API tools faq
paste
m1dw0rd

Untitled

m1dw0rd
Jul 5th, 2022
74
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 13.71 KB | None | 0 0
raw download clone embed print report
  1. #include<stdio.h>
  2. #include<windows.h>
  3. #include<winternl.h>
  4. #include<dbghelp.h>
  5. #include<tchar.h>
  6. #include<iostream>
  7.  
  8. int gtfo(const char* text = "")
  9. {
  10.     printf("gtfo! (%s)\n", text);
  11.     return -1;
  12. }
  13.  
  14. int main(int argc, char* argv[]) {
  15.  
  16.     DWORD bytesRead = NULL;
  17.  
  18.     HANDLE hFile = CreateFileA(argv[1], GENERIC_ALL, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  19.     DWORD fileSize = GetFileSize(hFile, NULL);
  20.     LPVOID lpFile = HeapAlloc(GetProcessHeap(), 0, fileSize);
  21.  
  22.  
  23.     ReadFile(hFile, lpFile, fileSize, &bytesRead, NULL);
  24.     printf("\n\n[*] PE PATH : \"%s\" \n",argv[1]);
  25.     printf("\n ----------------------------------------------------------\n");
  26.     printf("|                  DOS HEADER                              |\n");
  27.     printf(" ----------------------------------------------------------\n");
  28.     IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)lpFile;
  29.     printf("e_magic:\t%x\t\tSIZE : WORD\n", dosHeader->e_magic);
  30.     printf("e_cblp:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_cblp);
  31.     printf("e_cp:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_cp);
  32.     printf("e_crlc:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_crlc);
  33.     printf("e_minalloc:\t%x\t\tSIZE : WORD\n", dosHeader->e_minalloc);
  34.     printf("e_maxalloc:\t%x\t\tSIZE : WORD\n", dosHeader->e_maxalloc);
  35.     printf("e_ss:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_ss);
  36.     printf("e_sp:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_sp);
  37.     printf("e_csum:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_csum);
  38.     printf("e_ip:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_ip);
  39.     printf("e_cs:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_cs);
  40.     printf("e_lfarlc:\t%x\t\tSIZE : WORD\n", dosHeader->e_lfarlc);
  41.     printf("e_ovno:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_ovno);
  42.     printf("e_res1: \t%x\t\tSIZE : WORD\n", dosHeader->e_res[0]);
  43.     printf("    \t%x\t\tSIZE : WORD\n", dosHeader->e_res[1]);
  44.     printf("        \t%x\t\tSIZE : WORD\n", dosHeader->e_res[2]);
  45.     printf("        \t%x\t\tSIZE : WORD\n", dosHeader->e_res[3]);
  46.     printf("e_oemid:\t%x\t\tSIZE : WORD\n", dosHeader->e_oemid);
  47.     printf("e_oeminfo:\t%x\t\tSIZE : WORD\n", dosHeader->e_oeminfo);
  48.     printf("e_res2:\t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[0]);
  49.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[1]);
  50.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[2]);
  51.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[3]);
  52.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[4]);
  53.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[5]);
  54.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[6]);
  55.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[7]);
  56.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[8]);
  57.     printf("       \t\t%x\t\tSIZE : WORD\n", dosHeader->e_res2[9]);
  58.     printf("e_lfanew:\t%x\t\tSIZE : LONG\n", dosHeader->e_lfanew);
  59.  
  60.  
  61.     IMAGE_NT_HEADERS* ntHeaders = (IMAGE_NT_HEADERS*)((DWORD_PTR)lpFile + (DWORD)dosHeader->e_lfanew);
  62.     printf("\n ----------------------------------------------------------\n");
  63.     printf("|                  NT HEADER                              |\n");
  64.     printf(" ----------------------------------------------------------\n");
  65.     printf("Signature:\t%x\t\t\tSIZE : DWORD\n", ntHeaders->Signature);
  66.    
