mirror of
https://github.com/rbmm/SC
synced 2026-06-08 17:03:41 +00:00
rbmm
1164 lines
22 KiB
C++
1164 lines
22 KiB
C++
#include "stdafx.h"
|
|
#include "compressapi.h"
|
|
|
|
void PrintUTF8(PCSTR pcsz, ULONG len)
|
|
{
|
|
HANDLE hFile = GetStdHandle(STD_OUTPUT_HANDLE);
|
|
|
|
switch ((ULONG_PTR)hFile)
|
|
{
|
|
case 0:
|
|
case (ULONG_PTR)INVALID_HANDLE_VALUE:
|
|
return;
|
|
}
|
|
|
|
WriteFile(hFile, pcsz, len, &len, 0);
|
|
}
|
|
|
|
inline void PrintUTF8(PCSTR pcsz)
|
|
{
|
|
PrintUTF8(pcsz, (ULONG)strlen(pcsz));
|
|
}
|
|
|
|
void PrintUTF8_v(PCSTR format, ...)
|
|
{
|
|
va_list ap;
|
|
va_start(ap, format);
|
|
|
|
PSTR buf = 0;
|
|
int len = 0;
|
|
while (0 < (len = _vsnprintf(buf, len, format, ap)))
|
|
{
|
|
if (buf)
|
|
{
|
|
PrintUTF8(buf, len);
|
|
break;
|
|
}
|
|
|
|
buf = (PSTR)alloca(++len);
|
|
}
|
|
}
|
|
|
|
#define DbgPrint PrintUTF8_v
|
|
|
|
HRESULT PrintError(HRESULT dwError)
|
|
{
|
|
LPCVOID lpSource = 0;
|
|
ULONG dwFlags = FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_IGNORE_INSERTS;
|
|
|
|
if ((dwError & FACILITY_NT_BIT) || (0 > dwError && HRESULT_FACILITY(dwError) == FACILITY_NULL))
|
|
{
|
|
dwError &= ~FACILITY_NT_BIT;
|
|
__nt:
|
|
dwFlags = FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_IGNORE_INSERTS;
|
|
|
|
lpSource = GetModuleHandle(L"ntdll");
|
|
}
|
|
|
|
PSTR lpText;
|
|
if (ULONG cch = FormatMessageA(dwFlags, lpSource, dwError, 0, (PSTR)&lpText, 0, 0))
|
|
{
|
|
PrintUTF8(lpText, cch);
|
|
LocalFree(lpText);
|
|
}
|
|
else if (dwFlags & FORMAT_MESSAGE_FROM_SYSTEM)
|
|
{
|
|
goto __nt;
|
|
}
|
|
|
|
DbgPrint("0x%x (%d)\r\n", dwError, dwError);
|
|
return dwError;
|
|
}
|
|
|
|
NTSTATUS ReadFromFile(_In_ PCWSTR lpFileName,
|
|
_Out_ PBYTE* ppb,
|
|
_Out_ ULONG* pcb,
|
|
_In_opt_ ULONG cbBefore = 0,
|
|
_In_opt_ ULONG cbAfter = 0)
|
|
{
|
|
UNICODE_STRING ObjectName;
|
|
NTSTATUS status = RtlDosPathNameToNtPathName_U_WithStatus(lpFileName, &ObjectName, 0, 0);
|
|
|
|
DbgPrint("DosPathNameToNt(\"%ws\") = %x\r\n", lpFileName, status);
|
|
|
|
if (0 <= status)
|
|
{
|
|
HANDLE hFile;
|
|
OBJECT_ATTRIBUTES oa = { sizeof(oa), 0, &ObjectName, OBJ_CASE_INSENSITIVE };
|
|
IO_STATUS_BLOCK iosb;
|
|
status = NtOpenFile(&hFile, FILE_GENERIC_READ, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);
|
|
|
|
DbgPrint("NtOpenFile(\"%wZ\") = %x\r\n", &ObjectName, status);
|
|
|
|
RtlFreeUnicodeString(&ObjectName);
|
|
|
|
if (0 <= status)
|
|
{
|
|
FILE_STANDARD_INFORMATION fsi;
|
|
if (0 <= (status = NtQueryInformationFile(hFile, &iosb, &fsi, sizeof(fsi), FileStandardInformation)))
|
|
{
|
|
DbgPrint("FileSize=%I64u\r\n", fsi.EndOfFile.QuadPart);
|
|
|
|
if (fsi.EndOfFile.QuadPart < 0x1000000)
|
|
{
|
|
if (PBYTE pb = new BYTE[cbBefore + fsi.EndOfFile.LowPart + cbAfter])
|
|
{
|
|
if (0 > (status = NtReadFile(hFile, 0, 0, 0, &iosb, pb + cbBefore, fsi.EndOfFile.LowPart, 0, 0)))
|
|
{
|
|
delete[] pb;
|
|
}
|
|
else
|
|
{
|
|
*ppb = pb;
|
|
*pcb = (ULONG)iosb.Information;
|
|
}
|
|
|
|
DbgPrint("NtReadFile=%x\r\n", status);
|
|
}
|
|
else
|
|
{
|
|
status = STATUS_NO_MEMORY;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
status = STATUS_FILE_TOO_LARGE;
|
|
}
|
|
}
|
|
