forked from StyGame/kapiao
-
Notifications
You must be signed in to change notification settings - Fork 0
/
dllmain.cpp
2071 lines (1951 loc) · 154 KB
/
dllmain.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#include "stdafx.h"
#include "stdio.h"
#include <stdlib.h>
#include <intrin.h>
// #include <psapi.h>
// #include <tlhelp32.h>
// #pragma comment(lib,"psapi.lib")
#include "resource.h"
#include <tlhelp32.h>
#pragma comment(lib,"User32.lib")
//extern "C" ULONG _memset;
//#define _dbg //kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;msvcrtd.lib;vcruntimed.lib;ucrtd.lib;%(AdditionalDependencies)
HMODULE SELF = NULL;
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
//#define DBG__
typedef struct _STRING {
USHORT Length;
USHORT MaximumLength;
#ifdef MIDL_PASS
[size_is(MaximumLength), length_is(Length)]
#endif // MIDL_PASS
_Field_size_bytes_part_opt_(MaximumLength, Length) PCHAR Buffer;
} STRING;
typedef STRING *PSTRING;
typedef STRING ANSI_STRING;
typedef PSTRING PANSI_STRING;
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
#ifdef MIDL_PASS
[size_is(MaximumLength / 2), length_is((Length) / 2)] USHORT * Buffer;
#else // MIDL_PASS
_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer;
#endif // MIDL_PASS
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef _Null_terminated_ CHAR *PSZ;
typedef _Null_terminated_ CONST char *PCSZ;
typedef struct _CSTRING {
USHORT Length;
USHORT MaximumLength;
CONST char *Buffer;
} CSTRING;
typedef CSTRING *PCSTRING;
#define ANSI_NULL ((CHAR)0) // winnt
typedef STRING CANSI_STRING;
typedef PSTRING PCANSI_STRING;
typedef BOOL(NTAPI* _RtlDispatchExceptionAddr)(PEXCEPTION_RECORD pExcptRec, PCONTEXT pContext);
typedef BOOL(WINAPI* _GetTC)(HANDLE hThread, LPCONTEXT lpContext);
typedef BOOL(WINAPI* _GetMessage)(_Out_ LPMSG lpMsg, _In_opt_ HWND hWnd, _In_ UINT wMsgFilterMin, _In_ UINT wMsgFilterMax);
typedef int (WINAPI* _MessageBoxTimeoutA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType, WORD wLanguageId, DWORD dwMilliseconds);
_MessageBoxTimeoutA MessageBoxTimeoutA = NULL;
typedef DWORD (WINAPI*_GetCurrentThreadID)(VOID);
typedef ULONG (WINAPI *fn_NtDelayExecution)(IN BOOLEAN Alertable, IN PLARGE_INTEGER Interval);
typedef BOOL (WINAPI*fn_WriteProcessMemory)(_In_ HANDLE hProcess, _In_ LPVOID lpBaseAddress, _In_reads_bytes_(nSize) LPCVOID lpBuffer, _In_ SIZE_T nSize, _Out_opt_ SIZE_T* lpNumberOfBytesWritten);
typedef int (WINAPI*fn_MessageBoxA)(_In_opt_ HWND hWnd, _In_opt_ LPCSTR lpText, _In_opt_ LPCSTR lpCaption, _In_ UINT uType);
typedef BOOL (WINAPI*fn_VirtualFree)(LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD dwFreeType);
typedef BOOL (WINAPI*fn_DeleteFileA)(_In_ LPCSTR lpFileName);
typedef ULONG(WINAPI *fn_ZwSetEvent)(HANDLE EventHandle, PLONG PreviousState);
typedef HMODULE(WINAPI *fn_GetModuleHandleA)(_In_opt_ LPCSTR lpModuleName);
typedef BOOL(WINAPI *fn_ReadProcessMemory)(_In_ HANDLE hProcess, _In_ LPCVOID lpBaseAddress, _Out_writes_bytes_to_(nSize, *lpNumberOfBytesRead) LPVOID lpBuffer, _In_ SIZE_T nSize, _Out_opt_ SIZE_T* lpNumberOfBytesRead);
typedef long(__cdecl *fn_strtol)(_In_z_ char const* _String, _Out_opt_ _Deref_post_z_ char** _EndPtr, _In_ int _Radix);
typedef int(__cdecl *fn_strcmp)(_In_z_ char const* _Str1, _In_z_ char const* _Str2);
typedef size_t(__cdecl *fn_strlen)(_In_z_ char const* _Str);
typedef FARPROC(WINAPI *fn_GetProcAddress)(_In_ HMODULE hModule, _In_ LPCSTR lpProcName);
typedef LPVOID(WINAPI *fn_VirtualAlloc)(_In_opt_ LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD flAllocationType, _In_ DWORD flProtect);
typedef DWORD(WINAPI *fn_GetCurrentProcessId)(VOID);
typedef HANDLE(WINAPI *fn_OpenProcess)(_In_ DWORD dwDesiredAccess, _In_ BOOL bInheritHandle, _In_ DWORD dwProcessId);
typedef BOOL(WINAPI *fn_TerminateProcess)(_In_ HANDLE hProcess, _In_ UINT uExitCode);
typedef BOOL(WINAPI *fn_CloseHandle)(_In_ _Post_ptr_invalid_ HANDLE hObject);
typedef HANDLE(WINAPI *fn_OpenThread)(_In_ DWORD dwDesiredAccess, _In_ BOOL bInheritHandle, _In_ DWORD dwThreadId);
