API tools faq
paste
Guest User

Untitled

a guest
Jan 19th, 2018
74
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 9.08 KB | None | 0 0
raw download clone embed print report
  1. #pragma option w32c
  2. #includepath "..\..\wxCmm"
  3. #include "wxCmm.h--"
  4. #include "crypt.hmm"
  5. #include "crc32.hmm"
  6. #include "xpu2.rc"
  7. #include "XPVisualStyles.rc"
  8.  
  9. wxFrame frame;
  10. wxNoteBook      nb;
  11. wxCheckBox  control[10];
  12. wxTextCtrl fname;
  13. wxButton button1, button2, button3, button4;
  14. wxFileDialog FO;
  15. dword sz;
  16. byte buf[40960];
  17.  
  18. byte DelphiSign[64] =
  19. {
  20. 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xF0, 0xB8, 0xA0, 0x38, 0x55, 0x00, 0xE8, 0x60, 0x30, 0xEB, 0xFF,
  21. 0x33, 0xC9, 0xB2, 0x01, 0xA1, 0x40, 0x36, 0x55, 0x00, 0xE8, 0x52, 0x63, 0xF3, 0xFF, 0xA3, 0x90,
  22. 0x52, 0x56, 0x00, 0xA1, 0x90, 0x52, 0x56, 0x00, 0xE8, 0x9B, 0xA6, 0xF3, 0xFF, 0xA1, 0x90, 0x52,
  23. 0x56, 0x00, 0x8B, 0x10, 0xFF, 0x92, 0x88, 0x00, 0x00, 0x00, 0x33, 0xC0, 0x55, 0x68, 0xDC, 0x40
  24. };
  25. byte MySign[64];
  26.  
  27. struct IMAGE_NT_HEADERS
  28. {
  29.     dword               Signature;
  30.     IMAGE_FILE_HEADER   FileHeader;
  31.     IMAGE_OPTIONAL_HEADER32 OptionalHeader;
  32. };
  33.  
  34. struct  PEFile
  35. {
  36.     IMAGE_DOS_HEADER    MZHeader;
  37.     CHAR                MZData[0x400];
  38.     IMAGE_NT_HEADERS    PEHeader;
  39.     IMAGE_SECTION_HEADER Sections[0x20];
  40.     dword               Objects[0x20];
  41. };
  42.  
  43. PEFile  MyFile;
  44.  
  45.  
  46. void wxMain()
  47. {
  48.     dword       panel;
  49.     init_CRC32();
  50.     //FreeConsole();
  51.     if(!IsDebuggerPresentN())
  52.     {
  53.    
  54.         frame.wxFrame(NULL, -1, "Xpu", 0, new wxSize(400,400), wxSYSTEM_MENU);
  55.         frame.Centre();
  56.         nb.wxNoteBook(#frame);
  57.         panel = new wxPanel(#nb);
  58.         nb.AddPage(panel, "Main");
  59.  
  60.         fname.wxTextCtrl(panel, -1, "", 0, new wxSize(300,25));
  61.  
  62.         control[0].wxCheckBox(panel, -1, "Anti Ring3 debuggers");
  63.         control[0].Move(10, 50);
  64.        
  65.         control[1].wxCheckBox(panel, -1, "Anti SoftIce");
  66.         control[1].Move(10, 80);
  67.  
  68.         control[2].wxCheckBox(panel, -1, "Exit in Case of bad CRC");
  69.         control[2].Move(10, 110);
  70.  
  71.         control[3].wxCheckBox(panel, -1, "Erase API/DLL name string");
  72.         control[3].Move(10, 140);
  73.  
  74.         control[4].wxCheckBox(panel, -1, "Anti API breakpoint");
  75.         control[4].Move(10, 170);
  76.        
  77.         control[5].wxCheckBox(panel, -1, "Anti in-Loader API BPX");
  78.         control[5].Move(10, 200);
  79.  
  80.         control[6].wxCheckBox(panel, -1, "Anti in-Loader code BPX");
  81.         control[6].Move(10, 230);
  82.  