|
|
NtClose(hFile);
|
|
}
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
NTSTATUS SaveToFile(_In_ PCWSTR lpFileName, _In_ const void* lpBuffer, _In_ ULONG nNumberOfBytesToWrite)
|
|
{
|
|
UNICODE_STRING ObjectName;
|
|
NTSTATUS status = RtlDosPathNameToNtPathName_U_WithStatus(lpFileName, &ObjectName, 0, 0);
|
|
|
|
DbgPrint("DosPathNameToNt(\"%ws\") = %x\r\n", lpFileName, status);
|
|
|
|
if (0 <= status)
|
|
{
|
|
HANDLE hFile;
|
|
IO_STATUS_BLOCK iosb;
|
|
OBJECT_ATTRIBUTES oa = { sizeof(oa), 0, &ObjectName, OBJ_CASE_INSENSITIVE };
|
|
|
|
LARGE_INTEGER AllocationSize = { nNumberOfBytesToWrite };
|
|
|
|
status = NtCreateFile(&hFile, FILE_APPEND_DATA | SYNCHRONIZE, &oa, &iosb, &AllocationSize,
|
|
0, 0, FILE_OVERWRITE_IF, FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE, 0, 0);
|
|
|
|
DbgPrint("CreateFile(\"%wZ\") = %x\r\n", &ObjectName, status);
|
|
|
|
RtlFreeUnicodeString(&ObjectName);
|
|
|
|
if (0 <= status)
|
|
{
|
|
status = NtWriteFile(hFile, 0, 0, 0, &iosb, const_cast<void*>(lpBuffer), nNumberOfBytesToWrite, 0, 0);
|
|
NtClose(hFile);
|
|
DbgPrint("WriteFile(%x) = %x\r\n", nNumberOfBytesToWrite, status);
|
|
}
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
struct IMP_HELP
|
|
{
|
|
PVOID _M_hmod;
|
|
PIMAGE_IMPORT_DESCRIPTOR _M_piid;
|
|
|
|
void** _M_pFunction = 0;
|
|
PIMAGE_THUNK_DATA _M_pThunk = 0;
|
|
|
|
ULONG _M_n;
|
|
|
|
char _M_buf[32];
|
|
|
|
PCSTR GetName(ULONG rva);
|
|
|
|
BOOL Init(PVOID hmod);
|
|
|
|
NTSTATUS ProcessMAP(
|
|
PCWSTR pszImp,
|
|
PSTR pcsz,
|
|
ULONG iSection,
|
|
ULONG ofs,
|
|
ULONG_PTR Va,
|
|
ULONG s);
|
|
|
|
NTSTATUS ProcessMAP(
|
|
PCWSTR pszImp,
|
|
PCWSTR pszMap,
|
|
ULONG iSection,
|
|
ULONG ofs,
|
|
ULONG_PTR Va,
|
|
ULONG s);
|
|
|
|
PCSTR GetName(ULONG rva, DWORD FirstThunk, void** pFunction, PIMAGE_THUNK_DATA pThunk);
|
|
};
|
|
|
|
BOOL IMP_HELP::Init(PVOID hmod)
|
|
{
|
|
ULONG s;
|
|
if (PIMAGE_IMPORT_DESCRIPTOR piid = (PIMAGE_IMPORT_DESCRIPTOR)RtlImageDirectoryEntryToData(
|
|
hmod, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &s))
|
|
{
|
|
if (s /= sizeof(IMAGE_IMPORT_DESCRIPTOR))
|
|
{
|
|
_M_n = s, _M_piid = piid, _M_hmod = hmod;
|
|
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
PCSTR IMP_HELP::GetName(ULONG rva, DWORD FirstThunk, void** pFunction, PIMAGE_THUNK_DATA pThunk)
|
|
{
|
|
while (void* Function = *pFunction++)
|
|
{
|
|
IMAGE_THUNK_DATA Thunk = *pThunk++;
|
|
|
|
if (rva == FirstThunk)
|
|
{
|
|
_M_pFunction = pFunction;
|
|
_M_pThunk = pThunk;
|
|
|
|
if (IMAGE_SNAP_BY_ORDINAL(Thunk.u1.Ordinal))
|
|
{
|
|
if (0 < sprintf_s(_M_buf, _countof(_M_buf), "#%u", (ULONG)IMAGE_ORDINAL(Thunk.u1.Ordinal)))
|
|
{
|
|
return _M_buf;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
return (PCSTR)reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
|
|
RtlOffsetToPointer(_M_hmod, Thunk.u1.AddressOfData))->Name;
|
|
}
|
|
|
|
FirstThunk += sizeof(PVOID);
|
|
}
|
|
|
|
_M_pFunction = 0;
|
|
_M_pThunk = 0;
|
|
return 0;
|
|
}
|
|
|
|
PCSTR GetNameFormat(PCSTR str, PCSTR name, ULONG* pn)
|
|
{
|
|
*pn = 0;
|
|
if (strcmp(name, str))
|
|
{
|
|
#ifdef _X86_
|
|
BOOL f = FALSE;
|
|
switch (*name++)
|
|
{
|
|
case '@':
|
|
