加壳：挂起方式创建进程

写入部分

1，壳文件新增一个节
2，源文件与Harmonica异或
3，加密后源文件放入新增节中
4，存盘

VOID Shell(WCHAR* shellName, WCHAR* srcName) {
    FILE* fpShell;
    FILE* fpSrc;
    _wfopen_s(&fpShell, shellName, L"rb");
    _wfopen_s(&fpSrc, srcName, L"rb");
    if (fpShell == NULL||fpSrc==NULL) {
        MessageBox(0, L"can't open file", 0, MB_OK);
        return;
    }
    fseek(fpShell, 0, SEEK_END);
    int shellLen = ftell(fpShell);
    fseek(fpShell, 0, SEEK_SET);
    fseek(fpSrc, 0, SEEK_END);
    int srcLen = ftell(fpSrc);
    fseek(fpSrc, 0, SEEK_SET);
    CHAR* shellBuffer = (CHAR*)malloc(2 * (shellLen + srcLen));
    if (shellBuffer != NULL) {
        memset(shellBuffer, '\x00', 2 * (shellLen + srcLen));
        fread(shellBuffer, shellLen , 1, fpShell);
    }
    else {
        return;
    }
    fclose(fpShell);
    CHAR* srcBuffer = (CHAR*)malloc(srcLen);
    if (srcBuffer != NULL) {
        memset(srcBuffer, '\x00', srcLen);
        fread(srcBuffer, srcLen, 1, fpSrc);
    }
    else {
        free(shellBuffer);
        shellBuffer = NULL;
        return;
    }
    fclose(fpSrc);

    DWORD e_lfanew = *(DWORD*)(shellBuffer + 0x3c);
    CHAR* peHeader = shellBuffer + e_lfanew + 0x4;
    CHAR* opHeader = peHeader + 0x14;
    DWORD SectionAlignment = *(DWORD*)(opHeader + 0x20);
    DWORD SizeOfImage = *(DWORD*)(opHeader + 0x38);
    *(DWORD*)(opHeader + 0x38) = SizeOfImage + (srcLen / SectionAlignment + 1) * SectionAlignment;
    SizeOfImage = *(DWORD*)(opHeader + 0x38);
    DWORD SizeoOfHeaders = *(DWORD*)(opHeader + 0x3c);
    WORD NumberOfSections = *(WORD*)(peHeader + 0x2);
    *(WORD*)(peHeader + 0x2) = NumberOfSections + 1;
    WORD SizeOfOptionalHeader = *(WORD*)(peHeader + 0x10);
    CHAR* Sections_addr = opHeader + SizeOfOptionalHeader;

    DWORD Misc;
    DWORD VirtualAddress;
    DWORD SizeOfRawData;
    DWORD PointerToRawData;
    for (DWORD j = 0; j < NumberOfSections; j++) {
        Misc = *(DWORD*)(Sections_addr + 0x8);
        VirtualAddress = *(DWORD*)(Sections_addr + 0xc);
        SizeOfRawData = *(DWORD*)(Sections_addr + 0x10);
        PointerToRawData = *(DWORD*)(Sections_addr + 0x14);
        Sections_addr = Sections_addr + 0x28;
    }
    DWORD check = SizeoOfHeaders - (Sections_addr - shellBuffer);
    if (check < 0x50) {//太小了无法新增节
        free(shellBuffer);
        shellBuffer = NULL;
        free(srcBuffer);
        srcBuffer = NULL;
        return;
    }

    DWORD newSec_addr = VirtualAddress + SectionAlignment;
    DWORD newSec_PointerToRawData = PointerToRawData + SizeOfRawData;
    *(DWORD64*)Sections_addr = 0x000000007261482e;
    *(DWORD*)(Sections_addr + 0x8) = srcLen;
    *(DWORD*)(Sections_addr + 0xc) = newSec_addr;
    *(DWORD*)(Sections_addr + 0x10) = (srcLen / SectionAlignment + 1) * SectionAlignment;
    *(DWORD*)(Sections_addr + 0x14) = newSec_PointerToRawData;
    *(DWORD*)(Sections_addr + 0x24) = 0xC0000040;

    UCHAR key[9] = { 0x48,0x61,0x72,0x6d,0x6f,0x6e,0x69,0x63,0x61 };
    for (DWORD i = 0; i < srcLen; i++) {
        *(UCHAR*)(shellBuffer + newSec_PointerToRawData + i) = *(UCHAR*)(srcBuffer + i) ^ key[i % 9];
    }

    FILE* fpout;
    WCHAR fileName[256] = { 0 };
    wcscpy(fileName, srcName);
    WCHAR* tmp = wcsstr(fileName, L".exe");
    wcscpy(tmp, L"_shell.exe");
    _wfopen_s(&fpout, fileName, L"wb");
    if (fpout == NULL) {
        free(shellBuffer);
        shellBuffer = NULL;
        free(srcBuffer);
        srcBuffer = NULL;
        return;
    }
    fwrite(shellBuffer, (srcLen / SectionAlignment + 1) * SectionAlignment + newSec_PointerToRawData, 1, fpout);
    
    fclose(fpout);
    free(shellBuffer);
    shellBuffer = NULL;
    free(srcBuffer);
    srcBuffer = NULL;
    MessageBox(0, L"加壳成功", L"", MB_OK);
}