  83.         control[7].wxCheckBox(panel, -1, "Anti hardware breakpoint");
  84.         control[7].Move(10, 260);
  85.  
  86.         control[8].wxCheckBox(panel, -1, "Anti Ice dump");
  87.         control[8].Move(10, 290);
  88.        
  89.         control[9].wxCheckBox(panel, -1, "Make buckup");
  90.         control[9].Move(210, 50);
  91.  
  92.  
  93.         button1.wxButton(panel, -1, "Crypt");
  94.         button1.Move(10, 320);
  95.         connect(#button1, wxEVT_COMMAND_BUTTON_CLICKED, #DoCrypt);
  96.  
  97.         button2.wxButton(panel, -1, "Open");
  98.         button2.Move(310, 0);
  99.         connect(#button2, wxEVT_COMMAND_BUTTON_CLICKED, #OpenFile1);
  100.        
  101.         panel = new wxPanel(#nb);
  102.         nb.AddPage(panel, "Simulate");
  103.         //control.wxCheckBox(panel, -1, "wxCheckBox");
  104.        
  105.         frame.Show();
  106.     }  
  107. }
  108.  
  109.  
  110.  
  111.  
  112. :void  OpenFile1(dword event)
  113. {
  114.     PCHAR s;
  115.     FO.wxFileDialog(#frame, 0, 0, 0, "*.exe");
  116.     FO.SetStyle(wxOPEN | wxHIDE_READONLY); 
  117.     if(FO.ShowModal() == wxID_OK)
  118.         {
  119.             s = FO.GetPathDir();
  120.             lstrcat(s, "\\");
  121.             lstrcat(s, FO.GetFilename());
  122.             fname.WriteText(s);
  123.         }
  124. }
  125.  
  126. :dword Max(dword x1, x2)
  127. {
  128.     if(x1>x2) return(x1);
  129.         else return(x2);
  130. };
  131.  
  132. :void MakeBak(dword fname2)
  133. {
  134.     PCHAR s;
  135.     s = fname2;
  136.     lstrcat(s, ".bak");
  137.     CopyFile(fname2, s, 1);
  138. }
  139.  
  140. :dword LoadFile(dword fname1)
  141. {
  142.     PCHAR p;
  143.     HANDLE hfile;
  144.     dword nr, x;
  145.     hfile = CreateFile(fname1, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  146.     ReadFile(hfile, #MyFile.MZHeader, sizeof(MyFile.MZHeader), #nr, 0);
  147.     if(MyFile.MZHeader.e_magic != IMAGE_DOS_SIGNATURE )
  148.         {
  149.             wxMessageBox(#frame, "Wrong MZ file", "Error", wxOK | wxICON_INFORMATION);
  150.             return(0);
  151.         }
  152.     SetFilePointer(hfile, 0, 0, 0);
  153.     ReadFile(hfile, #MyFile.MZData, MyFile.MZHeader.e_lfanew, #nr, 0);
  154.     ReadFile(hfile, #MyFile.PEHeader, sizeof(IMAGE_NT_HEADERS), #nr, 0);
  155.     if(MyFile.PEHeader.Signature != IMAGE_NT_SIGNATURE)
  156.         {
  157.             wxMessageBox(#frame, "Wrong PE file", "Error", wxOK | wxICON_INFORMATION);
  158.             return(0);     
  159.         }
  160.     for(x=1; x<=MyFile.PEHeader.FileHeader.NumberOfSections; x++)
  161.         ReadFile(hfile, #MyFile.Sections[x-1], sizeof(IMAGE_SECTION_HEADER), #nr, 0);
  162.        
  163.     sz=0;
  164.     MyFile.PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;
  165.     for(x=IMAGE_DIRECTORY_ENTRY_EXPORT; x<=IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR; x++)
  166.         {
  167.             if(MyFile.PEHeader.OptionalHeader.DataDirectory[x].VirtualAddress<>0)
  168.                 sz += MyFile.PEHeader.OptionalHeader.DataDirectory[x].Size;
  169.         }
  170.     ReadFile(hfile, #buf, sz, #nr, 0);
  171.  
