作者: Simonzh2000[US]
感谢 too2y , 老王.
这是我在学习老王的壳后, 参考网上的一些例子做的。
比老王的壳差的太远, 希望各位不要见笑.
如果各位写出了类似的加壳器, 希望发一个给我。
启动前先启动 Calc.exe, 改一下, 用 Explorer.exe 也可以。
#define UNICODE
#define _UNICODE
#include <windows.h>
#include <tchar.h>
#include <conio.h>
#include <psapi.h>
typedef struct _remoteparameter
{
DWORD rpwinexec;
DWORD rpcreatemutex;
DWORD rpsleep;
DWORD rpclosehandle;
char rpwinexecname[MAX_PATH];
HANDLE rphMutex;
TCHAR rpMutex[30];
}REMOTEPARAMETER, *PREMOTEPARAMETER;
DWORD WINAPI remote(LPVOID);
DWORD processtopid(TCHAR*);
HANDLE createremote(PTSTR);
TCHAR cMutex[8];
int main()
{
TCHAR ExeName[MAX_PATH];
HANDLE hRemoteThread;
HANDLE hMutex;
int ret;
_tcscpy(cMutex,_T("simonzh"));
hMutex = OpenMutex(SYNCHRONIZE, TRUE, cMutex );
if (hMutex == NULL)
{
ret=GetModuleFileName(NULL,ExeName,MAX_PATH);
if(ret==0)
{
OutputDebugString(_T("GetModuleFileName Error/n"));
getche();
return -1;
}
if((hRemoteThread=createremote(ExeName))==NULL)
{
OutputDebugString(_T("CreateRemote Error/n"));
getche();
return -1;
}
return 0;
}
CloseHandle(hMutex);
// 上面相当于一个壳的 Loader
// 下面相当于被加壳的原程序.
_tprintf(_T("---[ This is not me. HaHaHa... ]---/n"));
getche();
return 0;
}
DWORD processtopid(TCHAR *processname)
{
DWORD lpidprocesses[1024],cbneeded,cprocesses;
HANDLE hprocess;
HMODULE hmodule;
UINT i;
TCHAR normalname[MAX_PATH]=_T("UnknownProcess");
if(!EnumProcesses(lpidprocesses,sizeof(lpidprocesses),&cbneeded))
{
OutputDebugString(_T("EnumProcesses Error/n"));
return -1;
}
cprocesses=cbneeded/sizeof(DWORD);
for(i=0;i<cprocesses;i++)
{
hprocess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,lpidprocesses[i]);
if(hprocess)
{
if(EnumProcessModules(hprocess,&hmodule,sizeof(hmodule),&cbneeded))
{
GetModuleBaseName(hprocess,hmodule,normalname,sizeof(normalname));
if(!_tcsicmp(normalname,processname))
{
CloseHandle(hprocess);
return (lpidprocesses[i]);
}
}
}
}
CloseHandle(hprocess);
return 0;
}
HANDLE createremote(PTSTR ExeName)
{
HANDLE ethread;
HANDLE rphandle;
TCHAR name[15];
TCHAR *remotethr;
TCHAR *remotepar;
DWORD remotepid;
int cb;
HINSTANCE hkernel32;
REMOTEPARAMETER rp;
_tcscpy(name,_T("Calc.exe"));
while(1)
{
remotepid=processtopid(name);
if(remotepid==-1)
{
return NULL;
}
else if(remotepid==0)
{
OutputDebugString(_T("Remote Process isn't running/n"));
Sleep(1000);
continue;
}
rphandle=OpenProcess(PROCESS_CREATE_THREAD |
PROCESS_VM_OPERATION |
PROCESS_VM_WRITE,
FALSE,remotepid);
if(rphandle==NULL)
{
Sleep(1000);
continue;
}
else
{
break;
}
}
cb=sizeof(TCHAR)*4*1024;
remotethr=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(remotethr==NULL)
{
OutputDebugString(_T("VirtualAllocEx for Thread Error/n"));
CloseHandle(rphandle);
return NULL;
}
if(WriteProcessMemory(rphandle,remotethr,(LPVOID)remote,cb,NULL)==FALSE)
{
OutputDebugString(_T("WriteProcessMemory for Thread Error/n"));
CloseHandle(rphandle);