f = TRUE;
|
|
case '_':
|
|
if (PCSTR pc = strchr(name, '@'))
|
|
{
|
|
if (!memcmp(name, str, pc - name))
|
|
{
|
|
ULONG n = strtoul(pc + 1, const_cast<PSTR*>(&pc), 10);
|
|
if (!*pc && !(n & 3))
|
|
{
|
|
*pn = n;
|
|
// __fastcall : __stdcall
|
|
return f ? "createFuncF %hs, %hs, %u\r\n" : "createFuncS %hs, %hs, %u\r\n";
|
|
}
|
|
}
|
|
}
|
|
else if (!strcmp(name, str))
|
|
{
|
|
// __cdecl
|
|
return "createFuncC %hs, %hs\r\n";
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
// name == str
|
|
return "createFunc %hs, %hs\r\n";
|
|
}
|
|
|
|
PCSTR IMP_HELP::GetName(ULONG rva)
|
|
{
|
|
PVOID hmod = _M_hmod;
|
|
ULONG n = _M_n;
|
|
PIMAGE_IMPORT_DESCRIPTOR piid = _M_piid;
|
|
|
|
if (void** pFunction = _M_pFunction)
|
|
{
|
|
if (PCSTR name = GetName(rva, RtlPointerToOffset(hmod, pFunction), pFunction, _M_pThunk))
|
|
{
|
|
return name;
|
|
}
|
|
}
|
|
|
|
do
|
|
{
|
|
DWORD Name = piid->Name;
|
|
|
|
if (!Name)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
if (DWORD FirstThunk = piid->FirstThunk)
|
|
{
|
|
if (rva < FirstThunk)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
if (DWORD OriginalFirstThunk = piid->OriginalFirstThunk)
|
|
{
|
|
if (PCSTR name = GetName(rva, FirstThunk,
|
|
(void**)RtlOffsetToPointer(hmod, FirstThunk),
|
|
(PIMAGE_THUNK_DATA)RtlOffsetToPointer(hmod, OriginalFirstThunk)))
|
|
{
|
|
return name;
|
|
}
|
|
}
|
|
}
|
|
|
|
} while (piid++, --n);
|
|
|
|
return 0;
|
|
}
|
|
|
|
NTSTATUS IMP_HELP::ProcessMAP(
|
|
PCWSTR pszImp,
|
|
PSTR pcsz,
|
|
ULONG iSection,
|
|
ULONG ofs,
|
|
ULONG_PTR Va,
|
|
ULONG s)
|
|
{
|
|
PSTR buf = pcsz, psz = buf;
|
|
|
|
ULONG64 u;
|
|
BOOL f = FALSE;
|
|
ULONG_PTR ImageBase = 0;
|
|
__0:
|
|
|
|
PSTR pcszLine = pcsz;
|
|
|
|
static const char plai[] = " Preferred load address is ";
|
|
|
|
//while (!IsDebuggerPresent()) Sleep(1000); __debugbreak();
|
|
|
|
if (!f && !memcmp(pcsz, plai, _countof(plai) - 1))
|
|
{
|
|
if (ImageBase)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
u = _strtoui64(pcsz + _countof(plai) - 1, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (!u || '\r' != *pcsz++ || '\n' != *pcsz++)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
ImageBase = (ULONG_PTR)u;
|
|
Va += ImageBase;
|
|
|
|
DbgPrint("ImageBase = %p, Va = %p\r\n", ImageBase, Va);
|
|
|
|
goto __0;
|
|
}
|
|
|
|
ULONG i = strtoul(pcsz, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (':' != *pcsz)
|
|
{
|
|
__1:
|
|
if (!(pcsz = strchr(pcsz, '\r')) || '\n' != *++pcsz)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
++pcsz;
|
|
goto __0;
|
|
}
|
|
|
|
if (i != iSection)
|
|
{
|
|
goto __1;
|
|
}
|
|
|
|
i = strtoul(pcsz + 1, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (' ' != *pcsz)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
if (i != ofs)
|
|
{
|
|
goto __1;
|
|
}
|
|
|
|
if (f)
|
|
{
|
|
pcsz = pcszLine;
|
|
}
|
|
else
|
|
{
|
|
i = strtoul(pcsz + 1, &pcsz, 16);
|
|
|
|
if ('H' != *pcsz || s != i)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
f = TRUE;
|
|
goto __1;
|
|
}
|
|
|
|
//////////////////////////////////////////////////////////////////////////
|
|
|
|
NTSTATUS status;
|
|
|
|
__loop:
|
|
|
|