typedef DWORD(WINAPI *fn_GetModuleFileNameA)(_In_opt_ HMODULE hModule, _Out_writes_to_(nSize, ((return < nSize) ? (return +1) : nSize)) LPSTR lpFilename, _In_ DWORD nSize);
typedef size_t(__cdecl *fn_strlen)(_In_z_ char const* _Str);
typedef int(__cdecl *fn_strnicmp)(_In_reads_or_z_(_MaxCount) char const* _String1, _In_reads_or_z_(_MaxCount) char const* _String2, _In_ size_t _MaxCount);
typedef char* (__CRTDECL *fn_strrchr)(_In_z_ char* const _String, _In_ int const _Ch);
typedef int (WINAPI *fn_MessageBoxA)(_In_opt_ HWND hWnd, _In_opt_ LPCSTR lpText, _In_opt_ LPCSTR lpCaption, _In_ UINT uType);
typedef HMODULE(WINAPI *fn_LoadLibraryA)(_In_ LPCSTR lpLibFileName);
typedef VOID(WINAPI *RtlFreeUnicodeStringT)(_Inout_ PUNICODE_STRING UnicodeString);
typedef VOID(WINAPI *RtlInitAnsiStringT)(_Out_ PANSI_STRING DestinationString, _In_opt_ PCSZ SourceString);
typedef NTSTATUS(WINAPI *RtlAnsiStringToUnicodeStringT)(_Inout_ PUNICODE_STRING DestinationString, _In_ PCANSI_STRING SourceString, _In_ BOOLEAN AllocateDestinationString);
typedef NTSTATUS(WINAPI *LdrLoadDllT)(PWCHAR, PULONG, PUNICODE_STRING, PULONG);
typedef int(__cdecl *fn_memcmp)(_In_reads_bytes_(_Size) void const* _Buf1, _In_reads_bytes_(_Size) void const* _Buf2, _In_ size_t _Size);
typedef DWORD(WINAPI *fn_GetCurrentThreadId)(VOID);
typedef HANDLE(WINAPI *fn_CreateThread)(_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, _In_ SIZE_T dwStackSize, _In_ LPTHREAD_START_ROUTINE lpStartAddress, _In_opt_ __drv_aliasesMem LPVOID lpParameter, _In_ DWORD dwCreationFlags, _Out_opt_ LPDWORD lpThreadId);
typedef DWORD(WINAPI *fn_WaitForSingleObject)(_In_ HANDLE hHandle, _In_ DWORD dwMilliseconds);
typedef VOID(WINAPI *fn_PostQuitMessage)(_In_ int nExitCode);
typedef DWORD(WINAPI *fn_SuspendThread)(_In_ HANDLE hThread);
typedef DWORD(WINAPI *fn_ResumeThread)(_In_ HANDLE hThread);
typedef BOOL(WINAPI *fn_GetThreadContext)(_In_ HANDLE hThread, _Inout_ LPCONTEXT lpContext);
typedef HANDLE(WINAPI *fn_GetCurrentThread)(VOID);
typedef BOOL(WINAPI *fn_SetThreadContext)(_In_ HANDLE hThread, _In_ CONST CONTEXT* lpContext);
typedef HANDLE(WINAPI *fn_CreateToolhelp32Snapshot)(DWORD dwFlags, DWORD th32ProcessID);
typedef BOOL(WINAPI *fn_Thread32First)(HANDLE hSnapshot, LPTHREADENTRY32 lpte);
typedef BOOL(WINAPI *fn_Thread32Next)(HANDLE hSnapshot, LPTHREADENTRY32 lpte);
typedef ULONG(WINAPI* fn_ZwSetInformationThread)(HANDLE ThreadHandle, ULONG ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength);
typedef INT_PTR(WINAPI *fn_DialogBoxParamA)(_In_opt_ HINSTANCE hInstance, _In_ LPCSTR lpTemplateName, _In_opt_ HWND hWndParent, _In_opt_ DLGPROC lpDialogFunc, _In_ LPARAM dwInitParam);
typedef BOOL(WINAPI *fn_EndDialog)(_In_ HWND hDlg, _In_ INT_PTR nResult);
typedef HANDLE(WINAPI *fn_CreateEventA)(_In_opt_ LPSECURITY_ATTRIBUTES lpEventAttributes, _In_ BOOL bManualReset, _In_ BOOL bInitialState, _In_opt_ LPCSTR lpName);
typedef BOOL(WINAPI *fn_SetWindowPos)(_In_ HWND hWnd, _In_opt_ HWND hWndInsertAfter, _In_ int X, _In_ int Y, _In_ int cx, _In_ int cy, _In_ UINT uFlags);
typedef HINSTANCE(WINAPI *fn_ShellExecuteA)(_In_opt_ HWND hwnd, _In_opt_ LPCSTR lpOperation, _In_ LPCSTR lpFile, _In_opt_ LPCSTR lpParameters, _In_opt_ LPCSTR lpDirectory, _In_ INT nShowCmd);
typedef UINT(WINAPI *fn_WinExec)(_In_ LPCSTR lpCmdLine, _In_ UINT uCmdShow);
typedef HANDLE(WINAPI *fn_CreateFileA)(_In_ LPCSTR lpFileName, _In_ DWORD dwDesiredAccess, _In_ DWORD dwShareMode, _In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes, _In_ DWORD dwCreationDisposition, _In_ DWORD dwFlagsAndAttributes, _In_opt_ HANDLE hTemplateFile);
typedef HWND(WINAPI *fn_GetDlgItem)(_In_opt_ HWND hDlg, _In_ int nIDDlgItem);
typedef LRESULT(WINAPI *fn_SendMessageA)(_In_ HWND hWnd, _In_ UINT Msg, _Pre_maybenull_ _Post_valid_ WPARAM wParam, _Pre_maybenull_ _Post_valid_ LPARAM lParam);
typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress, // Obsolete
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