  67.     printf("FileHeader:\n");
  68.     printf("\tMachine:\t\t%x\t\tSIZE: WORD\n", ntHeaders->FileHeader.Machine);
  69.     printf("\tNumberOfSections:\t%d\t\tSIZE: WORD\n", ntHeaders->FileHeader.NumberOfSections);
  70.     printf("\tTimeDateStamp:\t\t%x\tSIZE: DWORD\n", ntHeaders->FileHeader.TimeDateStamp);
  71.     printf("\tPointerToSymbolTable:\t%x\t\tSIZE: DWORD\n", ntHeaders->FileHeader.PointerToSymbolTable);
  72.     printf("\tNumberOfSymbols:\t%x\t\tSIZE: DWORD\n", ntHeaders->FileHeader.NumberOfSymbols);
  73.     printf("\tSizeOfOptionalHeader:\t%x\t\tSIZE: WORD\n", ntHeaders->FileHeader.SizeOfOptionalHeader);
  74.     printf("\tCharacteristics:\t%x\t\tSIZE: WORD\n", ntHeaders->FileHeader.Characteristics);
  75.  
  76.     IMAGE_OPTIONAL_HEADER* imgOptHeader = &ntHeaders->OptionalHeader;
  77.     printf("OptionalHeader:\n");
  78.     printf("\tMagic:\t\t\t%x\t\tSIZE: WORD\n", imgOptHeader->Magic);
  79.     printf("\tMajorLinkerVersion:\t%x\t\tSIZE: BYTE\n", imgOptHeader->MajorLinkerVersion);
  80.     printf("\tMinorLinkerVersion:\t%x\t\tSIZE: BYTE\n", imgOptHeader->MinorLinkerVersion);
  81.     printf("\tSizeOfCode:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfCode);
  82.     printf("\tSizeOfInitializedData:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfInitializedData);
  83.     printf("\tSizeOfUninitializedData:%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfUninitializedData);
  84.     printf("\tAddressOfEntryPoint:\t%x\t\tSIZE: DWORD\n", imgOptHeader->AddressOfEntryPoint);
  85.     printf("\tBaseOfCode:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->BaseOfCode);
  86.     printf("\tImageBase:\t\t%x\tSIZE: DWORD\n", imgOptHeader->ImageBase);
  87.     printf("\tSectionAlignment:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SectionAlignment);
  88.     printf("\tFileAlignment:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->FileAlignment);
  89.     printf("\tMajorOperatingSystemVersion:\t%x\tSIZE: WORD\n", imgOptHeader->MajorOperatingSystemVersion);
  90.     printf("\tMinorOperatingSystemVersion:\t%x\tSIZE: WORD\n", imgOptHeader->MinorOperatingSystemVersion);
  91.     printf("\tMajorImageVersion:\t%x\t\tSIZE: WORD\n", imgOptHeader->MajorImageVersion);
  92.     printf("\tMinorImageVersion:\t%x\t\tSIZE: WORD\n", imgOptHeader->MinorImageVersion);
  93.     printf("\tMajorSubsystemVersion:\t%x\t\tSIZE: WORD\n", imgOptHeader->MajorSubsystemVersion);
  94.     printf("\tMinorSubsystemVersion:\t%x\t\tSIZE: WORD\n", imgOptHeader->MinorSubsystemVersion);
  95.     printf("\tWin32VersionValue:\t%x\t\tSIZE: DWORD\n", imgOptHeader->Win32VersionValue);
  96.     printf("\tSizeOfImage:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfImage);
  97.     printf("\tSizeOfHeaders:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfHeaders);
  98.     printf("\tCheckSum:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->CheckSum);
  99.     printf("\tSubsystem:\t\t%x\t\tSIZE: WORD\n", imgOptHeader->Subsystem);
  100.     printf("\tDllCharacteristics:\t%x\t\tSIZE: WORD\n", imgOptHeader->DllCharacteristics);
  101.     printf("\tSizeOfStackReserve:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfStackReserve);
  102.     printf("\tSizeOfStackCommit:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfStackCommit);
  103.     printf("\tSizeOfHeapReserve:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfHeapReserve);
  104.     printf("\tSizeOfHeapCommit:\t%x\t\tSIZE: DWORD\n", imgOptHeader->SizeOfHeapCommit);
  105.     printf("\tLoaderFlags:\t\t%x\t\tSIZE: DWORD\n", imgOptHeader->LoaderFlags);
  106.     printf("\tNumberOfRvaAndSizes:\t%x\t\tSIZE: DWORD\n", imgOptHeader->NumberOfRvaAndSizes);
  107.     printf("\tDataDirectory:\n");
  108.     printf("\t\tMember\t\t\t\t\tValue\t\tSize\n");
  109.     printf("\t\t-------------------------------------------------------------\n");
  110.     printf("\t\tExport Directory RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[0].VirtualAddress);
  111.     printf("\t\tExport Directory Size\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[0].Size);
  112.     printf("\t\tImport Directory RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[1].VirtualAddress);