i = strtoul(pcsz, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (':' != *pcsz || iSection != i)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
i = strtoul(pcsz + 1, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (' ' != *pcsz || ofs != i)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
ofs += sizeof(PVOID);
|
|
BOOL __imp_ = FALSE;
|
|
|
|
__space:
|
|
switch (*pcsz++)
|
|
{
|
|
case ' ':
|
|
goto __space;
|
|
|
|
default:
|
|
return STATUS_BAD_DATA;
|
|
|
|
case '_':
|
|
if (memcmp(pcsz, "_imp_", 5))
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
pcsz += 5;
|
|
__imp_ = TRUE;
|
|
|
|
case '\\':
|
|
INT k = -1;
|
|
|
|
PCSTR name = pcsz;
|
|
|
|
while (' ' < *pcsz) pcsz++;
|
|
|
|
*pcsz++ = 0;
|
|
|
|
if (!strcmp(name, "__chkstk") || !strcmp(name, "__alloca_probe"))
|
|
{
|
|
DbgPrint("!!!! %hs\\%hs imported !!!!!\r\n", "__chkstk", "__alloca_probe");
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
u = _strtoui64(pcsz, const_cast<char**>(&pcsz), 16);
|
|
|
|
if (Va != u)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
Va += sizeof(PVOID);
|
|
|
|
PCSTR pszLib = 0;
|
|
|
|
__00:
|
|
switch (*pcsz)
|
|
{
|
|
case 0:
|
|
return STATUS_BAD_DATA;
|
|
case ':':
|
|
*pcsz++ = 0;
|
|
goto __01;
|
|
default:
|
|
if (!pszLib)
|
|
{
|
|
pszLib = pcsz;
|
|
}
|
|
case ' ':
|
|
pcsz++;
|
|
goto __00;
|
|
}
|
|
__01:
|
|
|
|
PCSTR pszDLL = pcsz;
|
|
|
|
__02:
|
|
switch (*pcsz++)
|
|
{
|
|
case 0:
|
|
case ':':
|
|
return STATUS_BAD_DATA;
|
|
default:
|
|
goto __02;
|
|
case '\r':
|
|
pcsz[-1] = 0;
|
|
break;
|
|
}
|
|
|
|
if ('\n' != *pcsz++)
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
|
|
ULONG cb = RtlPointerToOffset(psz, name);
|
|
|
|
if (__imp_)
|
|
{
|
|
__imp_ = FALSE;
|
|
|
|
if (PCSTR str = GetName((ULONG)(u - ImageBase)))
|
|
{
|
|
ULONG np;
|
|
if (PCSTR fmt = GetNameFormat(str, name, &np))
|
|
{
|
|
k = sprintf_s(psz, cb, fmt, pszLib, str, np);
|
|
}
|
|
else
|
|
{
|
|
k = sprintf_s(psz, cb, "createFunc? %hs, %hs, '%hs'\r\n", pszLib, name, str);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (!_stricmp(pszDLL, "ntdll.dll"))
|
|
{
|
|
pszDLL = "";
|
|
}
|
|
|
|
k = sprintf_s(psz, cb, "\r\nHMOD %hs, <%hs>\r\n\r\n", pszLib, pszDLL);
|
|
}
|
|
|
|
if (0 >= k)
|
|
{
|
|
return STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
psz += k;
|
|
|
|
if (s -= sizeof(PVOID))
|
|
{
|
|
goto __loop;
|
|
}
|
|
|
|
status = SaveToFile(pszImp, buf, RtlPointerToOffset(buf, psz));
|
|
return 0 > status ? status : STATUS_MORE_PROCESSING_REQUIRED;
|
|
}
|
|
}
|
|
|
|
NTSTATUS IMP_HELP::ProcessMAP(
|
|
PCWSTR pszImp,
|
|
PCWSTR pszMap,
|
|
ULONG iSection,
|
|
ULONG ofs,
|
|
ULONG_PTR Va,
|
|
ULONG s)
|
|
{
|
|
PBYTE pb;
|
|
ULONG cb;
|
|
|
|
DbgPrint("ProcessMAP(%04x:%08x %p [%x])...\r\n", iSection, ofs, Va, s);
|
|
|
|
NTSTATUS status = ReadFromFile(pszMap, &pb, &cb, 0, 1);
|
|
|
|
if (0 <= status)
|
|
{
|
|
pb[cb - 1] = 0;
|
|
status = ProcessMAP(pszImp, (PSTR)pb, iSection, ofs, Va, s);
|
|
delete[] pb;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
NTSTATUS ProcessIAT(PCWSTR pszImp, PCWSTR pszMap, ULONG_PTR pvShellEnd)
|
|
{
|
|
if (PVOID hmod = GetModuleHandleW(0))
|
|
{
|
|
ULONG s;