return NULL;
}
{
memset(&rp,0,sizeof(rp));
_tcscpy(rp.rpMutex, cMutex);
WideCharToMultiByte(CP_ACP,0,ExeName,-1,rp.rpwinexecname,_tcslen(ExeName),NULL,NULL);
hkernel32=GetModuleHandle(_T("kernel32.dll"));
rp.rpwinexec=(DWORD)GetProcAddress(hkernel32,"WinExec");
rp.rpcreatemutex=(DWORD)GetProcAddress(hkernel32,"CreateMutexW");
rp.rpsleep=(DWORD)GetProcAddress(hkernel32,"Sleep");
rp.rpclosehandle=(DWORD)GetProcAddress(hkernel32,"CloseHandle");
}
cb=sizeof(TCHAR)*sizeof(rp);
remotepar=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
if(remotepar==NULL)
{
OutputDebugString(_T("VirtualAllocEx for Parameter Error/n"));
CloseHandle(rphandle);
return NULL;
}
if(WriteProcessMemory(rphandle,remotepar,(LPVOID)&rp,cb,NULL)==FALSE)
{
OutputDebugString(_T("WriteProcessMemory for Parameter Error:"));
CloseHandle(rphandle);
return NULL;
}
ethread=CreateRemoteThread(rphandle,NULL,0,(LPTHREAD_START_ROUTINE)remotethr,(LPVOID)remotepar,0,NULL);
if(ethread==NULL)
{
OutputDebugString(_T("CreateRemoteThread Error/n"));
CloseHandle(rphandle);
return NULL;
}
return ethread;
}
DWORD WINAPI remote(LPVOID pvparam)
{
PREMOTEPARAMETER erp=(PREMOTEPARAMETER)pvparam;
typedef UINT (WINAPI *EWinExec)(LPCSTR, UINT);
typedef HANDLE (WINAPI *ECreateMutex)(LPSECURITY_ATTRIBUTES , BOOL, LPCTSTR);
typedef VOID (WINAPI *ESleep)(DWORD);
typedef BOOL (WINAPI *ECloseHandle)(HANDLE);
EWinExec tWinExec;
ECreateMutex tCreateMutex;
ESleep tSleep;
ECloseHandle tCloseHandle;
tWinExec=(EWinExec)erp->rpwinexec;
tCreateMutex=(ECreateMutex)erp->rpcreatemutex;
tSleep=(ESleep)erp->rpsleep;
tCloseHandle=(ECloseHandle)erp->rpclosehandle;
erp->rphMutex=tCreateMutex(NULL, TRUE, erp->rpMutex);
if(tWinExec(erp->rpwinexecname, SW_SHOW)<=31)
{
return -1;
}
tSleep(4000);
tCloseHandle(erp->rphMutex);
return 0;
}
感谢 too2y , 老王.
这是我在学习老王的壳后, 参考网上的一些例子做的。
比老王的壳差的太远, 希望各位不要见笑.
如果各位写出了类似的加壳器, 希望发一个给我。
启动前先启动 Calc.exe, 改一下, 用 Explorer.exe 也可以。
#define UNICODE
#define _UNICODE
#include <windows.h>
#include <tchar.h>
#include <conio.h>
#include <psapi.h>
typedef struct _remoteparameter
{
DWORD rpwinexec;
DWORD rpcreatemutex;
DWORD rpsleep;
DWORD rpclosehandle;
char rpwinexecname[MAX_PATH];
HANDLE rphMutex;
TCHAR rpMutex[30];
}REMOTEPARAMETER, *PREMOTEPARAMETER;
DWORD WINAPI remote(LPVOID);
DWORD processtopid(TCHAR*);
HANDLE createremote(PTSTR);
TCHAR cMutex[8];
int main()
{
TCHAR ExeName[MAX_PATH];
HANDLE hRemoteThread;
HANDLE hMutex;
int ret;
_tcscpy(cMutex,_T("simonzh"));
hMutex = OpenMutex(SYNCHRONIZE, TRUE, cMutex );
if (hMutex == NULL)
{
ret=GetModuleFileName(NULL,ExeName,MAX_PATH);
if(ret==0)
{
OutputDebugString(_T("GetModuleFileName Error/n"));
getche();
return -1;
}
if((hRemoteThread=createremote(ExeName))==NULL)
{
OutputDebugString(_T("CreateRemote Error/n"));
getche();
return -1;
}
return 0;
}
CloseHandle(hMutex);
// 上面相当于一个壳的 Loader
// 下面相当于被加壳的原程序.
