空白区域添加代码

其他 2020-10-04 10:58:49 阅读次数: 0

文章目录

一、流程

1、File-> FileBuffer
2、FileBuffer->ImageBuffer
3、判断空闲区是否有足够的空间存储ShellCode代码
4、将ShellCode代码复制到空闲区
5、修正E8、E9
6、修正OEP(入口程序)
7、ImageBuffer->NewBuffer
8、NewBuffer->文件

二、演示

1、看上篇
2、看上篇
3、判断空闲区是否有足够的空间存储ShellCode代码

#define SHELLCODELENGTH 0x12
#define MESSAGEBOXADDR 0x77D5050B

BYTE ShellCode[] = 
{
	0x6A,00,0x6A,00,0x6A,00,0x6A,00,
	0xE8,00,00,00,00,
	0xE9,00,00,00,00
};


pDosHeader = (PIMAGE_DOS_HEADER)pImageBuffer;
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)(((DWORD)pImageBuffer + pDosHeader->e_lfanew) + 4 + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)(((DWORD)pImageBuffer + pDosHeader->e_lfanew) + 4 + IMAGE_SIZEOF_FILE_HEADER + IMAGE_SIZEOF_NT_OPTIONAL32_HEADER);

	DWORD i = 2;
	if((((pSectionHeader+i)->SizeOfRawData) - (pSectionHeader+i)->Misc.VirtualSize) < SHELLCODELENGTH)
	{
		printf("代码空间不够");
		free(pFileBuffer);
		free(pImageBuffer);
		return;
	}

4、将ShellCode代码复制到空闲区

//将代码复制到空闲区
	CodeBegin = (PBYTE)((DWORD)pImageBuffer + (pSectionHeader+i)->VirtualAddress +  (pSectionHeader+i)->Misc.VirtualSize);
	memcpy(CodeBegin,ShellCode,SHELLCODELENGTH);

5、修正E8、E9

//修正E8
	DWORD CallAddr = (MESSAGEBOXADDR - (pOptionHeader->ImageBase + ((DWORD)(CodeBegin + 0xD) - (DWORD)pImageBuffer)));
	*(PDWORD)(CodeBegin + 9) = CallAddr;

//修正E9
	DWORD JmpAddr = (pOptionHeader->ImageBase + pOptionHeader->AddressOfEntryPoint) - (pOptionHeader->ImageBase + (pSectionHeader+i)->VirtualAddress + (pSectionHeader+i)->Misc.VirtualSize + SHELLCODELENGTH);
	*(PDWORD)(CodeBegin + 0xE) = JmpAddr;

6、修正OEP(入口程序)

//修改OEP
	pOptionHeader->AddressOfEntryPoint = (DWORD)CodeBegin - (DWORD)pImageBuffer;
	(pSectionHeader+i)->Misc.VirtualSize = (pSectionHeader+i)->Misc.VirtualSize + SHELLCODELENGTH;

7、看上篇
8、看上篇

三、完整代码

#include "stdafx.h"
#include <windows.h>
#include "stdlib.h"	
#include "stdio.h"	


#define FILEPATH_IN "C:/notepad.exe"
#define FILEPATH_OUT "C:/copyxx.exe"
#define SHELLCODELENGTH 0x12
#define MESSAGEBOXADDR 0x77D5050B

BYTE ShellCode[] = 
{
	0x6A,00,0x6A,00,0x6A,00,0x6A,00,
	0xE8,00,00,00,00,
	0xE9,00,00,00,00
};


DWORD ReadPEFile(IN LPSTR lpszFile,OUT LPVOID* pFileBuffer )
{
	FILE	*pFile		=	NULL;			
	DWORD	fileSize	=	0;			//文件大小
	LPVOID	pTempFileBuffer	=	NULL;	//缓冲区首地址

	
	pFile = fopen(lpszFile,"rb");	//打开文件
	if(!pFile)
	{
		printf("打开文件失败");
		return NULL;
	}

	//读取文件大小
	fseek(pFile,0,SEEK_END);		//将指针从开始的位置移动到末尾
	fileSize = ftell(pFile);		//获取数据大小