|
|
|
|
union {
|
|
PVOID pv;
|
|
PBYTE pb;
|
|
PIMAGE_BASE_RELOCATION pibr;
|
|
};
|
|
|
|
if (pv = RtlImageDirectoryEntryToData(hmod, TRUE, IMAGE_DIRECTORY_ENTRY_IAT, &s))
|
|
{
|
|
DbgPrint("IAT: %p [%x]\r\n", pv, s);
|
|
|
|
if (!s || (s & (sizeof(PVOID) - 1)))
|
|
{
|
|
return STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
if (PIMAGE_NT_HEADERS pinth = RtlImageNtHeader(hmod))
|
|
{
|
|
if (ULONG NumberOfSections = pinth->FileHeader.NumberOfSections)
|
|
{
|
|
ULONG_PTR Rva = (ULONG_PTR)pv - (ULONG_PTR)hmod;
|
|
|
|
ULONG iSection = 0;
|
|
PIMAGE_SECTION_HEADER pish = IMAGE_FIRST_SECTION(pinth);
|
|
do
|
|
{
|
|
++iSection;
|
|
|
|
ULONG_PTR Ofs = Rva - pish->VirtualAddress;
|
|
|
|
if (Ofs < pish->Misc.VirtualSize)
|
|
{
|
|
if (Ofs + s <= pish->Misc.VirtualSize)
|
|
{
|
|
IMP_HELP imh;
|
|
if (imh.Init(hmod))
|
|
{
|
|
return imh.ProcessMAP(pszImp, pszMap, iSection, (ULONG)Ofs, Rva, s);
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
} while (pish++, --NumberOfSections);
|
|
}
|
|
}
|
|
|
|
return STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
if (pv = RtlImageDirectoryEntryToData(hmod, TRUE, IMAGE_DIRECTORY_ENTRY_BASERELOC, &s))
|
|
{
|
|
pvShellEnd -= (ULONG_PTR)hmod;
|
|
|
|
#ifdef _X86_
|
|
BOOL bFirst = TRUE;
|
|
PVOID pvTarget = 0;
|
|
#endif // _X86_
|
|
|
|
do
|
|
{
|
|
ULONG SizeOfBlock = pibr->SizeOfBlock;
|
|
|
|
if (SizeOfBlock < sizeof(IMAGE_BASE_RELOCATION))
|
|
{
|
|
return STATUS_INVALID_IMAGE_FORMAT;
|
|
}
|
|
|
|
ULONG VirtualAddress = pibr->VirtualAddress;
|
|
|
|
struct TYPE_OFFSET
|
|
{
|
|
WORD ofs : 12;
|
|
WORD type : 4;
|
|
}*pu = (TYPE_OFFSET*)(pibr + 1);
|
|
|
|
pb += SizeOfBlock, s -= SizeOfBlock, SizeOfBlock -= sizeof(IMAGE_BASE_RELOCATION);
|
|
|
|
if (SizeOfBlock & (sizeof(WORD) - 1))
|
|
{
|
|
return STATUS_INVALID_IMAGE_FORMAT;
|
|
}
|
|
|
|
SizeOfBlock >>= 1;
|
|
|
|
do
|
|
{
|
|
if (pu->type)
|
|
{
|
|
//DbgPrint("\t## %x %08x\r\n", pu->type, VirtualAddress + pu->ofs);
|
|
|
|
if (VirtualAddress + pu->ofs < pvShellEnd)
|
|
{
|
|
ULONG rva = VirtualAddress + pu->ofs;
|
|
union {
|
|
PVOID prv;
|
|
PBYTE prb;
|
|
PULONG pru;
|
|
};
|
|
prv = RtlOffsetToPointer(hmod, rva);
|
|
|
|
#ifdef _X86_
|
|
|
|
if (IMAGE_REL_BASED_HIGHLOW == pu->type)
|
|
{
|
|
ULONG Target = *pru - (ULONG)hmod;
|
|
DbgPrint("!! Exist Relocs: %08x -> %08x\r\n", rva, Target);
|
|
|
|
// while (!IsDebuggerPresent()) Sleep(1000); __debugbreak();
|
|
if (pvShellEnd <= Target)
|
|
{
|
|
DbgPrint("reloc to %08x beyond shell end (%08x)\r\n", Target, pvShellEnd);
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
|
|
if (bFirst)
|
|
{
|
|
bFirst = FALSE;
|
|
if (Target + 8 != rva)
|
|
{
|
|
DbgPrint("_Target(%p) + 8 != rva(%x)\r\n", Target, rva);
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
|
|
pvTarget = RtlOffsetToPointer(hmod, Target);
|
|
|
|
DbgPrint("__Address: %p\r\n", pvTarget);
|
|
}
|
|
else
|
|
{
|
|
CHAR msg[0x80];
|
|
ULONG cch = _countof(msg);
|
|
if (CryptBinaryToStringA((PBYTE)*pru, 16, CRYPT_STRING_HEXASCII, msg, &cch))
|
|
{
|
|
DbgPrint("\t%hs\r\n", msg);
|
|
}
|
|
#if 0
|
|
// mov ecx,offset x
|
|
if (0xb9 != prb[-1])
|
|
{
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
