMemLocal, char* pMemRemote )
  6. {
  7.     DWORD dwOldProt, dwNumBytes, i;
  8.     MEMORY_BASIC_INFORMATION mbi;
  9.      
  10.     VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
  11.     while (mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0)
  12.     {
  13.         if (!(mbi.Protect & PAGE_GUARD))
  14.         {
  15.             for (i = 0; i < mbi.RegionSize; i += 0x1000)
  16.             {
  17.                 VirtualProtectEx(hProcess, pMemRemote + i, 0x1000,PAGE_EXECUTE_READWRITE, &dwOldProt);
  18.                 WriteProcessMemory(hProcess, pMemRemote + i, pMemLocal + i, 0x1000, &dwNumBytes);
  19.             }
  20.         }
  21.         pMemLocal += mbi.RegionSize;
  22.         pMemRemote += mbi.RegionSize;
  23.         VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));  
  24.     }
  25. }
  26.  
  27. bool TransferProgram(HANDLE hProcess)
  28. {
  29.     HMODULE g_module = GetModuleHandle(0);
  30.     VirtualFreeEx(hProcess, g_module, 0, MEM_RELEASE);
  31.    
  32.     DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(g_module) + ((PIMAGE_DOS_HEADER)(g_module))->e_lfanew +
  33.         sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;
  34.  
  35.     char *pMem = (char *)VirtualAllocEx(hProcess, g_module, dwSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  36.     if(pMem == NULL) return FALSE;
  37.  
  38.     __CopyMemoryAcrossProcesses( hProcess, (char*) g_module, pMem );
  39.  
  40.     return true;
  41. }
  42.  
  43. DWORD TransferProgramEx(HANDLE hProcess)
  44. /*
  45.  Return value: image base delta, -1 on error
  46. */
  47. {
  48.     HMODULE hmodule = GetModuleHandle(0);
  49.     DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(hmodule) + ((PIMAGE_DOS_HEADER)(hmodule))->e_lfanew +
  50.         sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;
  51.  
  52.     MEMORY_BASIC_INFORMATION mbi = {0};
  53.     VirtualQueryEx( hProcess, hmodule, &mbi, sizeof(mbi) );
  54.  
  55.     LPVOID Allocated;
  56.  
  57.     // Memory isn't free, relocate
  58.     if( mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0 )
  59.     {
  60. __try_relocate:
  61.         LPVOID DesiredAddress = hmodule;
  62.         *(DWORD*)&DesiredAddress += mbi.RegionSize;
  63.  
  64.         for(;;)
  65.         {
  66.             Allocated = VirtualAllocEx( hProcess, DesiredAddress, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
  67.             if( Allocated )
  68.                 break;
  69.             *(DWORD*)&DesiredAddress += dwSize;
  70.         }
  71.     }
  72.     else
  73.     {
  74.         Allocated = VirtualAllocEx( hProcess, hmodule, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
  75.         if( !Allocated )
  76.             goto __try_relocate;
  77.     }
  78.  
  79.     // move memory
  80.     __CopyMemoryAcrossProcesses( hProcess, (char*) hmodule, (char*) Allocated );
  81.  
  82.     DWORD ImageBaseDelta = (DWORD)Allocated - (DWORD)hmodule;
  83.  
  84.     // Nonzero imagebase delta
  85.     if( ImageBaseDelta )
  86.     {
  87.         // Apply fixups
  88.         typedef struct
  89.         {
  90.             WORD    Offset:12;
  91.             WORD    Type:4;
  92.         } IMAGE_FIXUP_ENTRY, *PIMAGE_FIXUP_ENTRY;
  93.  
  94.         PIMAGE_OPTIONAL_HEADER poh =
  95.             (PIMAGE_OPTIONAL_HEADER)(
  96.                 (DWORD)hmodule
  97.                 + ((PIMAGE_DOS_HEADER)hmodule)->e_lfanew
  98.                 + sizeof(IMAGE_NT_SIGNATURE)
  99.                 + sizeof(IMAGE_FILE_HEADER)
  100.             );
  101.  
  102.         // No fixups?
  103.         if( !poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress )
  104.         {
  105.             VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
  106.             VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
  107.             return -1;
  108.         }
  109.  
  110.         PIMAGE_BASE_RELOCATION Reloc = (PIMAGE_BASE_RELOCATION) RVATOVA(poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress, hmodule);
  111.         int i = 0;
  112.  
  113.         // Process fixups
  114.         for( PIMAGE_FIXUP_ENTRY Fixup = (PIMAGE_FIXUP_ENTRY)( (DWORD)Reloc + sizeof(IMAGE_BASE_RELOCATION) );
  115.              (DWORD)Fixup < (DWORD)Reloc + Reloc->SizeOfBlock -2;
  116.              Fixup ++, i ++
  117.                  )
  118.         {
  119.             if( Fixup->Type == IMAGE_REL_BASED_HIGHLOW )
  120.             {
  121.                 DWORD* Patch = (DWORD*)RVATOVA( Reloc->VirtualAddress + Fixup->Offset, Allocated );
  122.                
  123.                 DWORD t, r;
  124.                 BOOL b = 1;
  125.  
  126.                 // correct fixup
  127.                 b &= ReadProcessMemory( hProcess, Patch, &t, 4, &r );
  128.                 t += ImageBaseDelta;
  129.                 b &= WriteProcessMemory( hProcess, Patch, &t, 4, &r );
  130.  
  131.                 if( !b )
  132.                 {
  133.                     // smth wrong
  134.                     VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
  135.                     VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
  136.                     return -1;
  137.                 }
  138.             }
  139.             else
  140.             {
  141.                 // unsupported fixup type
  142.                 VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
  143.                 VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
  144.                 return -1;
  145.             }
  146.         }
  147.     }
  148.  
  149.     return ImageBaseDelta;
  150. }
  151. void test(HANDLE hProcess)
  152. {
  153.     DWORD ImageBaseDelta = TransferProgramEx( hProcess );
  154.  
  155.     switch(ImageBaseDelta)
  156.     {
  157.     case -1:
  158.         return printf("Cannot copy body\n"), 0;
  159.  
  160.     case 0:
  161.         printf("Program copied at the same addresses\n");
  162.         break;
  163.  
  164.     default:
  165.         printf("Program relocated (delta = 0x%08x)\n", ImageBaseDelta);
  166.         break;
  167.     }
  168.  
  169.     DWORD thID;
  170.     HANDLE hTh;
  171.  
  172.     hTh = CreateRemoteThread( hProcess, 0, 0, (LPTHREAD_START_ROUTINE)((char*)RemoteThread+Image  BaseDelta), 0, 0, &thID);
  173.     WaitForSingleObject( hTh, INFINITE );
  174. }
Advertisement
Advertisement
Advertisement
RAW Paste Data Copied
Advertisement