Windows 逆向-自动化加壳子（除夕特别版）

Oyst3r 于 2024-02-09 发布

芜湖，又是一年欸，2023 的最后一篇文章，2024 快乐呀，愿身边所有的人新的一年都幸福快乐安康

现在也写不进去了，一会儿有年夜饭和放烟花，然后这个代码是除夕凌晨写完的，实测都没有问题，可以加对齐方式不相等的，也可以加对齐方式相等的，废话不多说，直接粘贴代码了

这个是整体的结构

首先是 main 函数

#include <iostream>
#include <windows.h>
#include "Fuction.h"

int main()
{
	char* FilePath = (char*)"D:/Everything3.exe";  //打开的PE文件绝对路径
	char* SavePath = (char*)"D:/FakeEverything3.exe"; //保存的路径

	char* FileBufferPoint = ReadPeFile(FilePath);
	char* ImageBufferPoint = CopyFileBufferToImageBuffer(FileBufferPoint);
	int flag = AddShellCodeToSection(ImageBufferPoint ,2);
	if (!flag) {
		printf("shellcode注入失败\n");
		return 0;
	}
	char* NewBufferPoint = CopyImageBufferToNewBuffer(ImageBufferPoint);
	int flag_2 = MemeryToFile(NewBufferPoint, SavePath);
	if (flag_2) {
		printf("全部成功，程序已在对应路径生成\n");
	}
	else {
		printf("失败，再检查检查\n");
	}

	free(FileBufferPoint);
	free(ImageBufferPoint);
	free(NewBufferPoint);
	return 0;
}

然后是头文件

#pragma once
int PeFileSize(char* FilePath);
char* ReadPeFile(char* FilePath);
char* CopyFileBufferToImageBuffer(char* FileBufferPoint);
char* CopyImageBufferToNewBuffer(char* ImageBufferPoint);
int MemeryToFile(char* NewBufferPoint, char* SavePath);
int AddShellCodeToSection(char* ImageBufferPoint, int SectionNum);
int ImageAddressToFileAddress(char* FileBufferPoint, int ImageAddress);

然后是最主要的最重要的功能文件

#include "Fuction.h"
#include <cstdio>
#include <atomic>
//这个模块里面写的就是PE所要用到功能的集合，统一写在了这里
//给变量换个名字，写起来更方便一点
typedef unsigned int DWORD;
typedef unsigned short WORD;
typedef unsigned char BYTE;

//这个是shellcode的代码
BYTE shellcode[] = {
	0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,
	0xE8,0x00,0x00,0x00,0x00,
	0xE9,0x00,0x00,0x00,0x00
};

//这个就是一些PE里面固定的值
#define MZ 0x5A4D
#define PE 0x4550
#define IMAGE_SIZEOF_SHORT_NAME 8
#define MessageBox_Address 0x7611A000//这个是Everything2.exe的

//DOS头
struct _IMAGE_DOS_HEADER {
	WORD e_magic;  //MZ标记
	WORD e_cblp;
	WORD e_cp;
	WORD e_crlc;
	WORD e_cparhdr;
	WORD e_minalloc;
	WORD e_maxalloc;
	WORD e_ss;
	WORD e_sp;
	WORD e_csum;
	WORD e_ip;
	WORD e_cs;
	WORD e_lfarlc;
	WORD e_ovno;
	WORD e_res[4];
	WORD e_oemid;
	WORD e_oeminfo;
	WORD e_res2[10];
	DWORD e_lfanew;  //PE文件真正开始的偏移地址
};

//标准PE头
struct _IMAGE_FILE_HEADER {
	WORD Machine;  //文件运行平台
	WORD NumberOfSections;  //节数量
	DWORD TimeDateStamp;  //时间戳
	DWORD PointerToSymbolTable;
	DWORD NumberOfSymbols;
	WORD SizeOfOptionalHeader;  //可选PE头大小
	WORD Characteristics;  //特征值
};

