简单的二进制加密壳

说是说加密壳，但主要用到的技术是Process Hollowing

代码已发布在github上

decode-shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include <string.h>
#include <time.h>
#include <string.h>

void UnloadShell(HANDLE ProcHnd, unsigned long BaseAddr);
LPVOID GetLastSecData(LPSTR lpszFile, DWORD& fileSize);
LPVOID AllocShellSize(LPSTR shellDirectory, HANDLE shellProcess, LPVOID encryptFileBuffer);
VOID GetNtHeaderInfo(LPVOID pFileBuffer, DWORD& ImageBase, DWORD& ImageSize);
VOID GetEncryptFileContext(LPVOID pFileBuffer, DWORD& OEP, DWORD& ImageBase);
LPVOID FileBufferToImageBuffer(BYTE* decodebuffer, DWORD& size);
void DoRelocation(LPVOID pFileBuffer, void* OldBase, void* NewBase);
int main(int argc, char* argv[])
{
	WCHAR shellDirectory[100]; //encode后程序这边有个坑，win32api通常是宽字符然而自己写的函数不需要
	DWORD encryptSize = 0;
	mbstowcs(shellDirectory, argv[0], 100);//宽字符转换
	LPVOID encryptFileBuffer = NULL;
	encryptFileBuffer = GetLastSecData(argv[0], encryptSize);
	/*
	这边可以写解密函数
	*/
	srand(233);
	int i;
	unsigned char key;
	for (i = 0; i < encryptSize; i++)
	{
		key = rand();
		*((BYTE*)encryptFileBuffer + i) ^= key;
	}
	//解密完成
	STARTUPINFO si = { 0 };
	PROCESS_INFORMATION pi;
	si.cb = sizeof(si);
	::CreateProcess(shellDirectory, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
	//int x = GetLastError();
	//printf("%d\n", x);
	char szTempStr[256] = { 0 };
	//sprintf(szTempStr, "process_information %x , %x \n", pi.hProcess, pi.hThread);仅用于验证是否成功创建进程
	CONTEXT contx;
	contx.ContextFlags = CONTEXT_FULL;
	GetThreadContext(pi.hThread, &contx);
	//int x = GetLastError();
	//printf("%d\n", x);
	DWORD dwEntryPoint = contx.Eax;
	DWORD baseAddress;
	TCHAR szBuffer[4] = { 0 };
	ReadProcessMemory(pi.hProcess, (LPCVOID)(contx.Ebx + 8), (LPVOID)&baseAddress, 4, NULL);
	//printf("挂起进程的线程Context.Eax:%p - Context.Ebx + 8:%p\n", contx.Eax, baseAddress);
	int* fileImageBase;
	fileImageBase = (int*)szBuffer;
	DWORD shellImageBase = *fileImageBase;
	UnloadShell(pi.hProcess, shellImageBase);
	LPVOID p = AllocShellSize(argv[0], pi.hProcess, encryptFileBuffer);
	DWORD pEncryptImageSize = 0;
	LPVOID pEncryptImageBuffer = FileBufferToImageBuffer((BYTE*)encryptFileBuffer, pEncryptImageSize);
	unsigned long old;
	WriteProcessMemory(pi.hProcess, (void*)(contx.Ebx + 8), &p, sizeof(DWORD), &old);

	if (WriteProcessMemory(pi.hProcess, p, pEncryptImageBuffer, pEncryptImageSize, &old))
	{

		DWORD encryptFileOEP = 0;
		DWORD encryptFileImageBase = 0;

		GetEncryptFileContext(encryptFileBuffer, encryptFileOEP, encryptFileImageBase);

		contx.ContextFlags = CONTEXT_FULL;

		contx.Eax = encryptFileOEP + (DWORD)p;
		//contx.Eip
		SetThreadContext(pi.hThread, &contx);