	//分配缓冲区（申请内存）
	pTempFileBuffer = malloc(fileSize);
	if(!pTempFileBuffer)
	{
		printf("分配空间失败");
		fclose(pFile);
		return NULL;
	}

	//将文件数据读取到缓冲区
	fseek(pFile,0,SEEK_SET);	//将指针指向开始
	size_t n = fread(pTempFileBuffer,fileSize,1,pFile);	//将数据读取到缓冲区中
	if(!n)
	{
		printf("读取数据失败");
		free(pTempFileBuffer);		//释放内存
		fclose(pFile);			//关闭文件
		return NULL;
	}

	//关闭文件
	*pFileBuffer = pTempFileBuffer;
	pTempFileBuffer = NULL;
	fclose(pFile);				//关闭文件
	return fileSize;		
}


DWORD CopyFileBufferToImageBuffer(IN LPVOID pFileBuffer,OUT LPVOID* pImageBuffer)
{
	PIMAGE_DOS_HEADER			pDosHeader		=	NULL;	//用来接收DOS头信息
	PIMAGE_NT_HEADERS			pNTHeader		=	NULL;
	PIMAGE_FILE_HEADER			pPEHeader		=	NULL;
	PIMAGE_OPTIONAL_HEADER32	pOptionHeader	=	NULL;
	PIMAGE_SECTION_HEADER		pSectionHeader	=	NULL;
	LPVOID						pTemImageBuffer	=	NULL;

//判断传入的值是否有效
	if(!pFileBuffer)
	{
		printf("缓冲区指针无效");
		return 0;
	}

//判断是否为PE文件
	if(*((PWORD)pFileBuffer)	!=	IMAGE_DOS_SIGNATURE)
	{
		printf("不是有效的MZ头\n");
		return 0;
	}

//获取头信息
	pDosHeader	=	(PIMAGE_DOS_HEADER)pFileBuffer;

	if(*((PDWORD)((DWORD)pFileBuffer + pDosHeader->e_lfanew))	!=	IMAGE_NT_SIGNATURE)
	{
		printf("不是有效的PE标志\n");
		return 0;
	}
	//NT头地址
	pNTHeader		=	(PIMAGE_NT_HEADERS)((DWORD)pFileBuffer	+	pDosHeader->e_lfanew);
	//标准PE头地址
	pPEHeader		=	(PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 0x4);
	//可选PE头地址
	pOptionHeader	=	(PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader	+	IMAGE_SIZEOF_FILE_HEADER);	
	//第一个节表地址
	pSectionHeader	=	(PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader	+	pPEHeader->SizeOfOptionalHeader);



	//申请缓冲区大小
	pTemImageBuffer = malloc(pOptionHeader->SizeOfImage);
	if(!pTemImageBuffer)
	{
		printf("分配空间失败");
		return 0;
	}
	//初始化缓冲区
	memset(pTemImageBuffer,0,pOptionHeader->SizeOfImage);
	//根据 SizeOfHeaders，先拷贝头
	memcpy(pTemImageBuffer,pDosHeader,pOptionHeader->SizeOfHeaders);
	//根据节表，循环拷贝节
	PIMAGE_SECTION_HEADER	pTempSectionHeader	=	pSectionHeader;
	for(int i=0;i<pPEHeader->NumberOfSections;i++,pTempSectionHeader++)
	{
		memcpy((void*)((DWORD)pTemImageBuffer + pTempSectionHeader->VirtualAddress),(void*)((DWORD)pFileBuffer + pTempSectionHeader->PointerToRawData),pTempSectionHeader->SizeOfRawData);
	}

	//返回数据
	*pImageBuffer = pTemImageBuffer;
	pTemImageBuffer	=	NULL;
	return 0;

}


DWORD CopyImageBufferToNewBuffer(IN LPVOID pImageBuffer,OUT LPVOID* pNewBuffer)
{

