Guest User

lstrcmpA Killer

a guest
Feb 13th, 2011
278
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <Windows.h>
  2. #include <tlhelp32.h>
  3. #include <iostream>
  4. using namespace std;
  5.  
  6. #define MSGRET(str, ret) { cout << "ERROR: " << str << endl; system("pause"); return ret; }
  7.  
  8. DWORD procNameToPID(const char *procName);
  9. bool dllInjection(DWORD pid, string dll);
  10. void WinAPIError();
  11.  
  12. int main(int argc, const char *argv[])
  13. {
  14.     DWORD pid = procNameToPID("externalCrackme.exe");
  15.  
  16.     if (!pid)
  17.         MSGRET("Process not found.", 1)
  18.     cout << "PID Found: " << pid << endl;
  19.  
  20.     cout << "Killing strcmp..." << endl;
  21.  
  22.     HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
  23.     if (!processHandle)
  24.         MSGRET("Cannot open process.", false)
  25.  
  26.     HMODULE kernel32 = GetModuleHandle("Kernel32");
  27.     FARPROC lstrcmpAptr = GetProcAddress(kernel32, "lstrcmpA");
  28.  
  29.     char data[] = { 0x33, 0xc0, 0xc2, 0x08, 0x00 };
  30.  
  31.     DWORD oldFlags;
  32.     VirtualProtectEx(processHandle, (void*)lstrcmpAptr, sizeof(data), PAGE_EXECUTE_READWRITE, &oldFlags);
  33.     if (!WriteProcessMemory(processHandle, (void*)lstrcmpAptr, &data, sizeof(data), NULL))
  34.     {
  35.         WinAPIError();
  36.         MSGRET("Could not WriteProcessMemory.", 0)
  37.     }
  38.     VirtualProtectEx(processHandle, (void*)lstrcmpAptr, sizeof(data), oldFlags, &oldFlags);
  39.  
  40.     system("pause");
  41.  
  42.     return 0;
  43. }
  44.  
  45. DWORD procNameToPID(const char *procName)
  46. {
  47.     HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  48.     if (snapshot == INVALID_HANDLE_VALUE)
  49.         MSGRET("Unable to create snapshot.", 0)
  50.  
  51.     PROCESSENTRY32 process;
  52.     process.dwSize = sizeof(PROCESSENTRY32);
  53.    
  54.     Process32First(snapshot, &process);
  55.     do
  56.     {
  57.         if (strstr(process.szExeFile, procName))
  58.             return process.th32ProcessID;
  59.     }
  60.     while (Process32Next(snapshot, &process));
  61.    
  62.     return 0;
  63. }
  64.  
  65. void WinAPIError()
  66. {
  67.     LPSTR errorMessage = NULL;
  68.     FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, 0, GetLastError(), 0, (LPSTR)&errorMessage, 0, 0);
  69.     cout << "WinAPI: " << errorMessage;
  70.     LocalFree(errorMessage);
  71. }
RAW Paste Data