//可选PE头
struct _IMAGE_OPTIONAL_HEADER {
	WORD Magic;  //文件类型
	BYTE MajorLinkerVersion;
	BYTE MinorLinkerVersion;
	DWORD SizeOfCode;   //代码节文件对齐后的大小
	DWORD SizeOfInitializedData;  //初始化数据文件对齐后的大小
	DWORD SizeOfUninitializedData;  //未初始化数据文件对齐后大小
	DWORD AddressOfEntryPoint;  //程序入口点（偏移量）
	DWORD BaseOfCode;  //代码基址
	DWORD BaseOfData;  //数据基址
	DWORD ImageBase;   //内存镜像基址
	DWORD SectionAlignment;  //内存对齐粒度
	DWORD FileAlignment;  //文件对齐粒度
	WORD MajorOperatingSystemVersion;
	WORD MinorOperatingSystemVersion;
	WORD MajorImageVersion;
	WORD MinorImageVersion;
	WORD MajorSubsystemVersion;
	WORD MinorSubsystemVersion;
	DWORD Win32VersionValue;
	DWORD SizeOfImage;  //文件装入虚拟内存后大小
	DWORD SizeOfHeaders;  //DOS、NT头和节表大小
	DWORD CheckSum;  //校验和
	WORD Subsystem;
	WORD DllCharacteristics;
	DWORD SizeOfStackReserve;  //预留堆栈大小
	DWORD SizeOfStackCommit;  //实际分配堆栈大小
	DWORD SizeOfHeapReserve;  //预留堆大小
	DWORD SizeOfHeapCommit;  //实际分配堆大小
	DWORD LoaderFlags;
	DWORD NumberOfRvaAndSizes;  //目录项数目
	//_IMAGE_DATA_DIRECTORY DataDirectory[16];  //这个先不管
};

//NT头
struct _IMAGE_NT_HEADERS {
	DWORD Signature;  //PE签名，这个在宏定义里面已经说明
	_IMAGE_FILE_HEADER FileHeader;
	_IMAGE_OPTIONAL_HEADER OptionalHeader;
};

//节表
struct _IMAGE_SECTION_HEADER {
	BYTE Name[IMAGE_SIZEOF_SHORT_NAME];  //节表名
	union {
		DWORD PhysicalAddress;
		DWORD VirtualSize;  //内存中未对齐大小
	}Misc;
	DWORD VirtualAddress;  //该节在内存中偏移地址
	DWORD SizeOfRawData;  //该节在硬盘上文件对齐后大小
	DWORD PointerToRawData;  //该节在硬盘上文件对齐后偏移地址
	DWORD PointerToRelocations;
	DWORD PointerToLinenumbers;
	WORD NumberOfRelocations;
	WORD NumberOfLinenumbers;
	DWORD Characteristics;  //该节特征属性
};
//OK至此所有用到的结构体就都定义完了，这个海东老师的课件里面都有，气死但他不给代码

int PeFileSize(char* FilePath) {
	//PeFileSize：计算文件在硬盘上的大小
	//参数说明：
	//FilePath:指向文件的绝对路径
	//返回值说明：
	//读取成功返回文件在硬盘上的大小，读取失败则返回0
	FILE* pf = fopen(FilePath, "rb");
	if (pf == NULL) {
		perror("打开文件错误");
		fclose(pf);
		return 0;
	}
	fseek(pf, 0, 2);
	int length = ftell(pf);
	fseek(pf, 0, 0);
	fclose(pf);
	printf("已经成功读取该文件的大小\n");
	return length;
}

char* ReadPeFile(char* FilePath) {
	//ReadPeFile：将可执行文件从硬盘读取到FileBuffer
	//参数说明：
	//FilePath:指向文件的绝对路径
	//返回值说明：
	//读取成功返回FileBuffer的首地址，读取失败则返回0

	FILE* pf = fopen(FilePath, "rb");
	if (pf == NULL) {
		perror("打开文件错误");
		fclose(pf);
		return 0;
	}

	int length = PeFileSize(FilePath);
	char* ptr_1 = (char*)malloc(sizeof(char) * length);
	if (ptr_1 == NULL) {
		perror("File堆内存分配失败");
		fclose(pf);
		return 0;
	}
	memset(ptr_1, 0, sizeof(char) * length);
	int flag = fread(ptr_1, length, 1, pf);
	if (flag == NULL) {
		perror("读取数据失败，请检查文件路径");
		fclose(pf);
		free(ptr_1);
		return 0;
	}

	fclose(pf);
	//这里之所以没有free(ptr)，原因是咱们下面还要用到这块堆的内存，所以可以在main函数结束之前释放掉就行
	printf("已成功将可执行文件从硬盘读取到FileBuffer\n");
	return ptr_1;
}

char* CopyFileBufferToImageBuffer(char* FileBufferPoint) {
	//CopyFileBufferToImageBuffer：将可执行文件从FileBuffer读取到ImageBuffer
	//参数说明：
	//FileBufferPoint:指向可执行文件在FileBuffer的地址
	//返回值说明：
	//读取成功返回ImageBuffer的首地址，读取失败则返回0