ThreadSwitchLegacyState,
ThreadIsTerminated,
ThreadLastSystemCall,
ThreadIoPriority,
ThreadCycleTime,
ThreadPagePriority,
ThreadActualBasePriority,
ThreadTebInformation,
ThreadCSwitchMon, // Obsolete
ThreadCSwitchPmu,
ThreadWow64Context,
ThreadGroupInformation,
ThreadUmsInformation, // UMS
ThreadCounterProfiling,
ThreadIdealProcessorEx,
MaxThreadInfoClass
} THREADINFOCLASS;
fn_ResumeThread gpfn_ResumeThread;
fn_SuspendThread gpfn_SuspendThread;
fn_ReadProcessMemory gpfn_ReadProcessMemory;
fn_WriteProcessMemory gpfn_WriteProcessMemory;
fn_GetModuleHandleA gpfn_GetModuleHandleA;
fn_strtol gpfn_strtol;
fn_strcmp gpfn_strcmp;
fn_strlen gpfn_strlen;
fn_GetProcAddress gpfn_GetProcAddress;
fn_VirtualAlloc gpfn_VirtualAlloc;
fn_VirtualFree gpfn_VirtualFree;
fn_GetCurrentProcessId gpfn_GetCurrentProcessId;
fn_OpenProcess gpfn_OpenProcess;
fn_TerminateProcess gpfn_TerminateProcess;
fn_CloseHandle gpfn_CloseHandle;
fn_OpenThread gpfn_OpenThread;
fn_GetModuleFileNameA gpfn_GetModuleFileNameA;
fn_strnicmp gpfn_strnicmp;
fn_strrchr gpfn_strrchr;
fn_MessageBoxA gpfn_MessageBoxA;
fn_LoadLibraryA gpfn_LoadLibraryA;
LdrLoadDllT pLdrLoadDll;
RtlInitAnsiStringT RtlInitAnsiString_;
RtlAnsiStringToUnicodeStringT RtlAnsiStringToUnicodeString_;
RtlFreeUnicodeStringT RtlFreeUnicodeString_;
fn_memcmp gpfn_memcmp;
fn_GetCurrentThreadId gpfn_GetCurrentThreadId;
fn_CreateThread gpfn_CreateThread;
fn_WaitForSingleObject gpfn_WaitForSingleObject;
fn_PostQuitMessage gpfn_PostQuitMessage;
fn_GetThreadContext gpfn_GetThreadContext;
fn_GetCurrentThread gpfn_GetCurrentThread;
fn_SetThreadContext gpfn_SetThreadContext;
fn_CreateToolhelp32Snapshot gpfn_CreateToolhelp32Snapshot;
fn_Thread32First gpfn_Thread32First;
fn_Thread32Next gpfn_Thread32Next;
fn_ZwSetInformationThread gpfn_ZwSetInformationThread;
fn_EndDialog pfn_EndDialog;
fn_DialogBoxParamA pfn_DialogBoxParamA;
fn_CreateEventA pfn_CreateEventA;
fn_SetWindowPos pfn_SetWindowPos;
//fn_ShellExecuteA pfn_ShellExecuteA;
fn_WinExec pfn_WinExec;
fn_CreateFileA pfn_CreateFileA;
fn_GetDlgItem pfn_GetDlgItem;
fn_SendMessageA pfn_SendMessageA;
#define DELAY_ONE_MICROSECOND (-10)
#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND*1000)
#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND*1000)
typedef struct _SYSTEM_ROUTINE_ADDRESS {
ULONG Top_Kart_Base;
fn_NtDelayExecution pfn_NtDelayExecution;
fn_WriteProcessMemory pfn_WriteProcessMemory;
fn_VirtualFree pfn_VirtualFree;
fn_DeleteFileA pfn_DeleteFileA;
fn_ZwSetEvent pfn_ZwSetEvent;
CHAR PATH[512];
BYTE jmpcode[5];
ULONG ToAddr;
PUCHAR JmpFunAddr;
PVOID memStart;
HANDLE g_hEvent;
INT OFFSET1;
INT OFFSET2;
INT OFFSET3;
INT OFFSET4;
INT OFFSET5;
INT OFFSET6;
INT OFFSET7;
}SYSTEM_ROUTINE_ADDRESS, *PSYSTEM_ROUTINE_ADDRESS;
PSYSTEM_ROUTINE_ADDRESS g_pSysRotineAddr = NULL;
ULONG SizeOfFunc(PUCHAR FuncAddr) {
if (FuncAddr[0] == 0xE9) {
FuncAddr = *(int*)(FuncAddr + 1) + FuncAddr + 5;
}
for (ULONG i = 0; i < 0x1000; i++) {
// /*if (FuncAddr[i] == 0xC3 && FuncAddr[i + 1] == 0xCC && FuncAddr[i + 2] == 0xCC && FuncAddr[i + 3] == 0xCC) {
// return i + 1; }
// if (FuncAddr[i] == 0xcc && FuncAddr[i + 1] == 0xcc && FuncAddr[i + 2] == 0xcc && FuncAddr[i + 3] == 0xcc && FuncAddr[i + 4] == 0xCC) {
// return i; }
// if (FuncAddr[i] == 0x5d && FuncAddr[i + 1] == 0xc2 && FuncAddr[i + 2] == 0x10 && FuncAddr[i + 3] == 0x00 && ((FuncAddr[i + 4] == 0xCC) || (FuncAddr[i + 4] == 0x00))) {
// return i + 4; }
// if (FuncAddr[i] == 0x5d && FuncAddr[i + 1] == 0xc2 && FuncAddr[i + 2] == 0x08 && FuncAddr[i + 3] == 0x00 && ((FuncAddr[i + 4] == 0xCC) || (FuncAddr[i + 4] == 0x00) || (FuncAddr[i + 4] == 0x0F))) {
// return i + 4;
// }
// if (FuncAddr[i] == 0x5d && FuncAddr[i + 1] == 0xc2 && FuncAddr[i + 2] == 0x04 && FuncAddr[i + 3] == 0x00 && ((FuncAddr[i + 4] == 0xCC))) {
// return i + 4;
// }
// if (FuncAddr[i] == 0xE9 && FuncAddr[i + 2] == 0xFF && FuncAddr[i + 3] == 0xFF && FuncAddr[i + 4] == 0xFF) {
// return i + 5;
// }*/
if (FuncAddr[i] == 0xFF && FuncAddr[i + 1] == 0xD3 && FuncAddr[i + 2] == 0xEB) {