++pru;
|
|
|
|
// call __Address;
|
|
if (0xe8 != *prb++)
|
|
{
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
|
|
ULONG ofs = *pru++;
|
|
|
|
DbgPrint("call %p (%p + %08x)\r\n", prb + ofs, prb, ofs);
|
|
|
|
if (prb + ofs != pvTarget)
|
|
{
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
#endif // 0
|
|
}
|
|
}
|
|
else
|
|
#endif // _X86_
|
|
{
|
|
DbgPrint("######## !! Exist Relocs (%x:%08x) !! ########\r\n", pu->type, rva);
|
|
return STATUS_ILLEGAL_DLL_RELOCATION;
|
|
}
|
|
}
|
|
}
|
|
} while (pu++, --SizeOfBlock);
|
|
|
|
} while (s);
|
|
}
|
|
|
|
DbgPrint("!! NO IMPORT, NO RELOCS. OK !!\r\n");
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
return STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
NTSTATUS I_CreateAsmSC(PCWSTR pwzFileName, const void* pcv, SIZE_T cb)
|
|
{
|
|
NTSTATUS status;
|
|
|
|
union {
|
|
const void* pv;
|
|
PULONG64 pu64;
|
|
PULONG pu;
|
|
PUSHORT ps;
|
|
PUCHAR pb;
|
|
};
|
|
|
|
pv = pcv;
|
|
|
|
SIZE_T n = cb >> 3;
|
|
SIZE_T cch = n * (7 + 16) + 36;
|
|
// DD 0ABCDEF78h.. ; 7+8
|
|
// DW 0ABCDh.. ; 7+4
|
|
// DB 0ABh.. ; 7+2
|
|
|
|
if (PSTR buf = new char [cch])
|
|
{
|
|
status = STATUS_INTERNAL_ERROR;
|
|
|
|
int len;
|
|
ULONG s = 4;
|
|
|
|
PSTR psz = buf;
|
|
|
|
if (n)
|
|
{
|
|
cb -= n << 3;
|
|
|
|
do
|
|
{
|
|
if (0 >= (len = sprintf_s(psz, cch, "DQ 0%016I64xh\r\n", *pu64++)))
|
|
{
|
|
goto __exit;
|
|
}
|
|
|
|
} while (psz += len, cch -= len, --n);
|
|
}
|
|
|
|
static const PCSTR fmt[] = { "DB 0%02xh\r\n", "DW 0%04xh\r\n", "DD 0%08xh\r\n" };
|
|
n = _countof(fmt) - 1;
|
|
|
|
do
|
|
{
|
|
if (s <= cb)
|
|
{
|
|
cb -= s;
|
|
|
|
if (0 >= (len = sprintf_s(psz, cch, fmt[n], *pu & ((1ULL << (s << 3)) - 1))))
|
|
{
|
|
goto __exit;
|
|
}
|
|
|
|
psz += len, cch -= len, pb += s;
|
|
}
|
|
|
|
} while (s >>= 1, n--);
|
|
|
|
status = SaveToFile(pwzFileName, buf, RtlPointerToOffset(buf, psz));
|
|
|
|
__exit:
|
|
delete[] buf;
|
|
|
|
DbgPrint("CreateAsmSC(%ws)=%x\r\n", pwzFileName, status);
|
|
|
|
return status;
|
|
}
|
|
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
inline ULONG BOOL_TO_ERROR(BOOL f)
|
|
{
|
|
return f ? NOERROR : GetLastError();
|
|
}
|
|
|
|
//## -> #
|
|
//#. -> *
|
|
//#: -> %
|
|
|
|
BOOL UnEscape(_Inout_ PWSTR str)
|
|
{
|
|
PWSTR buf = str;
|
|
WCHAR c;
|
|
do
|
|
{
|
|
if ('#' == (c = *str++))
|
|
{
|
|
switch (c = *str++)
|
|
{
|
|
case '.':
|
|
c = '*';
|
|
break;
|
|
case ':':
|
|
c = '%';
|
|
break;
|
|
case '#':
|
|
break;
|
|
default:
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
*buf++ = c;
|
|
|
|
} while (c);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
NTSTATUS CreateAesKey(_Out_ BCRYPT_KEY_HANDLE* phKey, _In_ PBYTE secret, _In_ ULONG cb)
|
|
{
|
|
NTSTATUS status;
|
|
BCRYPT_ALG_HANDLE hAlgorithm;
|
|
if (0 <= (status = BCryptOpenAlgorithmProvider(&hAlgorithm, BCRYPT_AES_ALGORITHM, 0, 0)))
|
|
{
|
|
status = BCryptGenerateSymmetricKey(hAlgorithm, phKey, 0, 0, secret, cb, 0);
|
|
|
|
BCryptCloseAlgorithmProvider(hAlgorithm, 0);
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
NTSTATUS CreateAsmSC(PCWSTR to, PVOID pv, ULONG cb)
|
|
{
|
|
if (PWSTR psz = wcsrchr(to, '?'))