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)FileBufferPoint;
	//下面这个别忘记了还有一个PE标记的大小，为4个字节
	_image_file_header = (_IMAGE_FILE_HEADER*)(FileBufferPoint + _image_dos_header->e_lfanew + sizeof(PE));
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	int size = _image_optional_header->SizeOfImage;
	char* ptr_2 = (char*)malloc(size);
	if (ptr_2 == NULL) {
		perror("Image堆内存分配失败");
		return 0;
	}
	memset(ptr_2, 0, size);

	for (unsigned int i = 0; i < _image_optional_header->SizeOfHeaders; i++) {
		*(ptr_2 + i) = *(FileBufferPoint + i);
	}

	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		char* temp_1 = FileBufferPoint + _image_section_header->PointerToRawData;
		char* temp_2 = ptr_2 + _image_section_header->VirtualAddress;
		for (unsigned int j = 0; j < _image_section_header->SizeOfRawData; j++) {
			*(temp_2 + j) = *(temp_1 + j);
		}
		_image_section_header++;
	}

	printf("已成功将可执行文件从FileBuffer读取到ImageBuffer\n");
	return ptr_2;
}

char* CopyImageBufferToNewBuffer(char* ImageBufferPoint) {
	//CopyImageBufferToNewBuffer：将可执行文件从ImageBuffer读取到NewBuffer（其实也就是FileBuffer）
	//参数说明：
	//ImageBufferPoint:指向可执行文件在ImageBuffer的地址
	//返回值说明：
	//读取成功返回NewBuffer（其实也就是FileBuffer）的首地址，读取失败则返回0

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)ImageBufferPoint;
	//下面这个别忘记了还有一个PE标记的大小，为4个字节
	_image_file_header = (_IMAGE_FILE_HEADER*)(ImageBufferPoint + _image_dos_header->e_lfanew + sizeof(PE));
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	int ImageSectionSize = 0;
	_IMAGE_SECTION_HEADER* _image_section_header_temp = _image_section_header;
	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		ImageSectionSize += _image_section_header_temp->PointerToRawData;
		_image_section_header_temp++;
	}
	char* ptr_3 = (char*)malloc(_image_optional_header->SizeOfHeaders + ImageSectionSize);
	if (ptr_3 == NULL) {
		perror("NewBuffer堆内存分配失败");
		return 0;
	}
	memset(ptr_3, 0, _image_optional_header->SizeOfHeaders + ImageSectionSize);

	for (unsigned int i = 0; i < _image_optional_header->SizeOfHeaders; i++) {
		*(ptr_3 + i) = *(ImageBufferPoint + i);
	}

	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		char* temp_1 = ImageBufferPoint + _image_section_header->VirtualAddress;
		char* temp_2 = ptr_3 + _image_section_header->PointerToRawData;
		for (unsigned int j = 0; j < _image_section_header->SizeOfRawData; j++) {
			*(temp_2 + j) = *(temp_1 + j);
		}
		_image_section_header++;
	}

	printf("已成功将可执行文件从ImageBuffer读取到NewBuffer\n");
	return ptr_3;
}

int MemeryToFile(char* NewBufferPoint, char* SavePath) {
	//MemeryTOFile：将可执行文件从NewBuffer读取到硬盘
	//参数说明：
	//NewBufferPoint：指向NewBuffer的首地址
	//SavePath：指向另存为文件的绝对路径
	//返回值说明：
	//读取成功返回1，读取失败则返回0

