在内存中运行可执行程序
在内存中运行可执行程序,好处是可以给程序加壳,加密源程序,静态反汇编无法获得PE输入节,但是因为运行后仍然是独立的进程,所以没办法防止远程线程注入,挂接API钩子。
typedef IMAGE_SECTION_HEADER (
*
PIMAGE_SECTION_HEADERS)[
1
];
//
计算对齐后的大小
unsigned
long
GetAlignedSize(unsigned
long
Origin, unsigned
long
Alignment)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
return (Origin + Alignment - 1 ) / Alignment * Alignment;
}
//
计算加载pe并对齐需要占用多少内存
//
未直接使用OptionalHeader.SizeOfImage作为结果是因为据说有的编译器生成的exe这个值会填0
unsigned
long
CalcTotalImageSize(PIMAGE_DOS_HEADER MzH
, unsigned
long
FileLen
, PIMAGE_NT_HEADERS peH
, PIMAGE_SECTION_HEADERS peSecH)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
unsigned long res;
// 计算pe头的大小
res = GetAlignedSize( peH -> OptionalHeader.SizeOfHeaders , peH -> OptionalHeader.SectionAlignment);
// 计算所有节的大小
for ( int i = 0 ; i < peH -> FileHeader.NumberOfSections; ++ i)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
// 超出文件范围
if (peSecH[i] -> PointerToRawData + peSecH[i] -> SizeOfRawData > FileLen)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
return 0 ;
}
else if (peSecH[i] -> VirtualAddress) // 计算对齐后某节的大小
{
if (peSecH[i] -> Misc.VirtualSize)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
res = GetAlignedSize( peSecH[i] -> VirtualAddress + peSecH[i] -> Misc.VirtualSize
, peH -> OptionalHeader.SectionAlignment);
}
else
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
res = GetAlignedSize( peSecH[i] -> VirtualAddress + peSecH[i] -> SizeOfRawData
, peH -> OptionalHeader.SectionAlignment);
}
}
else if ( peSecH[i] -> Misc.VirtualSize < peSecH[i] -> SizeOfRawData )
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
res += GetAlignedSize( peSecH[i] -> SizeOfRawData
, peH -> OptionalHeader.SectionAlignment);
}
else
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
res += GetAlignedSize( peSecH[i] -> Misc.VirtualSize
, peH -> OptionalHeader.SectionAlignment);
} // if_else
} // for
return res;
}
//
加载pe到内存并对齐所有节
BOOL AlignPEToMem(
void
*
Buf
,
long
Len
, PIMAGE_NT_HEADERS
&
peH
, PIMAGE_SECTION_HEADERS
&
peSecH
,
void
*&
Mem
, unsigned
long
&
ImageSize)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
PIMAGE_DOS_HEADER SrcMz; // DOS头
PIMAGE_NT_HEADERS SrcPeH; // PE头
PIMAGE_SECTION_HEADERS SrcPeSecH; // 节表
SrcMz = (PIMAGE_DOS_HEADER)Buf;
if ( Len < sizeof (IMAGE_DOS_HEADER) )
return FALSE;
if ( SrcMz -> e_magic != IMAGE_DOS_SIGNATURE )
return FALSE;
if ( Len < SrcMz -> e_lfanew + ( long ) sizeof (IMAGE_NT_HEADERS) )
return FALSE;
SrcPeH = (PIMAGE_NT_HEADERS)(( int )SrcMz + SrcMz -> e_lfanew);
if ( SrcPeH -> Signature != IMAGE_NT_SIGNATURE )
return FALSE;
if ( (SrcPeH -> FileHeader.Characteristics & IMAGE_FILE_DLL) ||
(SrcPeH -> FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE == 0 ) ||
(SrcPeH -> FileHeader.SizeOfOptionalHeader != sizeof (IMAGE_OPTIONAL_HEADER)) )
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
return FALSE;
}
SrcPeSecH = (PIMAGE_SECTION_HEADERS)(( int )SrcPeH + sizeof (IMAGE_NT_HEADERS));
ImageSize = CalcTotalImageSize( SrcMz, Len, SrcPeH, SrcPeSecH);
if ( ImageSize == 0 )
return FALSE;
Mem = VirtualAlloc( NULL, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); // 分配内存
if ( Mem != NULL )
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
// 计算需要复制的PE头字节数
unsigned long l = SrcPeH -> OptionalHeader.SizeOfHeaders;
for ( int i = 0 ; i < SrcPeH -> FileHeader.NumberOfSections; ++ i)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
if ( (SrcPeSecH[i] -> PointerToRawData) &&