|
|
{
|
|
*psz++ = 0;
|
|
|
|
//while (!IsDebuggerPresent()) Sleep(100); __debugbreak();
|
|
if (!UnEscape(const_cast<PWSTR>(to)))
|
|
{
|
|
return STATUS_BAD_DATA;
|
|
}
|
|
DbgPrint("password: \"%ws\"\r\n", to);
|
|
|
|
BCRYPT_KEY_HANDLE hKey;
|
|
UCHAR secret[32];
|
|
ULONG s = sizeof(secret);
|
|
if (CryptHashCertificate2(BCRYPT_SHA256_ALGORITHM, 0, 0, (PBYTE)to, RtlPointerToOffset(to, psz), secret, &s))
|
|
{
|
|
NTSTATUS status = CreateAesKey(&hKey, secret, s);
|
|
|
|
if (0 <= status)
|
|
{
|
|
PBYTE pb = 0;
|
|
s = 0;
|
|
while (0 <= (status = BCryptEncrypt(hKey, (PBYTE)pv, cb, 0, 0, 0, pb, s, &s, BCRYPT_BLOCK_PADDING)))
|
|
{
|
|
if (pb)
|
|
{
|
|
DbgPrint("Encrypt: %x -> %x\r\n", cb, s);
|
|
status = I_CreateAsmSC(psz, pb, s);
|
|
break;
|
|
}
|
|
|
|
if (!(pb = new UCHAR[s]))
|
|
{
|
|
status = STATUS_NO_MEMORY;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (pb)
|
|
{
|
|
delete[] pb;
|
|
}
|
|
|
|
BCryptDestroyKey(hKey);
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
return GetLastError();
|
|
}
|
|
|
|
return I_CreateAsmSC(to, pv, cb);
|
|
}
|
|
|
|
NTSTATUS CreateZipAsmSC(PCWSTR to, PVOID pv, ULONG cb)
|
|
{
|
|
COMPRESSOR_HANDLE CompressorHandle;
|
|
if (CreateCompressor(COMPRESS_ALGORITHM_MSZIP, 0, &CompressorHandle))
|
|
{
|
|
ULONG dwError;
|
|
SIZE_T CompressedDataSize;
|
|
|
|
switch (dwError = BOOL_TO_ERROR(Compress(CompressorHandle, 0, cb, 0, 0, &CompressedDataSize)))
|
|
{
|
|
case NOERROR:
|
|
case ERROR_INSUFFICIENT_BUFFER:
|
|
if (PBYTE pb = new BYTE[CompressedDataSize])
|
|
{
|
|
if (Compress(CompressorHandle, pv, cb, pb, CompressedDataSize, &CompressedDataSize))
|
|
{
|
|
DbgPrint("Compress:%x >> %x [%u%%]\r\n", cb, CompressedDataSize, (CompressedDataSize * 100) / cb);
|
|
dwError = CreateAsmSC(to, pb, (ULONG)CompressedDataSize);
|
|
}
|
|
else
|
|
{
|
|
dwError = GetLastError();
|
|
}
|
|
|
|
delete[] pb;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
CloseCompressor(CompressorHandle);
|
|
|
|
return HRESULT_FROM_WIN32(dwError);
|
|
}
|
|
|
|
return GetLastError();
|
|
}
|
|
|
|
NTSTATUS CreateExeSC(PCWSTR pwzFileName, PVOID Base, ULONG cb, PVOID ImageBase)
|
|
{
|
|
struct PE
|
|
{
|
|
union {
|
|
UCHAR pad[0x200];
|
|
struct
|
|
{
|
|
IMAGE_DOS_HEADER idh;
|
|
IMAGE_NT_HEADERS inth;
|
|
IMAGE_SECTION_HEADER ish;
|
|
};
|
|
};
|
|
UCHAR text[];
|
|
|
|
void* operator new(size_t s, ULONG cb)
|
|
{
|
|
return RtlAllocateHeap(GetProcessHeap(), HEAP_ZERO_MEMORY, s + cb);
|
|
}
|
|
|
|
void operator delete(void* p)
|
|
{
|
|
RtlFreeHeap(GetProcessHeap(), 0, p);
|
|
}
|
|
};
|
|
|
|
if (PE* pe = new(cb) PE)
|
|
{
|
|
PIMAGE_NT_HEADERS pinth = RtlImageNtHeader(ImageBase);
|
|
|
|
memcpy(&pe->idh, ImageBase, sizeof(IMAGE_DOS_HEADER));
|
|
memcpy(&pe->inth, pinth, sizeof(IMAGE_NT_HEADERS));
|
|
|
|
pe->idh.e_lfanew = sizeof(IMAGE_DOS_HEADER);
|
|
