stub.cpp

来自「一些初级的网络编程」· C++ 代码 · 共 539 行 · 第 1/2 页

		if(bResource)
		{
			FillMemory(szRsrc, strlen((char*)szRsrc), 0);

			//CopyMemory(lpbDecompBuffer, (LPVOID)(pSecHdr->VirtualAddress + dwLoadAddress + gev.dwRVACompressedResourceSize), pSecHdr->Misc.VirtualSize - gev.dwRVACompressedResourceSize);
			CopyMemory(lpbDecompBuffer, (LPVOID)(pSecHdr->VirtualAddress + dwLoadAddress + gev.dwRVACompressedResourceSize), pSecHdr->SizeOfRawData - gev.dwRVACompressedResourceSize);
			
			if(gev.dwRVACompressedResourceSize != 0)
			{
				lpbResourceBuffer = (BYTE*)pfnGlobalAlloc(GPTR, gev.dwRVACompressedResourceSize);	
				CopyMemory(lpbResourceBuffer, (LPVOID)(pSecHdr->VirtualAddress + dwLoadAddress), gev.dwRVACompressedResourceSize);
			}
		}
		else
		{
			//CopyMemory(lpbDecompBuffer, (LPVOID)(pSecHdr->VirtualAddress + dwLoadAddress), pSecHdr->Misc.VirtualSize);
			CopyMemory(lpbDecompBuffer, (LPVOID)(pSecHdr->VirtualAddress + dwLoadAddress), pSecHdr->SizeOfRawData);
		}

		lpbDestination = (BYTE*)(dwLoadAddress + pSecHdr->VirtualAddress);
		pfnVirtualProtect(lpbDestination, pSecHdr->Misc.VirtualSize, PAGE_READWRITE, &dwOldProtect);

		aP_depack((PVOID)lpbDecompBuffer, (PVOID)lpbDestination);

		pfnVirtualProtect(lpbDestination, pSecHdr->Misc.VirtualSize, dwOldProtect, &dwOldProtect);
		pfnGlobalFree(lpbDecompBuffer);


		if(bResource)
		{
			// Copy unpacked resource's back to original location
			if(gev.dwRVACompressedResourceSize != 0)
			{
				pfnVirtualProtect(lpbDestination, pSecHdr->Misc.VirtualSize, PAGE_READWRITE, &dwOldProtect);
				CopyResources((PIMAGE_RESOURCE_DIRECTORY)lpbResourceBuffer, (PIMAGE_RESOURCE_DIRECTORY)lpbDestination);
				pfnVirtualProtect(lpbDestination, pSecHdr->Misc.VirtualSize, dwOldProtect, &dwOldProtect);
				pfnGlobalFree(lpbResourceBuffer);
			}
		}

		dwSecStart += sizeof(IMAGE_SECTION_HEADER);
	}

	// tweak number of sections so we can do multi decrypts ?!?!?
	pfnVirtualProtect(pNtHdr, sizeof(IMAGE_NT_HEADERS), PAGE_READWRITE, &dwOldProtect);
	pNtHdr->FileHeader.NumberOfSections--;
	pfnVirtualProtect(pNtHdr, sizeof(IMAGE_NT_HEADERS), dwOldProtect, &dwOldProtect);
}

inline void CopyResources(PIMAGE_RESOURCE_DIRECTORY pSourceRoot, PIMAGE_RESOURCE_DIRECTORY pDestinationRoot)
{
	PIMAGE_RESOURCE_DIRECTORY_ENTRY pSourceEntry;
	PIMAGE_RESOURCE_DIRECTORY_ENTRY pDestinationEntry;

	DWORD dwIconCount = 0;
	DWORD dwGroupIconCount = 0;

	int nDirectoryCount = pSourceRoot->NumberOfIdEntries + pSourceRoot->NumberOfNamedEntries;

	pSourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pSourceRoot + sizeof(IMAGE_RESOURCE_DIRECTORY));
	pDestinationEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pDestinationRoot + sizeof(IMAGE_RESOURCE_DIRECTORY));

	for(int i = 0; i < nDirectoryCount; i++)
	{
		if(pSourceEntry->DataIsDirectory)
		{
			PIMAGE_RESOURCE_DIRECTORY pSourceSubDirectory = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pSourceEntry->OffsetToDirectory + (DWORD)pSourceRoot);
			PIMAGE_RESOURCE_DIRECTORY pDestinationSubDirectory = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pDestinationEntry->OffsetToDirectory + (DWORD)pDestinationRoot);

			int nSubDirectoryCount = pSourceSubDirectory->NumberOfIdEntries + pSourceSubDirectory->NumberOfNamedEntries;