_tprintf(_T("---[ This is not me. HaHaHa... ]---/n"));
getche();
return 0;
}
DWORD processtopid(TCHAR *processname)
{
DWORD lpidprocesses[1024],cbneeded,cprocesses;
HANDLE hprocess;
HMODULE hmodule;
UINT i;
TCHAR normalname[MAX_PATH]=_T("UnknownProcess");
if(!EnumProcesses(lpidprocesses,sizeof(lpidprocesses),&cbneeded))
{
OutputDebugString(_T("EnumProcesses Error/n"));
return -1;
}
cprocesses=cbneeded/sizeof(DWORD);
for(i=0;i<cprocesses;i++)
{
hprocess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,lpidprocesses[i]);
if(hprocess)
{
if(EnumProcessModules(hprocess,&hmodule,sizeof(hmodule),&cbneeded))
{
GetModuleBaseName(hprocess,hmodule,normalname,sizeof(normalname));
if(!_tcsicmp(normalname,processname))
{
CloseHandle(hprocess);
return (lpidprocesses[i]);
}
}
}
}
CloseHandle(hprocess);
return 0;
}
HANDLE createremote(PTSTR ExeName)
{
HANDLE ethread;
HANDLE rphandle;
TCHAR name[15];
TCHAR *remotethr;
TCHAR *remotepar;
DWORD remotepid;
int cb;
HINSTANCE hkernel32;
REMOTEPARAMETER rp;
_tcscpy(name,_T("Calc.exe"));
while(1)
{
remotepid=processtopid(name);
if(remotepid==-1)
{
return NULL;
}
else if(remotepid==0)
{
OutputDebugString(_T("Remote Process isn't running/n"));
Sleep(1000);
continue;
}
rphandle=OpenProcess(PROCESS_CREATE_THREAD |
PROCESS_VM_OPERATION |
PROCESS_VM_WRITE,
FALSE,remotepid);
if(rphandle==NULL)
{
Sleep(1000);
continue;
}
else
{
break;
}
}
cb=sizeof(TCHAR)*4*1024;
remotethr=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(remotethr==NULL)
{
OutputDebugString(_T("VirtualAllocEx for Thread Error/n"));
CloseHandle(rphandle);
return NULL;
}
if(WriteProcessMemory(rphandle,remotethr,(LPVOID)remote,cb,NULL)==FALSE)
{
OutputDebugString(_T("WriteProcessMemory for Thread Error/n"));
CloseHandle(rphandle);
return NULL;
}
{
memset(&rp,0,sizeof(rp));
_tcscpy(rp.rpMutex, cMutex);
WideCharToMultiByte(CP_ACP,0,ExeName,-1,rp.rpwinexecname,_tcslen(ExeName),NULL,NULL);
hkernel32=GetModuleHandle(_T("kernel32.dll"));
rp.rpwinexec=(DWORD)GetProcAddress(hkernel32,"WinExec");
rp.rpcreatemutex=(DWORD)GetProcAddress(hkernel32,"CreateMutexW");
rp.rpsleep=(DWORD)GetProcAddress(hkernel32,"Sleep");
rp.rpclosehandle=(DWORD)GetProcAddress(hkernel32,"CloseHandle");
}
cb=sizeof(TCHAR)*sizeof(rp);
remotepar=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
if(remotepar==NULL)
{
OutputDebugString(_T("VirtualAllocEx for Parameter Error/n"));
CloseHandle(rphandle);
return NULL;
}
if(WriteProcessMemory(rphandle,remotepar,(LPVOID)&rp,cb,NULL)==FALSE)
{
OutputDebugString(_T("WriteProcessMemory for Parameter Error:"));
CloseHandle(rphandle);
return NULL;
}
ethread=CreateRemoteThread(rphandle,NULL,0,(LPTHREAD_START_ROUTINE)remotethr,(LPVOID)remotepar,0,NULL);
if(ethread==NULL)
{
OutputDebugString(_T("CreateRemoteThread Error/n"));
CloseHandle(rphandle);
return NULL;
}
return ethread;
}
DWORD WINAPI remote(LPVOID pvparam)
{
PREMOTEPARAMETER erp=(PREMOTEPARAMETER)pvparam;
typedef UINT (WINAPI *EWinExec)(LPCSTR, UINT);
typedef HANDLE (WINAPI *ECreateMutex)(LPSECURITY_ATTRIBUTES , BOOL, LPCTSTR);
typedef VOID (WINAPI *ESleep)(DWORD);
typedef BOOL (WINAPI *ECloseHandle)(HANDLE);
EWinExec tWinExec;
ECreateMutex tCreateMutex;
ESleep tSleep;
ECloseHandle tCloseHandle;
tWinExec=(EWinExec)erp->rpwinexec;
tCreateMutex=(ECreateMutex)erp->rpcreatemutex;
tSleep=(ESleep)erp->rpsleep;
tCloseHandle=(ECloseHandle)erp->rpclosehandle;
erp->rphMutex=tCreateMutex(NULL, TRUE, erp->rpMutex);
if(tWinExec(erp->rpwinexecname, SW_SHOW)<=31)
{
return -1;
}
tSleep(4000);
tCloseHandle(erp->rphMutex);
return 0;
}