pe->inth.FileHeader.NumberOfSections = 1;
|
|
pe->inth.FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER);
|
|
pe->inth.FileHeader.Characteristics &= ~IMAGE_FILE_DLL;
|
|
|
|
pe->inth.OptionalHeader.AddressOfEntryPoint = 0x1000;
|
|
pe->inth.OptionalHeader.SizeOfCode = cb;
|
|
pe->inth.OptionalHeader.BaseOfCode = 0x1000;
|
|
pe->inth.OptionalHeader.SizeOfInitializedData = 0;
|
|
pe->inth.OptionalHeader.SizeOfUninitializedData = 0;
|
|
pe->inth.OptionalHeader.SectionAlignment = 0x1000;
|
|
pe->inth.OptionalHeader.FileAlignment = 0x200;
|
|
pe->inth.OptionalHeader.SizeOfImage = ((cb + 0x1FFF) & ~0xFFF);
|
|
pe->inth.OptionalHeader.SizeOfHeaders = sizeof(PE);
|
|
pe->inth.OptionalHeader.CheckSum = 0;
|
|
pe->inth.OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
|
|
RtlZeroMemory(pe->inth.OptionalHeader.DataDirectory, sizeof(pe->inth.OptionalHeader.DataDirectory));
|
|
|
|
memcpy(pe->ish.Name, ".text\0\0", IMAGE_SIZEOF_SHORT_NAME);
|
|
pe->ish.Misc.VirtualSize = cb;
|
|
pe->ish.VirtualAddress = 0x1000;
|
|
pe->ish.SizeOfRawData = cb;
|
|
pe->ish.PointerToRawData = sizeof(PE);
|
|
pe->ish.Characteristics = IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;
|
|
|
|
memcpy(pe->text, Base, cb);
|
|
|
|
NTSTATUS status = SaveToFile(pwzFileName, pe, sizeof(PE) + cb);
|
|
|
|
delete pe;
|
|
|
|
DbgPrint("CreateExeSC(%ws)=%x\r\n", pwzFileName, status);
|
|
|
|
return status;
|
|
}
|
|
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
NTSTATUS NTAPI PrepareSC(PVOID Base, ULONG cb, PVOID ImageBase)
|
|
{
|
|
if (IsDebuggerPresent())
|
|
{
|
|
return VirtualProtect(Base, cb, PAGE_EXECUTE_READWRITE, &cb) ? 0 : RtlGetLastNtStatus();
|
|
}
|
|
|
|
DbgPrint("PrepareSC(%p, %x, <%ws>)\r\n", Base, cb, GetCommandLineW());
|
|
|
|
//*map*imp[*bin*[?[password?]]asm*exe]
|
|
|
|
if (PWSTR psz = wcschr(GetCommandLineW(), '*'))
|
|
{
|
|
PWSTR pczMap = ++psz;
|
|
|
|
if (psz = wcschr(psz, '*'))
|
|
{
|
|
*psz++ = 0;
|
|
PWSTR pczImp = psz, pczBin = 0, pczAsm = 0, pczExe = 0;
|
|
|
|
if (psz = wcschr(psz, '*'))
|
|
{
|
|
*psz++ = 0;
|
|
pczBin = psz;
|
|
|
|
if (psz = wcschr(psz, '*'))
|
|
{
|
|
*psz++ = 0;
|
|
pczAsm = psz;
|
|
|
|
if (psz = wcschr(psz, '*'))
|
|
{
|
|
*psz++ = 0;
|
|
pczExe = psz;
|
|
}
|
|
}
|
|
}
|
|
|
|
NTSTATUS status = ProcessIAT(pczImp, pczMap, (ULONG_PTR)Base + cb);
|
|
|
|
if (0 <= status)
|
|
{
|
|
if (pczBin && *pczBin)
|
|
{
|
|
status = SaveToFile(pczBin, Base, cb);
|
|
}
|
|
|
|
if (0 <= status)
|
|
{
|
|
if (pczAsm && *pczAsm)
|
|
{
|
|
status = '?' == *pczAsm ? CreateZipAsmSC(pczAsm + 1, Base, cb) : CreateAsmSC(pczAsm, Base, cb);
|
|
}
|
|
|
|
if (0 <= status)
|
|
{
|
|
if (pczExe && *pczExe)
|
|
{
|
|
status = CreateExeSC(pczExe, Base, cb, ImageBase);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return PrintError(status);
|
|
}
|
|
}
|
|
|
|
return PrintError(STATUS_INVALID_PARAMETER);
|
|
} |