			PIMAGE_RESOURCE_DIRECTORY_ENTRY pSourceSubEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pSourceSubDirectory + sizeof(IMAGE_RESOURCE_DIRECTORY));
			PIMAGE_RESOURCE_DIRECTORY_ENTRY pDestinationSubEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pDestinationSubDirectory + sizeof(IMAGE_RESOURCE_DIRECTORY));

			for(int j = 0; j < nSubDirectoryCount; j++)
			{
				if(pSourceSubEntry->DataIsDirectory)
				{
					PIMAGE_RESOURCE_DIRECTORY pSourceSubSubDirectory = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pSourceSubEntry->OffsetToDirectory + (DWORD)pSourceRoot);
					PIMAGE_RESOURCE_DIRECTORY pDestinationSubSubDirectory = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pDestinationSubEntry->OffsetToDirectory + (DWORD)pDestinationRoot);

					int nSubSubDirectoryCount = pSourceSubSubDirectory->NumberOfIdEntries + pSourceSubSubDirectory->NumberOfNamedEntries;

					PIMAGE_RESOURCE_DIRECTORY_ENTRY pSourceSubSubEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pSourceSubSubDirectory + sizeof(IMAGE_RESOURCE_DIRECTORY));
					PIMAGE_RESOURCE_DIRECTORY_ENTRY pDestinationSubSubEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pDestinationSubSubDirectory + sizeof(IMAGE_RESOURCE_DIRECTORY));

					for(int k = 0; k < nSubSubDirectoryCount; k++)
					{
						if(!(pSourceSubSubEntry->OffsetToData & 0x8000000))
						{
							PIMAGE_RESOURCE_DATA_ENTRY 	pSourceDataEntry = (PIMAGE_RESOURCE_DATA_ENTRY)((DWORD)pSourceRoot + pSourceSubSubEntry->OffsetToData);
							PIMAGE_RESOURCE_DATA_ENTRY 	pDestinationDataEntry = (PIMAGE_RESOURCE_DATA_ENTRY)((DWORD)pDestinationRoot + pDestinationSubSubEntry->OffsetToData);

							switch(pSourceEntry->Name)
							{
							case RT_ICON:
								if(dwIconCount < gev.dwFirstGroupIconCount)
								{
									DWORD dwTemp = pSourceDataEntry->OffsetToData - ((DWORD)pDestinationRoot - dwLoadAddress);
									CopyMemory((LPVOID)(pDestinationDataEntry->OffsetToData + dwLoadAddress), (LPVOID)(dwTemp + (DWORD)pSourceRoot), pSourceDataEntry->Size);

									dwIconCount++;
								}
								break;
							case RT_GROUP_ICON:
								if(dwGroupIconCount < 1)
								{
									DWORD dwTemp = pSourceDataEntry->OffsetToData - ((DWORD)pDestinationRoot - dwLoadAddress);
									CopyMemory((LPVOID)(pDestinationDataEntry->OffsetToData + dwLoadAddress), (LPVOID)(dwTemp + (DWORD)pSourceRoot), pSourceDataEntry->Size);

									dwGroupIconCount++;
								}
								break;
							case RT_VERSION:
							case 24:	//RT_MANIFEST:
								DWORD dwTemp = pSourceDataEntry->OffsetToData - ((DWORD)pDestinationRoot - dwLoadAddress);
								CopyMemory((LPVOID)(pDestinationDataEntry->OffsetToData + dwLoadAddress), (LPVOID)(dwTemp + (DWORD)pSourceRoot), pSourceDataEntry->Size);
								break;
							}
						}

						pSourceSubSubEntry++;
						pDestinationSubSubEntry++;
					}
				}

				pSourceSubEntry++;
				pDestinationSubEntry++;
			}
		}

		pSourceEntry++;
		pDestinationEntry++;
	}
}

extern "C" void NTAPI TlsCallback(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
	if(fSafeToCallback)
	{
		PIMAGE_TLS_CALLBACK* ppfn = (PIMAGE_TLS_CALLBACK*)gev.tlsOriginal.AddressOfCallBacks;

		if(ppfn)
		{
			while(*ppfn)
			{
				(*ppfn)(DllHandle, Reason, Reserved);
				++ppfn;
			}
		}
	}
	else
	{
		fDelayedTlsCallback = true;
		tlsDllHandle = DllHandle;
		tlsReason = Reason;
		tlsReserved = Reserved;
	}
}