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)NewBufferPoint;
	//下面这个别忘记了还有一个PE标记的大小，为4个字节
	_image_file_header = (_IMAGE_FILE_HEADER*)(NewBufferPoint + _image_dos_header->e_lfanew + sizeof(PE));
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	int ImageSectionSize = 0;
	_IMAGE_SECTION_HEADER* _image_section_header_temp = _image_section_header;
	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		ImageSectionSize += _image_section_header_temp->PointerToRawData;
		_image_section_header_temp++;
	}

	int size = _image_optional_header->SizeOfHeaders + ImageSectionSize;
	FILE* pf = fopen(SavePath, "wb");
	if (pf == NULL) {
		perror("打开文件错误");
		fclose(pf);
		return 0;
	}


	int flag = fwrite(NewBufferPoint, size, 1, pf);
	if (flag == NULL) {
		perror("存文件出现错误，请检查文件路径是否有效");
		free(NewBufferPoint);
		fclose(pf);
		return 0;
	}
	fclose(pf);
	return 1;
}

int ImageAddressToFileAddress(char* FileBufferPoint, int ImageAddress) {
	//ImageAddressToFileAddress：将ImageBuffer里面的节地址转换为对应的FileBuffer的节地址
	//参数说明：
	//FileBufferPoint：指向FileBuffer的首地址
	//ImageAddress：传入ImageBuffer里面的节地址
	//返回值说明：
	//转换成功返回节地址，地址不在节内或在空白区则返回0
	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)FileBufferPoint;
	//下面这个别忘记了还有一个PE标记的大小，为4个字节
	_image_file_header = (_IMAGE_FILE_HEADER*)(FileBufferPoint + _image_dos_header->e_lfanew + sizeof(PE));
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	int flag = 0;
	if (_image_section_header->VirtualAddress > ImageAddress - _image_optional_header->ImageBase) {
		return 0;
	}
	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		if (ImageAddress - _image_optional_header->ImageBase >= _image_section_header->VirtualAddress && ImageAddress - _image_optional_header->ImageBase < _image_section_header->VirtualAddress + _image_section_header->Misc.VirtualSize) {
			flag = 1;
			break;
		}
		else {
			_image_section_header++;
		}
	}
	if (flag == 0) {
		return 0;
	}
	int TempAddress = ImageAddress - _image_optional_header->ImageBase - _image_section_header->VirtualAddress;
	return _image_section_header->PointerToRawData + TempAddress;
}

int AddShellCodeToSection(char* ImageBufferPoint, int SectionNum) {
	//AddShellCodeToSection：将shellcode注入到ImageBuffer里面的任意节
	//参数说明：
	//ImageBufferPoint：指向FileBuffer的首地址
	//SectionNum：要注入的节的位置
	//返回值说明：
	//注入成功返回1，反之则返回0

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)ImageBufferPoint;
	//下面这个别忘记了还有一个PE标记的大小，为4个字节
	_image_file_header = (_IMAGE_FILE_HEADER*)(ImageBufferPoint + _image_dos_header->e_lfanew + sizeof(PE));
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	if (SectionNum < 0 || SectionNum>_image_file_header->NumberOfSections) {
		printf("输入的节不存在，请重新输入\n");
		return 0;
	}

	_IMAGE_SECTION_HEADER* temp_image_section_header = _image_section_header + SectionNum - 1;

	if ((int)(temp_image_section_header->SizeOfRawData - temp_image_section_header->Misc.VirtualSize) < sizeof(shellcode) / sizeof(shellcode[0])) {

		printf("该节空间不足，无法加壳");
		return 0;
	}

	char* ShellCodePoint = ImageBufferPoint + temp_image_section_header->VirtualAddress + temp_image_section_header->Misc.VirtualSize;
	for (int i = 0; i < sizeof(shellcode) / sizeof(shellcode[0]); i++) {
		*(ShellCodePoint + i) = shellcode[i];
	}

	DWORD E8Address = (DWORD)ShellCodePoint - (DWORD)ImageBufferPoint + _image_optional_header->ImageBase + 8;
	DWORD E8Data = MessageBox_Address - (E8Address + 5);
	*(DWORD*)(ShellCodePoint + 9) = E8Data;

	DWORD E9Address = E8Address + 5;
	DWORD E9Data = _image_optional_header->ImageBase + _image_optional_header->AddressOfEntryPoint - (E9Address + 5);
	*(DWORD*)(ShellCodePoint + 14) = E9Data;

	_image_optional_header->AddressOfEntryPoint = (DWORD)(ShellCodePoint - ImageBufferPoint);
	temp_image_section_header->Characteristics = temp_image_section_header->Characteristics | 0x60000020;

	return 1;
}

OK 大家快去找个程序的 MessageBoxA 去测试测试吧（对应的改一下文件的路径和那个 MessageBoxA 的地址就可以），我已经测了好多了都可以，开心开心祝大家新年快乐，新的一年发发发！