return i + 5;
}
}
return 0x1000;
}
ULONG ToShellCode(PUCHAR OrgFun,PVOID ToAddr,ULONG size,PVOID NewData) {
if (OrgFun != NULL) {
if (OrgFun[0] == 0xE9) {
OrgFun = *(int*)(OrgFun + 1) + OrgFun + 5;
}
PUCHAR pRepRoutinePoint = NULL;
BOOL s = gpfn_WriteProcessMemory((HANDLE)-1, ToAddr, OrgFun, size, 0);
pRepRoutinePoint = (PUCHAR)ToAddr;
for (int i = 0; i < size - sizeof(ULONG); i++)
{
if (*(ULONG*)(&pRepRoutinePoint[i]) == (ULONG)&g_pSysRotineAddr)
{
PVOID fined = &pRepRoutinePoint[i];
gpfn_WriteProcessMemory((HANDLE)-1, fined, &NewData, sizeof(NewData),0);
return size;
}
}
}
return 0;
}
VOID MakeJmp(PVOID OrgFun,PVOID NewFun) {
BYTE jmpcode[] = { 0xe9,0x90,0x90,0x90,0x90 };
*(ULONG*)(jmpcode + 1) = (ULONG)NewFun - ((ULONG)OrgFun + 5);
gpfn_WriteProcessMemory((HANDLE)-1, OrgFun, jmpcode, 5, 0);
return;
}
BYTE buf[0x1500];
BYTE buf2[0x1500];
DWORD ScanAddress2(HANDLE process, const char *markCode, DWORD distinct, DWORD beginAddr, DWORD findMode, LPDWORD offset, DWORD endAddrOffset, DWORD pageSize = 0x1100, BOOL markCodeFlag = 0)
{
// union Base
// {
// DWORD address;
// BYTE data[4];
// };
//CString tmp;
//结束地址
const DWORD endAddr = beginAddr + endAddrOffset;
//每次读取游戏内存数目的大小
BYTE *m_code;
int len;
// AfxMessageBox(L"01");
if (markCodeFlag == 0) {
////////////////////////处理特征码/////////////////////
//特征码长度不能为单数
if (gpfn_strlen(markCode) % 2 != 0) return 0;
//特征码长度
len = gpfn_strlen(markCode) / 2;
//将特征码转换成byte型
ULONG64 ___strA[] = { 0x0000000000002A2A };
m_code = buf;
for (int i = 0; i < len; i++) {
char c[] = { markCode[i * 2], markCode[i * 2 + 1], '\0' };
if (gpfn_strcmp(c, (CHAR*)___strA) == 0) {
m_code[i] = (BYTE)0xCC;
}
else {
m_code[i] = (BYTE)gpfn_strtol(c, NULL, 16);
}
}
// CString fda;
// fda.Format(L"%x", m_code);
// AfxMessageBox(fda);
//CHAR dd[98];
//sprintf(dd, "%X", m_code);
//MessageBox(NULL, dd, "1", MB_OK);
}
else if (markCodeFlag == 1) {
m_code = (BYTE*)markCode;
len = distinct;
}
/////////////////////////查找特征码/////////////////////
BOOL _break = FALSE;
//用来保存在第几页中的第几个找到的特征码
int curPage = 0;
int curIndex = 0;
//Base base;
//每页读取4096个字节
BYTE *page = buf2;
ULONG realpageSize = pageSize - 0x100;
DWORD tmpAddr = beginAddr;
while (tmpAddr <= endAddr - len) {
__stosb(page, 0, pageSize);
gpfn_ReadProcessMemory(process, (LPCVOID)tmpAddr, page, pageSize, 0);
// if (IsBadReadPtr((void*)tmpAddr, 0x100)) {
// curPage++;
// tmpAddr += 0x100;
// // AfxMessageBox(L"03");
// continue;
// }
// STYReadMemory((void*)tmpAddr, page, pageSize);
//在该页中查找特征码
for (int i = 0; i < realpageSize; i++) {
for (int j = 0; j < len; j++) {
//只要有一个与特征码对应不上则退出循环
if (m_code[j] != 0xCC) {
if (m_code[j] != page[i + j]) break;
//找到退出所有循环
}
if (j == len - 1) {
_break = TRUE;
// CString tmp;
// tmp.Format(L"m_code[j]=%x page[i + j]=%x,%x", m_code[j], page[i + j], tmpAddr + i);
// AfxMessageBox(tmp);
if (!findMode) {
curIndex = i;
//base.data[0] = page[curIndex - distinct - 4];
//base.data[1] = page[curIndex - distinct - 3];
//base.data[2] = page[curIndex - distinct - 2];
//base.data[3] = page[curIndex - distinct - 1];
}
else {
curIndex = i + j;
//base.data[0] = page[curIndex + distinct + 1];
//base.data[1] = page[curIndex + distinct + 2];
//base.data[2] = page[curIndex + distinct + 3];
//base.data[3] = page[curIndex + distinct + 4];
}
break;
}
}
if (_break) break;
}
if (_break) break;
curPage++;
tmpAddr += realpageSize;
}
//delete[] page;
if (markCodeFlag == 0) {
//delete[] m_code;
}
if (offset != NULL) {
*offset = curPage * realpageSize + curIndex + beginAddr;
}
if (!_break)
{
return NULL;
}
return tmpAddr + curIndex;
}
DWORD ScanAddress(HANDLE process, const char *markCode, DWORD distinct, DWORD beginAddr, DWORD findMode, LPDWORD offset, DWORD endAddrOffset)
{
DWORD ret = ScanAddress2(process == NULL ? (HANDLE)-1 : process, markCode, distinct, beginAddr, findMode, offset, endAddrOffset, 0x1100, 0);
return ret;
}
#pragma optimize( "gs", off )
ULONG FindAThread(BOOL *isPass) {
typedef ULONG KPRIORITY;
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef enum _KWAIT_REASON {