inline void FinaliseTlsStuff()
{
	PIMAGE_DOS_HEADER pDosHdr;
	PIMAGE_NT_HEADERS pNtHdr;
	DWORD dwKatSup;
	LONG lJmp;

	pDosHdr = (PIMAGE_DOS_HEADER)dwLoadAddress;
	lJmp = pDosHdr->e_lfanew;
	dwKatSup = (DWORD)pDosHdr;
	dwKatSup += lJmp;

	pNtHdr = (PIMAGE_NT_HEADERS)dwKatSup;

	if(pNtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress != 0)
	{
		//gev.tlsOriginal.AddressOfIndex = dwTlsSlotIndex;
		gev.tlsOriginal.AddressOfIndex = (DWORD*)dwTlsSlotIndex;

		void* pvTlsData;
		
		__asm
		{
			mov ecx, DWORD PTR dwTlsSlotIndex;
			mov edx, DWORD PTR fs:[02ch]
			mov ecx, DWORD PTR [edx+ecx*4]
			mov pvTlsData, ecx
		}

		int size = gev.tlsOriginal.EndAddressOfRawData - gev.tlsOriginal.StartAddressOfRawData;

		CopyMemory(pvTlsData, (void*)gev.tlsOriginal.StartAddressOfRawData, size);
		FillMemory((void*)gev.tlsOriginal.EndAddressOfRawData, gev.tlsOriginal.SizeOfZeroFill, 0);
	}

	fSafeToCallback = true;

	if(fDelayedTlsCallback)
	{
		TlsCallback(tlsDllHandle, tlsReason, tlsReserved);
	}
}

inline void GetLoadAddress()
{
	// calc load address, need to of decrypted GEV section first
	dwLoadAddress = (DWORD)StubEntryPoint - gev.dwRVAStubEntry;
}

inline void Jump()
{
	// jump to OEP and blank out global vars
	gev.dwOEP += dwLoadAddress;

	__asm push gev.dwOEP;
	FillMemory(&gev, sizeof(GLOBAL_EXTERNAL_VARS), 0);
	__asm ret;
}

inline void DecryptVars()
{
	// decrypt gev section
	DWORD dwUncompressedSize = (DWORD)&gev.tlsOriginal - (DWORD)&gev;;
	BYTE* lpbDecompBuffer = (BYTE*)&gev;
	BYTE* lpbDestination = (BYTE*)pfnGlobalAlloc(GPTR, dwUncompressedSize);

	aP_depack((PVOID)lpbDecompBuffer, (PVOID)lpbDestination);

	DWORD dwLength = (DWORD)&gev.tlsOriginal - (DWORD)&gev;
	CopyMemory(&gev, lpbDestination, dwLength);
	pfnGlobalFree(lpbDestination);
}

inline void CheckDebugger()
{
	if(pfnIsDebugerPresent() == TRUE)
	{
		pfnExitProcess(0);
	}
}

inline void SetupFuncs()
{
	HMODULE hMod = LoadLibrary(StringDecrypt(szKernel32));
	FillMemory(szKernel32, strlen((char*)szKernel32), 0);
	
	pfnGlobalAlloc = (PFNGLOBALALLOC)GetProcAddress(hMod, StringDecrypt(szGlobalAlloc));
	FillMemory(szGlobalAlloc, strlen((char*)szGlobalAlloc), 0);

	pfnGlobalFree = (PFNGLOBALFREE)GetProcAddress(hMod, StringDecrypt(szGlobalFree));
	FillMemory(szGlobalFree, strlen((char*)szGlobalFree), 0);

	pfnIsDebugerPresent = (PFNISDEBUGGERPRESENT)GetProcAddress(hMod, StringDecrypt(szIsDebuggerPresent));
	FillMemory(szIsDebuggerPresent, strlen((char*)szIsDebuggerPresent), 0);

	pfnExitProcess = (PFNEXITPROCESS)GetProcAddress(hMod, StringDecrypt(szExitProcess));
	FillMemory(szExitProcess, strlen((char*)szExitProcess), 0);

	pfnVirtualProtect = (PFNVIRTUALPROTECT)GetProcAddress(hMod, StringDecrypt(szVirtualProtect));
	FillMemory(szVirtualProtect, strlen((char*)szVirtualProtect), 0);
}

char* StringDecrypt(unsigned char* source)
{	
	// use Tiny Encryption Algorithm (TEA) to protect internal strings
	DecryptData_TEA(source, strlen((char*)source), (char*)szKey);
	return (char*)source;
}