  172.     for(x=1; x<=MyFile.PEHeader.FileHeader.NumberOfSections; x++)
  173.         {
  174.             SetFilePointer(hfile, MyFile.Sections[x-1].PointerToRawData, 0, 0);
  175.             MyFile.Objects[x-1] = GlobalAlloc(GMEM_ZEROINIT, Max(MyFile.Sections[x-1].Misc.VirtualSize, MyFile.Sections[x-1].SizeOfRawData));
  176.             ReadFile(hfile, MyFile.Objects[x-1], MyFile.Sections[x-1].SizeOfRawData, #nr, 0);
  177.         }
  178.     CloseHandle(hfile);
  179. }
  180.  
  181. :dword SaveFile(dword fname2)
  182. {
  183.     HANDLE hfile;
  184.     dword nr, x;
  185.     hfile = CreateFile(fname2,GENERIC_WRITE,FILE_SHARE_WRITE,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
  186.     WriteFile(hfile, #MyFile.MZData, MyFile.MZHeader.e_lfanew, #nr, 0);
  187.     WriteFile(hfile, #MyFile.PEHeader, sizeof(IMAGE_NT_HEADERS), #nr, 0);
  188.      
  189.     for(x=1; x<=MyFile.PEHeader.FileHeader.NumberOfSections; x++)
  190.         {
  191.             MyFile.Sections[x-1].Characteristics |=0xE0000060;
  192.             WriteFile(hfile, #MyFile.Sections[x-1], sizeof(IMAGE_SECTION_HEADER), #nr, 0);
  193.         }
  194.     if(sz!=0)
  195.         WriteFile(hfile, #buf, sz, #nr, 0);
  196.  
  197.     for(x=1; x<=MyFile.PEHeader.FileHeader.NumberOfSections; x++)
  198.         {
  199.             SetFilePointer(hfile, MyFile.Sections[x-1].PointerToRawData, 0, 0);
  200.             WriteFile(hfile, MyFile.Objects[x-1], MyFile.Sections[x-1].SizeOfRawData, #nr, 0);
  201.         }
  202.     CloseHandle(hfile);
  203. }
  204.  
  205. struct sDecryptor
  206. {
  207.     byte moveax;
  208.     dword addr1;
  209.     byte movebx;
  210.     dword addr2;
  211.     word pushbyte;
  212.     byte popecx;
  213.     word movdleax;
  214.     word xorebxal;
  215.     byte inceax;
  216.     byte incebx;
  217.     word deccx;
  218.     word jnzlbl;
  219. } Decryptor = {0xB8, 0, 0xBB, 0, 0x406A, 0x59, 0x108A, 0x1330, 0x40, 0x43, 0x4966, 0xF675};
  220.  
  221. :void AddSection(void)
  222. {
  223.     dword x, y, z, z1, siz, nr;
  224.     x = MyFile.PEHeader.FileHeader.NumberOfSections;
  225.     MyFile.PEHeader.FileHeader.NumberOfSections++;
  226.  
  227.     MyFile.Sections[x].Misc.VirtualSize = MyFile.Sections[x].SizeOfRawData = 4096;
  228.     MyFile.Sections[x].PointerToRawData = MyFile.Sections[x-1].PointerToRawData + MyFile.Sections[x-1].SizeOfRawData;
  229.    
  230.     MyFile.Sections[x].PointerToRawData = MyFile.Sections[x].PointerToRawData / MyFile.PEHeader.OptionalHeader.FileAlignment;
  231.     MyFile.Sections[x].PointerToRawData++;
  232.     MyFile.Sections[x].PointerToRawData = MyFile.Sections[x].PointerToRawData * MyFile.PEHeader.OptionalHeader.FileAlignment;
  233.      
  234.     MyFile.Sections[x].VirtualAddress = MyFile.Sections[x-1].VirtualAddress + MyFile.Sections[x-1].Misc.VirtualSize;
  235.    
  236.     MyFile.Sections[x].VirtualAddress = MyFile.Sections[x].VirtualAddress / MyFile.PEHeader.OptionalHeader.SectionAlignment;
  237.     if(EDX!=0)MyFile.Sections[x].VirtualAddress++;
  238.     MyFile.Sections[x].VirtualAddress = MyFile.Sections[x].VirtualAddress * MyFile.PEHeader.OptionalHeader.SectionAlignment;
  239.    
