C++写壳详解之基础篇

//将DLL以不会执行代码的标志加载到进程中.
 HMODULE hStubDll = LoadLibraryExA("Stub.dll", 0,
 DONT_RESOLVE_DLL_REFERENCES);

//获取DOS头
PIMAGE_DOS_HEADER GetDosHeader(char* pBase)
{
 return (PIMAGE_DOS_HEADER)pBase;
}
 
//获取NT头
PIMAGE_NT_HEADERS GetNtHeader(char* pBase)
{
 return (PIMAGE_NT_HEADERS)
 (GetDosHeader(pBase)->e_lfanew + (DWORD)pBase);
}

//修复stub的重定位
void FixStubReloc(char* pTarBuff, char*& hModule,DWORD dwNewBase,DWORD dwNewSecRva)
{
 //获取sutb.dll重定位va
 auto pReloc = (PIMAGE_BASE_RELOCATION)
 (GetOptHeader(hModule)->DataDirectory[5].VirtualAddress
 + hModule);
 //获取stub.dll的.text区段的Rva
 DWORD dwTextRva = (DWORD)GetSecHeader(hModule, ".text")->VirtualAddress;
 
 //修复重定位
 while (pReloc->SizeOfBlock)
 {
 struct TypeOffset
 {
 WORD offset : 12;
 WORD type : 4;
 };
 TypeOffset* pTyOf = (TypeOffset*)(pReloc + 1);
 DWORD dwCount = (pReloc->SizeOfBlock - 8) / 2;
 for (size_t i = 0; i < dwCount; i++)
 {
 if(pTyOf[i].type != 3)
 continue;
 //要修复的Rva
 DWORD dwFixRva = pTyOf[i].offset + pReloc->VirtualAddress;
 //要修复的地址
 DWORD* pFixAddr = (DWORD*)(dwFixRva + (DWORD)hModule);
 DWORD dwOldProc;
 VirtualProtect(pFixAddr, 4, PAGE_READWRITE, &dwOldProc);
 *pFixAddr -= (DWORD)hModule; //减去原始基址
 *pFixAddr -= dwTextRva; //减去原始代码段Rva
 *pFixAddr += dwNewBase; //加上新基址
 *pFixAddr += dwNewSecRva; //加上新Rva
 VirtualProtect(pFixAddr, 4, dwOldProc, &dwOldProc);
 }
 //指向下一个重定位块
 pReloc = (PIMAGE_BASE_RELOCATION)
 ((DWORD)pReloc + pReloc->SizeOfBlock);
 }
}

//把数据段融入代码段
#pragma comment(linker,"/merge:.data=.text")
//把只读数据段融入代码段
#pragma comment(linker,"/merge:.rdata=.text")
//设置代码段为可读可写可执行
#pragma comment(linker,"/section:.text,RWE")

__asm
 {
 push esi;
 mov esi, fs:[0x30]; //得到PEB地址
 mov esi, [esi + 0xc]; //指向PEB_LDR_DATA结构的首地址
 mov esi, [esi + 0x1c];//一个双向链表的地址
 mov esi, [esi]; //得到第2个条目kernelBase的链表
 mov esi, [esi]; //得到第3个条目kernel32的链表(win10系统)
 mov esi, [esi + 0x8]; //kernel32.dll地址
 mov g_hKernel32, esi;
 pop esi;
 }