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
WrKeyedEvent,
WrTerminated,
WrProcessInSwap,
WrCpuRateControl,
WrCalloutStack,
WrKernel,
WrResource,
WrPushLock,
WrMutex,
WrQuantumEnd,
WrDispatchInt,
WrPreempted,
WrYieldExecution,
WrFastMutex,
WrGuardedMutex,
WrRundown,
MaximumWaitReason
} KWAIT_REASON;
typedef enum _THREAD_STATE {
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
} THREAD_STATE;
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PVOID Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
typedef struct _SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
LONG BasePriority;
ULONG ContextSwitches;
THREAD_STATE ThreadState;
KWAIT_REASON WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION {
DWORD NextEntryDelta;
DWORD ThreadCount;
LARGE_INTEGER SpareLi1;
LARGE_INTEGER SpareLi2;
LARGE_INTEGER SpareLi3;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
LSA_UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG_PTR PageDirectoryBase;
//
// This part corresponds to VM_COUNTERS_EX.
// NOTE: *NOT* THE SAME AS VM_COUNTERS!
//
SIZE_T PeakVirtualSize;
ULONG VirtualSize;
SIZE_T PageFaultCount;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
//
// This part corresponds to IO_COUNTERS
//
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
SYSTEM_THREAD_INFORMATION ThreadInfos[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
typedef enum _SYSTEM_INFORMATION_CLASS
{
SystemBasicInformation = 0x0,
SystemProcessorInformation = 0x1,
SystemPerformanceInformation = 0x2,
SystemTimeOfDayInformation = 0x3,
SystemPathInformation = 0x4,
SystemProcessInformation = 0x5,
SystemCallCountInformation = 0x6,
SystemDeviceInformation = 0x7,
SystemProcessorPerformanceInformation = 0x8,
SystemFlagsInformation = 0x9,
SystemCallTimeInformation = 0xa,
SystemModuleInformation = 0xb,
SystemLocksInformation = 0xc,
SystemStackTraceInformation = 0xd,
SystemPagedPoolInformation = 0xe,
SystemNonPagedPoolInformation = 0xf,
SystemHandleInformation = 0x10,
SystemObjectInformation = 0x11,
SystemPageFileInformation = 0x12,
SystemVdmInstemulInformation = 0x13,
SystemVdmBopInformation = 0x14,
SystemFileCacheInformation = 0x15,
SystemPoolTagInformation = 0x16,
SystemInterruptInformation = 0x17,
SystemDpcBehaviorInformation = 0x18,
SystemFullMemoryInformation = 0x19,
SystemLoadGdiDriverInformation = 0x1a,
SystemUnloadGdiDriverInformation = 0x1b,
SystemTimeAdjustmentInformation = 0x1c,
SystemSummaryMemoryInformation = 0x1d,
SystemMirrorMemoryInformation = 0x1e,
SystemPerformanceTraceInformation = 0x1f,
SystemObsolete0 = 0x20,
SystemExceptionInformation = 0x21,
SystemCrashDumpStateInformation = 0x22,
SystemKernelDebuggerInformation = 0x23,
SystemContextSwitchInformation = 0x24,
SystemRegistryQuotaInformation = 0x25,
SystemExtendServiceTableInformation = 0x26,
SystemPrioritySeperation = 0x27,
SystemVerifierAddDriverInformation = 0x28,
SystemVerifierRemoveDriverInformation = 0x29,
SystemProcessorIdleInformation = 0x2a,
SystemLegacyDriverInformation = 0x2b,
SystemCurrentTimeZoneInformation = 0x2c,
SystemLookasideInformation = 0x2d,
SystemTimeSlipNotification = 0x2e,
SystemSessionCreate = 0x2f,
SystemSessionDetach = 0x30,
SystemSessionInformation = 0x31,
SystemRangeStartInformation = 0x32,
SystemVerifierInformation = 0x33,
SystemVerifierThunkExtend = 0x34,
SystemSessionProcessInformation = 0x35,
SystemLoadGdiDriverInSystemSpace = 0x36,
SystemNumaProcessorMap = 0x37,
SystemPrefetcherInformation = 0x38,
SystemExtendedProcessInformation = 0x39,
SystemRecommendedSharedDataAlignment = 0x3a,
SystemComPlusPackage = 0x3b,
SystemNumaAvailableMemory = 0x3c,
SystemProcessorPowerInformation = 0x3d,
SystemEmulationBasicInformation = 0x3e,
SystemEmulationProcessorInformation = 0x3f,
SystemExtendedHandleInformation = 0x40,
SystemLostDelayedWriteInformation = 0x41,
SystemBigPoolInformation = 0x42,
SystemSessionPoolTagInformation = 0x43,
SystemSessionMappedViewInformation = 0x44,
SystemHotpatchInformation = 0x45,