(SrcPeSecH[i] -> PointerToRawData < l) )
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
l = SrcPeSecH[i] -> PointerToRawData;
}
}
memmove( Mem, SrcMz, l);
peH = (PIMAGE_NT_HEADERS)(( int )Mem + ((PIMAGE_DOS_HEADER)Mem) -> e_lfanew);
peSecH = (PIMAGE_SECTION_HEADERS)(( int )peH + sizeof (IMAGE_NT_HEADERS));
void * Pt = ( void * )((unsigned long )Mem
+ GetAlignedSize( peH -> OptionalHeader.SizeOfHeaders
, peH -> OptionalHeader.SectionAlignment)
);
for ( i = 0 ; i < peH -> FileHeader.NumberOfSections; ++ i)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
// 定位该节在内存中的位置
if (peSecH[i] -> VirtualAddress)
Pt = ( void * )((unsigned long )Mem + peSecH[i] -> VirtualAddress);
if (peSecH[i] -> SizeOfRawData)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
// 复制数据到内存
memmove(Pt, ( const void * )((unsigned long )(SrcMz) + peSecH[i] -> PointerToRawData), peSecH[i] -> SizeOfRawData);
if (peSecH[i] -> Misc.VirtualSize < peSecH[i] -> SizeOfRawData)
Pt = ( void * )((unsigned long )Pt + GetAlignedSize(peSecH[i] -> SizeOfRawData, peH -> OptionalHeader.SectionAlignment));
else // pt 定位到下一节开始位置
Pt = ( void * )((unsigned long )Pt + GetAlignedSize(peSecH[i] -> Misc.VirtualSize, peH -> OptionalHeader.SectionAlignment));
}
else
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
Pt = ( void * )((unsigned long )Pt + GetAlignedSize(peSecH[i] -> Misc.VirtualSize, peH -> OptionalHeader.SectionAlignment));
}
}
}
return TRUE;
}
typedef
void
*
(__stdcall
*
pfVirtualAllocEx)(unsigned
long
,
void
*
, unsigned
long
, unsigned
long
, unsigned
long
);
pfVirtualAllocEx MyVirtualAllocEx
=
NULL;
BOOL IsNT()
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
return MyVirtualAllocEx != NULL;
}
//
生成外壳程序命令行
char
*
PrepareShellExe(
char
*
CmdParam, unsigned
long
BaseAddr, unsigned
long
ImageSize)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
if (IsNT())
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
char * Buf = new char [ 256 ];
memset(Buf, 0 , 256 );
GetModuleFileName( 0 , Buf, 256 );
strcat(Buf, CmdParam);
return Buf; // 请记得释放内存;-)
}
else
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
// Win98下的处理请参考原文;-)
// http://community.csdn.net/Expert/topic/4416/4416252.xml?temp=8.709133E-03
return NULL;
}
}
//
是否包含可重定向列表
BOOL HasRelocationTable(PIMAGE_NT_HEADERS peH)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
return (peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)
&& (peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
}
#pragma pack(push,
1
)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
typedef
struct
{
unsigned long VirtualAddress;
unsigned long SizeOfBlock;
}
*
PImageBaseRelocation;
#pragma pack(pop)
//
重定向PE用到的地址
void
DoRelocation(PIMAGE_NT_HEADERS peH,
void
*
OldBase,
void
*
NewBase)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
unsigned long Delta = (unsigned long )NewBase - peH -> OptionalHeader.ImageBase;
PImageBaseRelocation p = (PImageBaseRelocation)((unsigned long )OldBase
+ peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
while (p -> VirtualAddress + p -> SizeOfBlock)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
unsigned short * pw = (unsigned short * )(( int )p + sizeof ( * p));
for (unsigned int i = 1 ; i <= (p -> SizeOfBlock - sizeof ( * p)) / 2 ; ++ i)
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (( * pw) & 0xF000 == 0x3000 )
{
unsigned long * t = (unsigned long * )((unsigned long )(OldBase) + p -> VirtualAddress + (( * pw) & 0x0FFF ));