壳部分

1，解密源文件
2，拉伸源文件
3，以挂起方式创建进程，获取进程信息
4，强制卸载进程模块
5，在进程内分配空间
6，修复重定位表
7，源文件写入进程
8，修复Imagebase和oep
9，恢复进程

#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>

CONTEXT cs;
CHAR* SrcBuffer;            //
CHAR* ImageBuffer;            //拉伸后的源文件
DWORD SizeOfImage;
DWORD ImageBase;
DWORD OEP;

LPVOID lp;                    //VirtualAllocEx返回的地址
BOOL HasReloc = FALSE;


BOOL UnloadShell(HANDLE ProcHnd, unsigned long BaseAddr)
{
    typedef unsigned long(__stdcall* pfZwUnmapViewOfSection)(unsigned long, unsigned long);
    pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;
    BOOL res = FALSE;
    HMODULE m = LoadLibraryA("ntdll.dll");
    if (m) {
            ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress(m, "ZwUnmapViewOfSection");
            if (ZwUnmapViewOfSection)
                res = (ZwUnmapViewOfSection((unsigned long)ProcHnd, BaseAddr) == 0);
            FreeLibrary(m);
    }
    return res;
}

BOOL DecodeSrc(HANDLE hShellModule) {
    //解密源程序
    CHAR* lpShellModule = (CHAR*)hShellModule;
    DWORD e_lfanew = *(DWORD*)(lpShellModule + 0x3c);
    CHAR* peHeader = lpShellModule + e_lfanew + 0x4;
    CHAR* opHeader = peHeader + 0x14;
    WORD NumberOfSections = *(WORD*)(peHeader + 0x2);
    WORD SizeOfOptionalHeader = *(WORD*)(peHeader + 0x10);
    CHAR* Sections_addr = opHeader + SizeOfOptionalHeader;
    DWORD Misc;
    DWORD VirtualAddress;
    DWORD SizeOfRawData;
    DWORD PointerToRawData;
    for (DWORD j = 0; j < NumberOfSections - 1; j++) {
        Sections_addr = Sections_addr + 0x28;
    }

    if (*(DWORD64*)Sections_addr != 0x000000007261482e) {
        return FALSE;
    }

    UCHAR key[9] = { 0x48,0x61,0x72,0x6d,0x6f,0x6e,0x69,0x63,0x61 };
    DWORD srcLen = *(DWORD*)(Sections_addr + 0x8);
    CHAR* lpSrc = lpShellModule + *(DWORD*)(Sections_addr + 0xc);
    SrcBuffer = (CHAR*)malloc(srcLen + 1);
    if (SrcBuffer != NULL) {
        memset(SrcBuffer, '\x00', srcLen + 1);
        for (DWORD i = 0; i < srcLen; i++) {
            *(SrcBuffer + i) = *(lpSrc + i) ^ key[i % 9];
        }
    }
    else {
        return FALSE;
    }
    return TRUE;
}

BOOL ExtendSrc() {
    WORD peCheck = *(WORD*)(SrcBuffer);
    if (peCheck != 0x5A4D) {
        return FALSE;
    }
    DWORD e_lfanew = *(DWORD*)(SrcBuffer + 0x3c);
    CHAR* peHeader = SrcBuffer + e_lfanew + 0x4;
    CHAR* opHeader = peHeader + 0x14;
    DWORD SectionAlignment = *(DWORD*)(opHeader + 0x20);
    SizeOfImage = *(DWORD*)(opHeader + 0x38);
    ImageBase = *(DWORD*)(opHeader + 0x1c);
    OEP = *(DWORD*)(opHeader + 0x10);
    if (*(DWORD*)(opHeader + 0x60 + 0x28) != NULL) {
        HasReloc = TRUE;
    }
    DWORD SizeoOfHeaders = *(DWORD*)(opHeader + 0x3c);
    WORD NumberOfSections = *(WORD*)(peHeader + 0x2);
    WORD SizeOfOptionalHeader = *(WORD*)(peHeader + 0x10);
    CHAR* Sections_addr = opHeader + SizeOfOptionalHeader;
    
    ImageBuffer = (CHAR*)malloc(SizeOfImage + 1);
    if (ImageBuffer == NULL) {
        return FALSE;
    }
    else {
        memset(ImageBuffer, '\x00', SizeOfImage + 1);
    }
    memcpy(ImageBuffer, SrcBuffer, SizeoOfHeaders);
    