SystemObjectSecurityMode = 0x46,
SystemWatchdogTimerHandler = 0x47,
SystemWatchdogTimerInformation = 0x48,
SystemLogicalProcessorInformation = 0x49,
SystemWow64SharedInformationObsolete = 0x4a,
SystemRegisterFirmwareTableInformationHandler = 0x4b,
SystemFirmwareTableInformation = 0x4c,
SystemModuleInformationEx = 0x4d,
SystemVerifierTriageInformation = 0x4e,
SystemSuperfetchInformation = 0x4f,
SystemMemoryListInformation = 0x50,
SystemFileCacheInformationEx = 0x51,
SystemThreadPriorityClientIdInformation = 0x52,
SystemProcessorIdleCycleTimeInformation = 0x53,
SystemVerifierCancellationInformation = 0x54,
SystemProcessorPowerInformationEx = 0x55,
SystemRefTraceInformation = 0x56,
SystemSpecialPoolInformation = 0x57,
SystemProcessIdInformation = 0x58,
SystemErrorPortInformation = 0x59,
SystemBootEnvironmentInformation = 0x5a,
SystemHypervisorInformation = 0x5b,
SystemVerifierInformationEx = 0x5c,
SystemTimeZoneInformation = 0x5d,
SystemImageFileExecutionOptionsInformation = 0x5e,
SystemCoverageInformation = 0x5f,
SystemPrefetchPatchInformation = 0x60,
SystemVerifierFaultsInformation = 0x61,
SystemSystemPartitionInformation = 0x62,
SystemSystemDiskInformation = 0x63,
SystemProcessorPerformanceDistribution = 0x64,
SystemNumaProximityNodeInformation = 0x65,
SystemDynamicTimeZoneInformation = 0x66,
SystemCodeIntegrityInformation = 0x67,
SystemProcessorMicrocodeUpdateInformation = 0x68,
SystemProcessorBrandString = 0x69,
SystemVirtualAddressInformation = 0x6a,
SystemLogicalProcessorAndGroupInformation = 0x6b,
SystemProcessorCycleTimeInformation = 0x6c,
SystemStoreInformation = 0x6d,
SystemRegistryAppendString = 0x6e,
SystemAitSamplingValue = 0x6f,
SystemVhdBootInformation = 0x70,
SystemCpuQuotaInformation = 0x71,
SystemNativeBasicInformation = 0x72,
SystemErrorPortTimeouts = 0x73,
SystemLowPriorityIoInformation = 0x74,
SystemBootEntropyInformation = 0x75,
SystemVerifierCountersInformation = 0x76,
SystemPagedPoolInformationEx = 0x77,
SystemSystemPtesInformationEx = 0x78,
SystemNodeDistanceInformation = 0x79,
SystemAcpiAuditInformation = 0x7a,
SystemBasicPerformanceInformation = 0x7b,
SystemQueryPerformanceCounterInformation = 0x7c,
SystemSessionBigPoolInformation = 0x7d,
SystemBootGraphicsInformation = 0x7e,
SystemScrubPhysicalMemoryInformation = 0x7f,
SystemBadPageInformation = 0x80,
SystemProcessorProfileControlArea = 0x81,
SystemCombinePhysicalMemoryInformation = 0x82,
SystemEntropyInterruptTimingInformation = 0x83,
SystemConsoleInformation = 0x84,
SystemPlatformBinaryInformation = 0x85,
SystemThrottleNotificationInformation = 0x86,
SystemHypervisorProcessorCountInformation = 0x87,
SystemDeviceDataInformation = 0x88,
SystemDeviceDataEnumerationInformation = 0x89,
SystemMemoryTopologyInformation = 0x8a,
SystemMemoryChannelInformation = 0x8b,
SystemBootLogoInformation = 0x8c,
SystemProcessorPerformanceInformationEx = 0x8d,
SystemSpare0 = 0x8e,
SystemSecureBootPolicyInformation = 0x8f,
SystemPageFileInformationEx = 0x90,
SystemSecureBootInformation = 0x91,
SystemEntropyInterruptTimingRawInformation = 0x92,
SystemPortableWorkspaceEfiLauncherInformation = 0x93,
SystemFullProcessInformation = 0x94,
SystemKernelDebuggerInformationEx = 0x95,
SystemBootMetadataInformation = 0x96,
SystemSoftRebootInformation = 0x97,
SystemElamCertificateInformation = 0x98,
SystemOfflineDumpConfigInformation = 0x99,
SystemProcessorFeaturesInformation = 0x9a,
SystemRegistryReconciliationInformation = 0x9b,
MaxSystemInfoClass = 0x9c,
} SYSTEM_INFORMATION_CLASS;
typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
MaxThreadInfoClass
} THREADINFOCLASS;
typedef DWORD(WINAPI *ZWQUERYSYSTEMINFORMATION) (DWORD, PVOID, DWORD, PDWORD);
typedef LONG(__stdcall *_ZwQueryInformationThread)(HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength);
typedef CLIENT_ID *PCLIENT_ID;
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
char *buf = NULL;
int cnt = 0;
ULONG ThreadStartAddr = 0;
PSYSTEM_THREAD_INFORMATION pSysThread;
CHAR ntdlldll_strA[] = { 'n','t','d','l','l','.','d','l','l','\0' };