  113.     printf("\t\tImport Directory Size\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[1].Size);
  114.     printf("\t\tResource  Directory RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[2].VirtualAddress);
  115.     printf("\t\tResource  Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[2].Size);
  116.     printf("\t\tException  Directory RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[3].VirtualAddress);
  117.     printf("\t\tException  Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[3].Size);
  118.     printf("\t\tSecurity  Directory RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[4].VirtualAddress);
  119.     printf("\t\tSecurity  Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[4].Size);
  120.     printf("\t\tRelocation Directory RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[5].VirtualAddress);
  121.     printf("\t\tRelocation Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[5].Size);
  122.     printf("\t\tDebug Directory RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[6].VirtualAddress);
  123.     printf("\t\tDebug Directory Size\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[6].Size);
  124.     printf("\t\tArchitecture Directory RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[7].VirtualAddress);
  125.     printf("\t\tArchitecture Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[7].Size);
  126.     printf("\t\tGlobal Pointer Directory RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[8].VirtualAddress);
  127.     printf("\t\tGlobal Pointer Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[8].Size);
  128.     printf("\t\tThread Local Storage Directory RVA\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[9].VirtualAddress);
  129.     printf("\t\tThread Local Storage Directory Size\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[9].Size);
  130.     printf("\t\tLoad Configuration Directory RVA\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[10].VirtualAddress);
  131.     printf("\t\tLoad Configuration Directory Size\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[10].Size);
  132.     printf("\t\tBound Import Directory RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[11].VirtualAddress);
  133.     printf("\t\tBound Import Directory Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[11].Size);
  134.     printf("\t\tImport Address Table RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[12].VirtualAddress);
  135.     printf("\t\tImport Address Table Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[12].Size);
  136.     printf("\t\tDelay Import Table RVA\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[13].VirtualAddress);
  137.     printf("\t\tDelay Import Table Size\t\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[13].Size);
  138.     printf("\t\tCOM Descriptor Table RVA\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[14].VirtualAddress);
  139.     printf("\t\tCOM Descriptor Table Size\t\t%x\t\tDWORD\n", imgOptHeader->DataDirectory[14].Size);
  140.     printf("\t\t-------------------------------------------------------------\n");
  141.  
  142.     IMAGE_SECTION_HEADER* sectionHeader = IMAGE_FIRST_SECTION(ntHeaders);
  143.  
  144.  
  145.     printf("\n --------------------------------------------------------------\n");
  146.     printf("|                  SECTION HEADER                              |\n");
  147.     printf(" --------------------------------------------------------------\n");
  148.     printf("--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n");
  149.     printf("Name\t\tVirtualSize\tVirtualAddress\tRawSize\t\tRawAddress\tRelocAddress\tLinenumbers\tRelocationsNumbers\tLinenumbersNumbers\tCharacteristics\n");
  150.     printf("--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n");
  151.     for (int i = 0; i < ntHeaders->FileHeader.NumberOfSections; i++) {
  152.         printf("%s\t\t%x\t\t%x\t\t%x\t\t%x\t\t%x\t\t%x\t\t%x\t\t\t%x\t\t\t%x\n", sectionHeader->Name, sectionHeader->Misc.VirtualSize,sectionHeader->VirtualAddress,sectionHeader->SizeOfRawData,sectionHeader->PointerToRawData,sectionHeader->PointerToRelocations,sectionHeader->PointerToLinenumbers,sectionHeader->NumberOfRelocations,sectionHeader->NumberOfLinenumbers,sectionHeader->Characteristics);
  153.        