//获取GetProcAddress函数地址
void MyGetFunAddress()
{
 __asm
 {
 pushad;
 mov ebp, esp;
 sub esp, 0xc;
 mov edx, g_hKernel32;
 mov esi, [edx + 0x3c]; //NT头的RVA
 lea esi, [esi + edx]; //NT头的VA
 mov esi, [esi + 0x78]; //Export的Rva
 lea edi, [esi + edx]; //Export的Va
 
 mov esi, [edi + 0x1c]; //Eat的Rva
 lea esi, [esi + edx]; //Eat的Va
 mov[ebp - 0x4], esi; //保存Eat
 
 mov esi, [edi + 0x20]; //Ent的Rva
 lea esi, [esi + edx]; //Ent的Va
 mov[ebp - 0x8], esi; //保存Ent
 
 mov esi, [edi + 0x24]; //Eot的Rva
 lea esi, [esi + edx]; //Eot的Va
 mov[ebp - 0xc], esi; //保存Eot
 
 xor ecx, ecx;
 jmp _First;
 _Zero:
 inc ecx;
 _First:
 mov esi, [ebp - 0x8]; //Ent的Va
 mov esi, [esi + ecx * 4]; //FunName的Rva
 
 lea esi, [esi + edx]; //FunName的Va
 cmp dword ptr[esi], 050746547h;// 47657450 726F6341 64647265 7373;
 jne _Zero; // 上面的16进制是GetProcAddress的ASCII
 cmp dword ptr[esi + 4], 041636f72h;
 jne _Zero;
 cmp dword ptr[esi + 8], 065726464h;
 jne _Zero;
 cmp word ptr[esi + 0ch], 07373h;
 jne _Zero;
 
 xor ebx,ebx
 mov esi, [ebp - 0xc]; //Eot的Va
 mov bx, [esi + ecx * 2]; //得到序号
 
 mov esi, [ebp - 0x4]; //Eat的Va
 mov esi, [esi + ebx * 4]; //FunAddr的Rva
 lea eax, [esi + edx]; //FunAddr
 mov MyGetProcAddress, eax;
 add esp, 0xc;
 popad;
 }
}

//运行函数
void RunFun()
{
 MyLoadLibraryExA = (FuLoadLibraryExA)MyGetProcAddress(g_hKernel32, "LoadLibraryExA");
 g_hUser32 = MyLoadLibraryExA("user32.dll", 0, 0);
 MyMessageBoxW = (FuMessageBoxW)MyGetProcAddress(g_hUser32, "MessageBoxW");
 MyMessageBoxW(0, L"大家好我是一个壳", L"提示", 0);
}

//加密代码段
//1.获取代码段首地址
char* pTarText = GetSecHeader(pTarBuff, ".text")->PointerToRawData + pTarBuff;
//2.获取代码段实际大小
int nSize = GetSecHeader(pTarBuff, ".text")->Misc.VirtualSize;
for (int i = 0; i < nSize; ++i)
{
 pTarText[i] ^= 0x15;
}

//自写strcmp
int StrCmpText(const char* pStr, char* pBuff)
{
 int nFlag = 1;
 __asm
 {
 mov esi, pStr;
 mov edi, pBuff;
 mov ecx, 0x6;
 cld;
 repe cmpsb;
 je _end;
 mov nFlag, 0;
 _end:
 }
 return nFlag;
}

//解密
void Decryption()
{
 //获取.text的区段头
 auto pNt = GetNtHeader((char*)g_hModule);
 DWORD dwSecNum = pNt->FileHeader.NumberOfSections;
 auto pSec = IMAGE_FIRST_SECTION(pNt);
 
 //找到代码区段
 for (size_t i = 0; i < dwSecNum; i++)
 {
 if (StrCmpText(".text", (char*)pSec[i].Name))
 {
 pSec += i;
 break;
 }
 }
 
 //获取代码段首地址
 char* pTarText = pSec->VirtualAddress + (char*)g_hModule;
 int nSize = pSec->Misc.VirtualSize;
 DWORD old = 0;
 //解密代码段
 MyVirtualProtect(pTarText, nSize, PAGE_READWRITE, &old);
 for (int i = 0; i < nSize; ++i) {
 pTarText[i] ^= 0x15;
 }
 MyVirtualProtect(pTarText, nSize, old, &old);
}

auto pData = GetOptHeader(pTarBuff)->DataDirectory;
pData[9].Size = 0;
pData[9].VirtualAddress = 0;