HMODULE hNtDll = gpfn_GetModuleHandleA(ntdlldll_strA);
//CHAR addr_str[32];
CHAR zw_[] = { 'Z','w','Q','u','e','r','y','S','y','s','t','e','m','I','n','f','o','r','m','a','t','i','o','n','\0' };
CHAR ZwQueryInformationThread_str[] = { 'Z','w','Q','u','e','r','y','I','n','f','o','r','m','a','t','i','o','n','T','h','r','e','a','d','\0' };
ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)gpfn_GetProcAddress(hNtDll, zw_);
_ZwQueryInformationThread ZwQueryInformationThread = (_ZwQueryInformationThread)gpfn_GetProcAddress(hNtDll, ZwQueryInformationThread_str);
DWORD retlen, truelen;
NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, NULL, 0, &retlen);
IMAGE_DOS_HEADER* dosheader = (IMAGE_DOS_HEADER *)hNtDll;
PIMAGE_NT_HEADERS32 ImageNtHeaders = (PIMAGE_NT_HEADERS32)((BYTE*)dosheader + dosheader->e_lfanew);
ULONG size = ImageNtHeaders->OptionalHeader.SizeOfImage;
truelen = retlen;
BYTE Info[2];
status = ZwQuerySystemInformation(SystemKernelDebuggerInformation, &Info, sizeof(Info), NULL);
if (status == 0)
{
if (Info[0] == 1 || Info[1] == 0)
{
*isPass = FALSE;
}
}
buf = (char *)gpfn_VirtualAlloc(NULL, retlen, MEM_COMMIT, PAGE_READWRITE);
// printf("Size of SYSTEM_THREAD:%d\n", sizeof(PSYSTEM_THREAD_INFORMATION));
status = ZwQuerySystemInformation(SystemProcessInformation, buf, truelen, &retlen);
if (status == 0)
{
PSYSTEM_PROCESS_INFORMATION pSysProcess = (PSYSTEM_PROCESS_INFORMATION)buf;
do
{
cnt++;
// printf("Name:%ws\n", &pSysProcess->ImageName);
// printf("ThreadCnt:%d\t", pSysProcess->NumberOfThreads);
// printf("Priority:%d\t", pSysProcess->BasePriority);
// printf("PID:%4d\t", pSysProcess->ProcessId);
// printf("PPID:%d\n", pSysProcess->InheritedFromProcessId);
// printf("HandleCnt:%d\n", pSysProcess->HandleCount);
//在每一项SYSTEM_PROCESS结构的最后是一个接一个的SYSTEM_THREAD结构
if (*isPass == FALSE) {
HANDLE hProcessHandle = gpfn_OpenProcess(PROCESS_TERMINATE, FALSE, (DWORD)pSysProcess->UniqueProcessId);
if (hProcessHandle != NULL) {
gpfn_TerminateProcess(hProcessHandle, 0);
gpfn_CloseHandle(hProcessHandle);
}
}
//输出每个线程的信息
if (pSysProcess->ThreadCount && ((DWORD)pSysProcess->UniqueProcessId == gpfn_GetCurrentProcessId()))
{
DWORD i = 0;
pSysThread = pSysProcess->ThreadInfos;
for (; i < pSysProcess->ThreadCount; i++)
{
ULONG startaddr = NULL;
HANDLE thread = gpfn_OpenThread(THREAD_QUERY_INFORMATION, FALSE, (DWORD)pSysThread[i].ClientId.UniqueThread);
if (thread != NULL) {
status = ZwQueryInformationThread(thread, ThreadQuerySetWin32StartAddress, &startaddr, sizeof(startaddr), NULL);
gpfn_CloseHandle(thread);
if (startaddr != NULL && (startaddr > (ULONG)hNtDll) && (startaddr < ((ULONG)hNtDll + size))) {
ThreadStartAddr = startaddr;
break;
}
}
pSysThread++;
}
}
//若NextEntryDelta为0,则表明已结束
if (pSysProcess->NextEntryDelta == 0)
{
break;
}
pSysProcess = (PSYSTEM_PROCESS_INFORMATION)((PUCHAR)pSysProcess + pSysProcess->NextEntryDelta);
// printf("===============================================================\n");
} while (1);
}
// printf("Total:%d\n", cnt);
status = gpfn_VirtualFree(buf, truelen, MEM_RELEASE);
return ThreadStartAddr;
/*
typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
MaxThreadInfoClass
} THREADINFOCLASS;
ULONG ThreadStartAddr = 0;
CHAR ntdlldll_strA[] = { 'n','t','d','l','l','.','d','l','l','\0' };
HMODULE hNtDll = GetModuleHandle(ntdlldll_strA);
typedef LONG(__stdcall *_ZwQueryInformationThread)(HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength);
CHAR ZwQueryInformationThread_str[] = { 'Z','w','Q','u','e','r','y','I','n','f','o','r','m','a','t','i','o','n','T','h','r','e','a','d','\0' };
_ZwQueryInformationThread ZwQueryInformationThread = (_ZwQueryInformationThread)GetProcAddress(hNtDll, ZwQueryInformationThread_str);
ULONG status = ZwQueryInformationThread(GetCurrentThread(), ThreadQuerySetWin32StartAddress, &ThreadStartAddr, sizeof(ThreadStartAddr), NULL);
return ThreadStartAddr;*/
}
#pragma optimize( "gs", on )
DWORD WINAPI InitThread(LPVOID Handle) {