    DWORD Misc;
    DWORD VirtualAddress;
    DWORD SizeOfRawData;
    DWORD PointerToRawData;
    for (DWORD j = 0; j < NumberOfSections; j++) {
        Misc = *(DWORD*)(Sections_addr + 0x8);
        VirtualAddress = *(DWORD*)(Sections_addr + 0xc);
        SizeOfRawData = *(DWORD*)(Sections_addr + 0x10);
        PointerToRawData = *(DWORD*)(Sections_addr + 0x14);
        if (SizeOfRawData == NULL) {
            Sections_addr = Sections_addr + 0x28;
            continue;
        }
        if (Misc > SizeOfRawData) {
            memcpy(ImageBuffer + VirtualAddress, SrcBuffer + PointerToRawData, Misc);
        }
        else {
            memcpy(ImageBuffer + VirtualAddress, SrcBuffer + PointerToRawData, SizeOfRawData);
        }
        Sections_addr = Sections_addr + 0x28;
    }
    free(SrcBuffer);
    SrcBuffer = NULL;
    return TRUE;
}

VOID repairReloc(DWORD newAddr) {
    DWORD e_lfanew = *(DWORD*)(ImageBuffer + 0x3c);
    CHAR* peHeader = ImageBuffer + e_lfanew + 0x4;
    CHAR* opHeader = peHeader + 0x14;
    DWORD relocRVA = *(DWORD*)(opHeader + 0x60 + 0x28);
    
    CHAR* addr = ImageBuffer + relocRVA;
    CHAR* size = addr + 4;
    CHAR* data = size + 4;
    while (*(DWORD*)addr != 0 && *(DWORD*)size != 0) {
        DWORD num = (*(DWORD*)size - 8) / 2;
        for (DWORD i = 0; i < num; i++) {
            WORD Characteristics = (*(WORD*)data & 0xf000) >> 12;
            WORD offset = *(WORD*)data & 0x0fff;
            if (Characteristics == 0x3) {
                DWORD NewData = *(DWORD*)(ImageBuffer + *(DWORD*)addr + offset) - ImageBase + newAddr;
                *(DWORD*)(ImageBuffer + *(DWORD*)addr + offset) = NewData;
            }
            data += 2;
        }
        addr += *(DWORD*)size;
        size = addr + 4;
        data = size + 4;
    }
}

BOOL MyAlloc(HANDLE p) {
    lp = VirtualAllocEx(p, (VOID*)ImageBase, SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (lp == NULL) {
        if (HasReloc) {
            lp = VirtualAllocEx(p, NULL, SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            if (lp == NULL) {
                return FALSE;
            }
            repairReloc((DWORD)lp);
        }
        else
        {
            return FALSE;
        }
    }
    return TRUE;
}

int main()
{
    LPWSTR fileName;
    fileName = GetCommandLineW();
    HANDLE hShellProcess = GetCurrentProcess();
    HANDLE hShellModule = GetModuleHandleW(NULL);
    cs.ContextFlags = CONTEXT_FULL;

    //解密源文件
    BOOL isDecode = DecodeSrc(hShellModule);
    if (isDecode == FALSE) {
        return 0;
    }
    //拉伸源文件
    BOOL isExtend = ExtendSrc();
    if (isExtend == FALSE) {
        free(SrcBuffer);
        SrcBuffer = NULL;
    //    return 0;
    }

    //以挂起方式创建进程
    STARTUPINFO s = { 0 };
    s.cb = sizeof(STARTUPINFO);
    PROCESS_INFORMATION p;
    ::CreateProcess(
        NULL,
        fileName,
        NULL, NULL,
        FALSE,
        CREATE_SUSPENDED,
        NULL, NULL,
        &s, &p);
    //获取进程信息
    GetThreadContext(p.hThread, &cs);
    DWORD shellOEP = cs.Eax;
    CHAR* baseAddress = (CHAR*)cs.Ebx + 8;
    TCHAR szBuffer[4] = { 0 };
    ReadProcessMemory(p.hProcess, baseAddress, szBuffer, 4, NULL);
    DWORD shellImageBase = *(DWORD*)szBuffer;

    //卸载模块
    BOOL UnloadCheck = UnloadShell(p.hProcess, shellImageBase);
    if (UnloadCheck == FALSE) {
        free(ImageBuffer);
        ImageBuffer = NULL;
        ::TerminateProcess(p.hProcess, 0);
        return 0;
    }

    //分配空间
    BOOL allocCheck = MyAlloc(p.hProcess);
    if (allocCheck == FALSE) {
        free(ImageBuffer);
        ImageBuffer = NULL;
        ::TerminateProcess(p.hProcess, 0);
        return 0;
    }

    BOOL writeCheck = WriteProcessMemory(p.hProcess, lp, ImageBuffer, SizeOfImage, NULL);
    if (writeCheck == FALSE) {
        free(ImageBuffer);
        ImageBuffer = NULL;
        ::TerminateProcess(p.hProcess, 0);
        return 0;
    }

    //更改Imagebase和oep
    WriteProcessMemory(p.hProcess, (LPVOID)(cs.Ebx + 8), &lp, sizeof(DWORD), NULL);
    cs.Eax = (DWORD)lp + OEP;
    SetThreadContext(p.hThread, &cs);
    //::TerminateProcess(p.hProcess, 0);
    ::ResumeThread(p.hThread);
    ::CloseHandle(p.hProcess);
    
    return 0;

}

因为我没修复IAT表，使用API会挂