	PIMAGE_DOS_HEADER			pDosHeader		=	NULL;
	PIMAGE_NT_HEADERS			pNTHeader		=	NULL;
	PIMAGE_FILE_HEADER			pPEHeader		=	NULL;
	PIMAGE_OPTIONAL_HEADER32	pOptionHeader	=	NULL;
	PIMAGE_SECTION_HEADER		pSectionHeader	=	NULL;
	LPVOID						pTempNewBuffer	=	NULL;
	

	if(!pImageBuffer)
	{
		printf("缓冲区指针无效");
		return 0;
	}

	if(*((PWORD)pImageBuffer)	!=	IMAGE_DOS_SIGNATURE)
	{
		printf("不是有效的MZ头\n");
		return 0;
	}

	pDosHeader	=	(PIMAGE_DOS_HEADER)pImageBuffer;

	if(*((PDWORD)((DWORD)pImageBuffer + pDosHeader->e_lfanew))	!=	IMAGE_NT_SIGNATURE)
	{
		printf("不是有效的PE标志\n");
		return 0;
	}


	//NT头地址
	pNTHeader		=	(PIMAGE_NT_HEADERS)((DWORD)pImageBuffer	+	pDosHeader->e_lfanew);
	//标准PE头地址
	pPEHeader		=	(PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 0x4);
	//可选PE头地址
	pOptionHeader	=	(PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader	+	IMAGE_SIZEOF_FILE_HEADER);	
	//第一个节表地址
	pSectionHeader	=	(PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader	+	pPEHeader->SizeOfOptionalHeader);



	//数据大小（最后一个节的文件偏移 + 最后一个节的真实大小 + 文件对齐）
	DWORD	FileSize = (
		  (pSectionHeader + pPEHeader->NumberOfSections-1)->PointerToRawData 
		+ (pSectionHeader + pPEHeader->NumberOfSections-1)->Misc.VirtualSize 
		+ pOptionHeader->FileAlignment
		)&(0 - pOptionHeader->FileAlignment);
	pTempNewBuffer = malloc(FileSize);
	if(!pTempNewBuffer)
	{
		printf("分配空间失败");
		return 0;
	}
	//初始化缓冲区
	memset(pTempNewBuffer,0,FileSize);

	memcpy(pTempNewBuffer,pDosHeader,pOptionHeader->SizeOfHeaders);
	//根据节表，循环拷贝节
	PIMAGE_SECTION_HEADER	pTempSectionHeader	=	pSectionHeader;
	for(int i=0;i<pPEHeader->NumberOfSections;i++,pTempSectionHeader++)
	{
		memcpy((void*)((DWORD)pTempNewBuffer + pTempSectionHeader->PointerToRawData),
			(void*)((DWORD)pImageBuffer + pTempSectionHeader->VirtualAddress),
			pTempSectionHeader->Misc.VirtualSize);
	}

	*pNewBuffer = pTempNewBuffer;
	pTempNewBuffer	=	NULL;
	return FileSize;
}

BOOL MemeryTOFile(LPVOID pMemBuffer,size_t size,LPSTR lpszFile)
{
	FILE *fp = NULL;
	fp = fopen(lpszFile,"wb");	
	if(!fp)
	{
		return FALSE;
	}
	fwrite(pMemBuffer,size,1,fp);	//向磁盘写入数据
	fclose(fp);	//关闭文件
	fp = NULL;
	return TRUE;	

}


VOID Test()
{
	DWORD	Size			=	0;		//用来接收数据大小
	BOOL	isok			=	FALSE;		//用来接收写入磁盘是否成功
	PBYTE	CodeBegin		=	NULL;

	LPVOID	pFileBuffer		=	NULL;	//用来接收缓冲区的首地址
	LPVOID	pImageBuffer	=	NULL;
	LPVOID	pNewBuffer		=	NULL;

	PIMAGE_DOS_HEADER			pDosHeader		=	NULL;
	PIMAGE_NT_HEADERS			pNTHeader		=	NULL;
	PIMAGE_FILE_HEADER			pPEHeader		=	NULL;
	PIMAGE_OPTIONAL_HEADER32	pOptionHeader	=	NULL;
	PIMAGE_SECTION_HEADER		pSectionHeader	=	NULL;