PSYSTEM_ROUTINE_ADDRESS g_pSRA = (PSYSTEM_ROUTINE_ADDRESS)g_pSysRotineAddr;
//MessageBox(NULL, "2", "1", MB_OK);
ULONG Top_Kart_Base = g_pSRA->Top_Kart_Base;
fn_NtDelayExecution pfn_NtDelayExecution = g_pSRA->pfn_NtDelayExecution;
fn_WriteProcessMemory pfn_WriteProcessMemory = g_pSRA->pfn_WriteProcessMemory;
fn_VirtualFree pfn_VirtualFree = g_pSRA->pfn_VirtualFree;
fn_DeleteFileA pfn_DeleteFileA = g_pSRA->pfn_DeleteFileA;
// CHAR path[512];
// __movsb((PUCHAR)path, (PUCHAR)g_pSRA->PATH, 512);
ULONG memstart = (ULONG)g_pSRA->memStart;
ULONG toaddr = (ULONG)g_pSRA->ToAddr;
pfn_WriteProcessMemory((HANDLE)-1, (PVOID)g_pSRA->ToAddr, g_pSRA->jmpcode, 5, 0);
pfn_WriteProcessMemory((HANDLE)-1, (PVOID)g_pSRA->JmpFunAddr, (PUCHAR)g_pSRA + sizeof(SYSTEM_ROUTINE_ADDRESS), 32, 0);
g_pSRA->pfn_ZwSetEvent(g_pSRA->g_hEvent, 0);
INT OFFSET1 = g_pSRA->OFFSET1;
INT OFFSET2 = g_pSRA->OFFSET2;
INT OFFSET3 = g_pSRA->OFFSET3;
INT OFFSET4 = g_pSRA->OFFSET4;
INT OFFSET5 = g_pSRA->OFFSET5;
INT OFFSET6 = g_pSRA->OFFSET6;
INT OFFSET7 = g_pSRA->OFFSET7;
__stosb((PUCHAR)g_pSRA, 0, sizeof(SYSTEM_ROUTINE_ADDRESS));
pfn_VirtualFree(g_pSRA, 0, MEM_RELEASE);
pfn_WriteProcessMemory((HANDLE)-1, (PVOID)memstart, (PUCHAR)toaddr+0x6C, 0xC8, 0);
pfn_WriteProcessMemory = 0;
pfn_VirtualFree = 0;
memstart = 0;
toaddr = 0;
//LARGE_INTEGER Interval;
//LARGE_INTEGER Interval50;
LARGE_INTEGER Interval1000;
//Interval50.QuadPart = DELAY_ONE_MILLISECOND * 10;
Interval1000.QuadPart = DELAY_ONE_MILLISECOND * 1000;
while (1) {
// if (toaddr == 0) {
// if (1/*pfn_DeleteFileA(path)*/) {
// toaddr = 1;
// __stosb((PUCHAR)path, 0, 512);
// }
// }
//Interval = Interval1000;
ULONG offset = *(DWORD*)(Top_Kart_Base);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET1);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET2);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET3);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET4);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET7);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET5);
if (offset != 0) {
offset = *(DWORD*)(offset + OFFSET6);
if (offset != 0) {
// ULONG va = *(DWORD*)(offset + 0x4c);
// if (va != 0 && memstart != va) {
// memstart = va;
// *(BYTE*)(offset + 0x4c + 4 + 0) = ((BYTE*)&memstart)[3];
// *(BYTE*)(offset + 0x4c + 4 + 1) = ((BYTE*)&memstart)[0];
// *(BYTE*)(offset + 0x4c + 4 + 2) = ((BYTE*)&memstart)[1];
// *(BYTE*)(offset + 0x4c + 4 + 3) = ((BYTE*)&memstart)[2];
// }
ULONG va = *(DWORD*)(offset + 0x48 + 4);
if (va != 0 && memstart != va) {
memstart = va;
*(BYTE*)(offset + 0x48) = *(BYTE*)(memstart + 1);
*(BYTE*)(offset + 0x48 + 1) = *(BYTE*)(memstart + 2);
*(BYTE*)(offset + 0x48 + 2) = *(BYTE*)(memstart + 3);
*(BYTE*)(offset + 0x48 + 3) = *(BYTE*)(memstart);
}
//Interval = Interval50;
//*(DWORD*)(offset + 0x8) = 0;
//ULONG va = *(DWORD*)(offset + 0x4c + 4);
//if (va != 0 && va != memstart) {
// memstart = va;
// *(DWORD*)(offset + 0x4c + 4) += 0x100;
//ULONG o = 0x56CC;
//BYTE *a1 = (BYTE *)(offset + 0x5C);
//char *a2 = (char *)&o;
//unsigned int a3 = 4;
//char v3; // ST03_1
//unsigned int i; // [esp+4h] [ebp-8h]
//char v6; // [esp+Bh] [ebp-1h]
//*a2 ^= *a1;
//v6 = *a2;
//for (i = 1; i < a3; ++i)
//{
// a2[i] ^= a1[i % 4];
// v3 = a2[i];
// a2[i] = v6;
// v6 = v3;
//}
//*a2 = v6;
//*(DWORD*)(offset + 0x60) = o;
//}
}
}
}
}
}
}
}
}
pfn_NtDelayExecution(TRUE, &Interval1000);
}
return 0;
}
int LDE(const unsigned char *func)
{
int operandSize = 4;
int FPU = 0;
const unsigned char* pOrigin = func;
//跳过F0h,F2h,F3h,66h,67h,2Eh,26h,36h,3Eh,64h,65h等前缀,
//以及D8h-DFh等ESC(转移操作码)
while (*func == 0xF0 ||
*func == 0xF2 ||
*func == 0xF3 ||
*func == 0x66 ||
*func == 0x67 ||
*func == 0x2E ||
*func == 0x3E ||
*func == 0x26 ||
*func == 0x36 ||
*func == 0x64 ||
*func == 0x65 ||
(*func & 0xF8) == 0xD8 //D8-DF
)
{
if (*func == 0x66)
{
operandSize = 2;
}
else if ((*func & 0xF8) == 0xD8)
{
FPU = *func++;
break;
}
func++;
}
//跳过双字节操作码转义字节0Fh
bool twoByte = false;
if (*func == 0x0F)
{
twoByte = true;
func++;
}
//跳过主操作码
unsigned char opcode = *func++;