* t += Delta;
}
++ pw;
}
p = (PImageBaseRelocation)pw;
}
}
//
卸载原外壳占用内存
BOOL UnloadShell(HANDLE ProcHnd, unsigned
long
BaseAddr)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
typedef unsigned long (__stdcall * pfZwUnmapViewOfSection)(unsigned long , unsigned long );
pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;
BOOL res = FALSE;
HMODULE m = LoadLibrary( " ntdll.dll " );
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (m)
{
ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress(m, " ZwUnmapViewOfSection " );
if (ZwUnmapViewOfSection)
res = (ZwUnmapViewOfSection((unsigned long )ProcHnd, BaseAddr) == 0 );
FreeLibrary(m);
}
return res;
}
//
创建外壳进程并获取其基址、大小和当前运行状态
BOOL CreateChild(
char
*
Cmd, CONTEXT
&
Ctx, HANDLE
&
ProcHnd, HANDLE
&
ThrdHnd,
unsigned
long
&
ProcId, unsigned
long
&
BaseAddr, unsigned
long
&
ImageSize)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
STARTUPINFOA si;
PROCESS_INFORMATION pi;
unsigned long old;
MEMORY_BASIC_INFORMATION MemInfo;
memset( & si, 0 , sizeof (si));
memset( & pi, 0 , sizeof (pi));
si.cb = sizeof (si);
BOOL res = CreateProcess(NULL, Cmd, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, & si, & pi); // 以挂起方式运行进程;
if (res)
{
ProcHnd = pi.hProcess;
ThrdHnd = pi.hThread;
ProcId = pi.dwProcessId;
// 获取外壳进程运行状态,[ctx.Ebx+8]内存处存的是外壳进程的加载基址,ctx.Eax存放有外壳进程的入口地址
Ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(ThrdHnd, & Ctx);
ReadProcessMemory(ProcHnd, ( void * )(Ctx.Ebx + 8 ), & BaseAddr, sizeof (unsigned long ), & old); // 读取加载基址
void * p = ( void * )BaseAddr;
// 计算外壳进程占有的内存
while (VirtualQueryEx(ProcHnd, p, & MemInfo, sizeof (MemInfo)))
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
if (MemInfo.State = MEM_FREE) break ;
p = ( void * )((unsigned long )p + MemInfo.RegionSize);
}
ImageSize = (unsigned long )p - (unsigned long )BaseAddr;
}
return res;
}
//
创建外壳进程并用目标进程替换它然后执行
HANDLE AttachPE(
char
*
CmdParam, PIMAGE_NT_HEADERS peH, PIMAGE_SECTION_HEADERS peSecH,
void
*
Ptr, unsigned
long
ImageSize, unsigned
long
&
ProcId)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
HANDLE res = INVALID_HANDLE_VALUE;
CONTEXT Ctx;
HANDLE Thrd;
unsigned long Addr, Size;
char * s = PrepareShellExe(CmdParam, peH -> OptionalHeader.ImageBase, ImageSize);
if (s == NULL) return res;
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (CreateChild(s, Ctx, res, Thrd, ProcId, Addr, Size))
{
void * p = NULL;
unsigned long old;
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if ((peH -> OptionalHeader.ImageBase == Addr) && (Size >= ImageSize))
{ // 外壳进程可以容纳目标进程并且加载地址一致
p = ( void * )Addr;
VirtualProtectEx(res, p, Size, PAGE_EXECUTE_READWRITE, & old);
}
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
else if (IsNT())
{
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (UnloadShell(res, Addr))
{ // 卸载外壳进程占有内存
p = MyVirtualAllocEx((unsigned long )res, ( void * )peH -> OptionalHeader.ImageBase, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
}
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if ((p == NULL) && HasRelocationTable(peH))
{ // 分配内存失败并且目标进程支持重定向
p = MyVirtualAllocEx((unsigned long )res, NULL, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (p) DoRelocation(peH, Ptr, p); // 重定向
}
}
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (p)
{
WriteProcessMemory(res, ( void * )(Ctx.Ebx + 8 ), & p, sizeof (DWORD), & old); // 重置目标进程运行环境中的基址
peH -> OptionalHeader.ImageBase = (unsigned long )p;