  240.     MyFile.Sections[x].Characteristics = 0xE0000040;
  241.     MyFile.Sections[x].Name[0] = '1';
  242.     MyFile.Sections[x].Name[1] = '2';
  243.     MyFile.Sections[x].Name[2] = '3';
  244.     MyFile.Objects[x] = GlobalAlloc(GMEM_ZEROINIT, 4096);
  245.     MyFile.PEHeader.OptionalHeader.SizeOfImage += MyFile.Sections[x].Misc.VirtualSize;
  246.  
  247.  
  248.     //IsDebuggerPresentN();
  249.     y = #IsDebuggerPresentN;
  250.     siz = sizeof(IsDebuggerPresentN)-1;
  251.     for(z=0; z<siz; z++)
  252.         {
  253.             DSBYTE[MyFile.Objects[x]+z]=DSBYTE[y+z];
  254.         }
  255.          
  256.     y = #zero_ecx;
  257.     siz = sizeof(zero_ecx)+z;
  258.     for(; z<siz; z++, y++)
  259.         {
  260.             DSBYTE[MyFile.Objects[x]+z]=DSBYTE[y];
  261.         }
  262.        
  263.     Decryptor.addr1 = MyFile.Sections[x].VirtualAddress + MyFile.PEHeader.OptionalHeader.ImageBase + 4032; 
  264.     Decryptor.addr2 = MyFile.PEHeader.OptionalHeader.AddressOfEntryPoint + MyFile.PEHeader.OptionalHeader.ImageBase;
  265.     for(y=0; y<sizeof(sDecryptor); z++, y++)   
  266.         DSBYTE[MyFile.Objects[x]+z] = DSBYTE[#Decryptor+y];
  267.  
  268.  
  269.  
  270.     z1 = MyFile.PEHeader.OptionalHeader.AddressOfEntryPoint;
  271.     for(y=0; y<=x; y++)
  272.         {
  273.             if(z1>=MyFile.Sections[y].VirtualAddress)
  274.                 if(MyFile.Sections[y].VirtualAddress + MyFile.Sections[y].Misc.VirtualSize>=z1)break;  
  275.         }
  276.     z1 -= MyFile.Sections[y].VirtualAddress;
  277.     z1 = MyFile.Objects[y] + z1;
  278.     for(y=0; y<63; y++, z1++)  
  279.         {
  280.             DSBYTE[MyFile.Objects[x]+4096-64+y] = DSBYTE[z1] ^ DelphiSign[y];
  281.             DSBYTE[z1] = DelphiSign[y];
  282.         }
  283.        
  284. // B8 xx xx xx xx  MOV EAX,xxxxxxxx
  285. // FF E0           JMP EAX 
  286.     DSBYTE[MyFile.Objects[x]+z] = 0xB8;
  287.     DSDWORD[MyFile.Objects[x]+z+1] = MyFile.PEHeader.OptionalHeader.ImageBase + MyFile.PEHeader.OptionalHeader.AddressOfEntryPoint;
  288.     DSWORD[MyFile.Objects[x]+z+5] = 0xE0FF;
  289.  
  290.        
  291.     MyFile.PEHeader.OptionalHeader.AddressOfEntryPoint = MyFile.Sections[x].VirtualAddress;
  292. }
  293.  
  294. void DoCrypt(dword event)
  295. {
  296.     if(strcmp(fname.GetValue(), "")==0) {wxMessageBox(#frame, "Select file first", "Warning", wxOK | wxICON_INFORMATION); return();};
  297.     if(control[9].IsChecked()) {MakeBak(fname.GetValue());};
  298.     LoadFile(fname.GetValue());
  299.  
  300.     AddSection();
  301.  
  302.     SaveFile("j:\\1.exe");
  303.     wxMessageBox(#frame, fname.GetValue(), "TO-DO", wxOK | wxICON_INFORMATION);
  304.  
  305. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!