  154.         sectionHeader++;
  155.     }
  156.     printf("--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n");
  157.    
  158.    
  159.     //map the file
  160.     HANDLE hMappedFile = CreateFileMappingA(hFile, nullptr, PAGE_READONLY | SEC_IMAGE, 0, 0, nullptr);
  161.     if (!hMappedFile)
  162.         return gtfo("CreateFileMappingA");
  163.  
  164.     //map the sections appropriately
  165.     LPVOID fileMap = MapViewOfFile(hMappedFile, FILE_MAP_READ, 0, 0, 0);
  166.     if (!fileMap)
  167.         return gtfo("MapViewOfFile");
  168.  
  169.     IMAGE_DATA_DIRECTORY importDir = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
  170.     printf("\n --------------------------------------------------------------\n");
  171.     printf("|                  Import Directory                              |\n");
  172.     printf(" --------------------------------------------------------------\n");
  173.     //printf(" RVA: %08X\n", importDir.VirtualAddress);
  174.     //printf("Size: %08X\n\n", importDir.Size);
  175.  
  176.     if (!importDir.VirtualAddress || !importDir.Size)
  177.         return gtfo("No Import directory!");
  178.  
  179.     PIMAGE_IMPORT_DESCRIPTOR importDescriptor = PIMAGE_IMPORT_DESCRIPTOR(ULONG_PTR(fileMap) + importDir.VirtualAddress);
  180.     if (!IsBadReadPtr((char*)fileMap + importDir.VirtualAddress, 0x1000))
  181.     {
  182.        
  183.         for (; importDescriptor->FirstThunk; importDescriptor++)
  184.         {  
  185.             int numberOfimports = 0;
  186.            
  187.             printf("OriginalFirstThunk: %08X\n", importDescriptor->OriginalFirstThunk);
  188.             printf("     TimeDateStamp: %08X\n", importDescriptor->TimeDateStamp);
  189.             printf("    ForwarderChain: %08X\n", importDescriptor->ForwarderChain);
  190.            
  191.             if (!IsBadReadPtr((char*)fileMap + importDescriptor->Name, 0x1000))
  192.                 printf("              Name: %08X \"%s\"\n", importDescriptor->Name, (char*)fileMap + importDescriptor->Name);
  193.             else
  194.                 printf("              Name: %08X INVALID\n", importDescriptor->Name);
  195.             printf("        FirstThunk: %08X\n", importDescriptor->FirstThunk);
  196.  
  197.             PIMAGE_THUNK_DATA thunkData = PIMAGE_THUNK_DATA(ULONG_PTR(fileMap) + importDescriptor->FirstThunk);
  198.             for (; thunkData->u1.AddressOfData; thunkData++)
  199.             {
  200.                 numberOfimports++;
  201.                 ULONG_PTR rva = ULONG_PTR(thunkData) - ULONG_PTR(fileMap);
  202.  
  203.                 ULONG data = thunkData->u1.AddressOfData;
  204.                 if (data & IMAGE_ORDINAL_FLAG)
  205.                     printf("              Ordinal: %08X\n", data & ~IMAGE_ORDINAL_FLAG);
  206.                 else
  207.                 {
  208.                     PIMAGE_IMPORT_BY_NAME importByName = PIMAGE_IMPORT_BY_NAME(ULONG_PTR(fileMap) + data);
  209.                     if (!IsBadReadPtr(importByName, 0x1000))
  210.                         printf("             Function: %08X \"%s\"\n", data, (char*)importByName->Name);
  211.                     else
  212.                         printf("             Function: %08X INVALID\n", data);
  213.                 }
  214.             }
  215.             printf("    Numbers of imports: %d\n", numberOfimports);
  216.             numberOfimports = 0;
  217.             puts("");
  218.         }
  219.        
  220.        
  221.     }
  222.     else
  223.         puts("INVALID IMPORT DESCRIPTOR");
  224.  
  225.  
  226. }
  227.  
  228.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!