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
if (WriteProcessMemory(res, p, Ptr, ImageSize, & old))
{ // 复制PE数据到目标进程
Ctx.ContextFlags = CONTEXT_FULL;
if ((unsigned long )p == Addr)
Ctx.Eax = peH -> OptionalHeader.ImageBase + peH -> OptionalHeader.AddressOfEntryPoint; // 重置运行环境中的入口地址
else
Ctx.Eax = (unsigned long )p + peH -> OptionalHeader.AddressOfEntryPoint;
SetThreadContext(Thrd, & Ctx); // 更新运行环境
ResumeThread(Thrd); // 执行
CloseHandle(Thrd);
}
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
else
{ // 加载失败,杀掉外壳进程
TerminateProcess(res, 0 );
CloseHandle(Thrd);
CloseHandle(res);
res = INVALID_HANDLE_VALUE;
}
}
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
else
{ // 加载失败,杀掉外壳进程
TerminateProcess(res, 0 );
CloseHandle(Thrd);
CloseHandle(res);
res = INVALID_HANDLE_VALUE;
}
}
delete[] s;
return res;
}
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
/**/
/**/
/**/
/* ******************************************************/
{ ******************************************************* }
{ * 从内存中加载并运行exe * }
{ ******************************************************* }
{ * 参数: }
{ * Buffer: 内存中的exe地址 }
{ * Len: 内存中exe占用长度 }
{ * CmdParam: 命令行参数(不包含exe文件名的剩余命令行参数)}
{ * ProcessId: 返回的进程Id }
{ * 返回值: 如果成功则返回进程的Handle(ProcessHandle), }
{ 如果失败则返回INVALID_HANDLE_VALUE }
{ ******************************************************* }
/****************************************************** */
HANDLE MemExecute(
void
*
ABuffer,
long
Len,
char
*
CmdParam, unsigned
long
*
ProcessId)
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
HANDLE res = INVALID_HANDLE_VALUE;
PIMAGE_NT_HEADERS peH;
PIMAGE_SECTION_HEADERS peSecH;
void * Ptr;
unsigned long peSz;
if (AlignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz))
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
res = AttachPE(CmdParam, peH, peSecH, Ptr, peSz, * ProcessId);
VirtualFree(Ptr, peSz, MEM_DECOMMIT);
}
return res;
}
//
初始化
class
CInit
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
public :
CInit()
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
MyVirtualAllocEx = (pfVirtualAllocEx)GetProcAddress(GetModuleHandle( " Kernel32.dll " ), " VirtualAllocEx " );
}
}
Init;
![](https://i-blog.csdnimg.cn/blog_migrate/cbef093dcc044b2793832001e2365e43.gif)
![](https://i-blog.csdnimg.cn/blog_migrate/cbef093dcc044b2793832001e2365e43.gif)
![](https://i-blog.csdnimg.cn/blog_migrate/cbef093dcc044b2793832001e2365e43.gif)
int
main(
int
argc,
char
*
argv[])
![](https://i-blog.csdnimg.cn/blog_migrate/2f88ce130b654eb5dc6788e02dbcfc90.gif)
{
FILE * fp;
fp = fopen( " E://CProject//DBGVIEW.EXE " , " rb " );
![](https://i-blog.csdnimg.cn/blog_migrate/df37983f39daa189b8c814e01a6a9011.gif)
if ( fp )
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
{
![](https://i-blog.csdnimg.cn/blog_migrate/df37983f39daa189b8c814e01a6a9011.gif)
fseek(fp, 0l ,SEEK_END);
![](https://i-blog.csdnimg.cn/blog_migrate/f70a0fde2b51b7dd92a70e712e540cf6.gif)
int file_size = ftell(fp); /**/ /* 获取文件长度 */
fseek(fp, 0l ,SEEK_SET); /**/ /* 回到文件头部 */
LPBYTE pBuf = new BYTE[file_size];
memset( pBuf, 0 , file_size);
![](https://i-blog.csdnimg.cn/blog_migrate/df37983f39daa189b8c814e01a6a9011.gif)
fread(pBuf,file_size, 1 ,fp);
![](https://i-blog.csdnimg.cn/blog_migrate/df37983f39daa189b8c814e01a6a9011.gif)
DWORD id = GetCurrentProcessId();
unsigned long ulProcessId = 0 ;
MemExecute( pBuf, file_size, "" , & ulProcessId);
delete[] pBuf;
}
return 0 ;
}