	//File-> FileBuffer
	Size = ReadPEFile(FILEPATH_IN,&pFileBuffer);	//调用函数读取文件数据
	if(!pFileBuffer || !Size)
	{
		printf("File-> FileBuffer失败");
		return;
	}

	//FileBuffer->ImageBuffer
	CopyFileBufferToImageBuffer(pFileBuffer,&pImageBuffer);

	if(!pImageBuffer)
	{
		printf("FileBuffer->ImageBuffer失败");
		free(pFileBuffer);
		return;
	}

	//判断代码段空闲区是否有足够的空间存储ShellCode代码
	pDosHeader = (PIMAGE_DOS_HEADER)pImageBuffer;
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)(((DWORD)pImageBuffer + pDosHeader->e_lfanew) + 4 + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)(((DWORD)pImageBuffer + pDosHeader->e_lfanew) + 4 + IMAGE_SIZEOF_FILE_HEADER + IMAGE_SIZEOF_NT_OPTIONAL32_HEADER);

	DWORD i = 2;
	if((((pSectionHeader+i)->SizeOfRawData) - (pSectionHeader+i)->Misc.VirtualSize) < SHELLCODELENGTH)
	{
		printf("代码空间不够");
		free(pFileBuffer);
		free(pImageBuffer);
		return;
	}

	//将代码复制到空闲区
	CodeBegin = (PBYTE)((DWORD)pImageBuffer + (pSectionHeader+i)->VirtualAddress +  (pSectionHeader+i)->Misc.VirtualSize);
	memcpy(CodeBegin,ShellCode,SHELLCODELENGTH);

	//修正E8
	DWORD CallAddr = (MESSAGEBOXADDR - (pOptionHeader->ImageBase + ((DWORD)(CodeBegin + 0xD) - (DWORD)pImageBuffer)));
	*(PDWORD)(CodeBegin + 9) = CallAddr;

	//修正E9
	DWORD JmpAddr = (pOptionHeader->ImageBase + pOptionHeader->AddressOfEntryPoint) - (pOptionHeader->ImageBase + (pSectionHeader+i)->VirtualAddress + (pSectionHeader+i)->Misc.VirtualSize + SHELLCODELENGTH);
	*(PDWORD)(CodeBegin + 0xE) = JmpAddr;

	//修改OEP
	pOptionHeader->AddressOfEntryPoint = (DWORD)CodeBegin - (DWORD)pImageBuffer;
	(pSectionHeader+i)->Misc.VirtualSize = (pSectionHeader+i)->Misc.VirtualSize + SHELLCODELENGTH;





	//ImageBuffer->NewBuffer
	Size = CopyImageBufferToNewBuffer(pImageBuffer,&pNewBuffer);
	if(!Size || !pNewBuffer)
	{
		printf("ImageBuffer->NewBuffer失败");
		free(pFileBuffer);
		free(pImageBuffer);
		return;
	}

	//NewBuffer->文件
	isok = MemeryTOFile(pNewBuffer,Size,FILEPATH_OUT);
	if(isok)
	{
		printf("存盘成功");
		return;
	}

	//释放内存
	free(pFileBuffer);
	free(pImageBuffer);
	free(pNewBuffer);
}



int main(int argc, char* argv[])
{
	Test();
	getchar();
	return 0;
}

猜你喜欢

转载自blog.csdn.net/qq_41232519/article/details/108858613
今日推荐
周排行
vue + echart +map中国地图，省市地图，区县地图
spring boot2 (31)-cors跨域请求
『学习资料推荐』299元买的微信营销资料打包
个人学习卷积神经网络的疑惑解答
网络工程师-软考
模拟人生4 春夏秋冬、星梦起飞版更新下载方法以及常见问题
python关于对象的字符串显示str和repr以及
奇怪的session混乱问题
【3】分治法（divide-and-conquer）
Java项目开发成绩管理系统（九） 各模块实现信息修改
每日归档
更多
2024-08-07(0)
2024-08-06(0)
2024-08-05(0)
2024-08-04(0)
2024-08-03(0)
2024-08-02(0)
2024-08-01(0)
2024-07-31(0)
2024-07-30(0)
2024-07-29(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022