		LPVOID szBufferTemp = malloc(pEncryptImageSize);
		memset(szBufferTemp, 0, pEncryptImageSize);
		ReadProcessMemory(pi.hProcess, p, szBufferTemp, pEncryptImageSize, NULL);
		ResumeThread(pi.hThread);
		CloseHandle(pi.hThread);
	}
	return 0;
}
void UnloadShell(HANDLE ProcHnd, unsigned long BaseAddr)
{
	typedef unsigned long(__stdcall* pfZwUnmapViewOfSection)(unsigned long, unsigned long);
	pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;
	BOOL res = FALSE;
	HMODULE m = LoadLibraryA("ntdll.dll");
	if (m) {
		ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress(m, "ZwUnmapViewOfSection");

		if (ZwUnmapViewOfSection)
			res = (ZwUnmapViewOfSection((unsigned long)ProcHnd, BaseAddr) == 0);
		FreeLibrary(m);
	}
	else
	{
		printf("load library failed!!!\n");
		exit(0);
	}
	return;
}
LPVOID FileBufferToImageBuffer(BYTE* decodebuffer, DWORD& size)
{
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader_LAST = NULL;


	pDosHeader = (PIMAGE_DOS_HEADER)decodebuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)decodebuffer + pDosHeader->e_lfanew);
	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	pSectionHeader_LAST = (PIMAGE_SECTION_HEADER)((DWORD)pSectionHeader + (pPEHeader->NumberOfSections - 1) * 40);

	unsigned int fileLength = pSectionHeader_LAST->PointerToRawData + pSectionHeader_LAST->SizeOfRawData;
	size = pNTHeader->OptionalHeader.SizeOfImage;
	BYTE* pEncryptBuffer = (BYTE*)malloc(size);
	memset(pEncryptBuffer, 0, size);
	memcpy(pEncryptBuffer, decodebuffer, pNTHeader->OptionalHeader.SizeOfHeaders);
	int i;
	for (i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
	{
		memcpy(pEncryptBuffer + pSectionHeader->VirtualAddress, decodebuffer + pSectionHeader->VirtualAddress, pSectionHeader->SizeOfRawData);
		pSectionHeader++;
	}


	return pEncryptBuffer;
}
LPVOID GetLastSecData(LPSTR lpszFile, DWORD& fileSize)
{
	FILE* a = fopen(lpszFile, "rb");
	fseek(a, 0, SEEK_END);
	fileSize = ftell(a);
	fseek(a, 0, SEEK_SET);
	LPVOID pFileBuffer = calloc(1, fileSize);
	fread(pFileBuffer, fileSize, 1, a);
	fclose(a);
	if (!pFileBuffer)
	{
		printf("文件读取失败\n");
		return NULL;
	}


	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader_LAST = NULL;


	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);
	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	pSectionHeader_LAST = (PIMAGE_SECTION_HEADER)((DWORD)pSectionHeader + (pPEHeader->NumberOfSections - 1) * 40);

	unsigned int fileLength = pSectionHeader_LAST->PointerToRawData + pSectionHeader_LAST->SizeOfRawData;
	fileSize = pSectionHeader_LAST->SizeOfRawData;
	LPVOID pEncryptBuffer = malloc(fileSize);
	memset(pEncryptBuffer, 0, fileSize);
	CHAR* pNew = (CHAR*)pEncryptBuffer;

	CHAR* pOld = (CHAR*)((DWORD)pFileBuffer + pSectionHeader_LAST->PointerToRawData);

	pEncryptBuffer = pOld;

	return pEncryptBuffer;
}
LPVOID AllocShellSize(LPSTR shellDirectory, HANDLE shellProcess, LPVOID encryptFileBuffer)
{
	typedef void* (__stdcall* pfVirtualAllocEx)(unsigned long, void*, unsigned long, unsigned long, unsigned long);
	pfVirtualAllocEx MyVirtualAllocEx = NULL;
	MyVirtualAllocEx = (pfVirtualAllocEx)GetProcAddress(GetModuleHandle((LPCWSTR)"Kernel32.dll"), "VirtualAllocEx"); //获取VirtualAllocEx 函数地址
	FILE* a = fopen(shellDirectory, "rb");
	fseek(a, 0, SEEK_END);
	unsigned long long fileSize = ftell(a);
	fseek(a, 0, SEEK_SET);
	LPVOID pShellBuffer = calloc(1, fileSize);
	fread(pShellBuffer, fileSize, 1, a);
	fclose(a);

	DWORD shellImageBase = 0;
	DWORD shellImageSize = 0;
	DWORD encryptImageBase = 0;
	DWORD encryptImageSize = 0;


	GetNtHeaderInfo(pShellBuffer, shellImageBase, shellImageSize);
	GetNtHeaderInfo(encryptFileBuffer, encryptImageBase, encryptImageSize);

	if (shellImageBase == 0 || shellImageSize == 0 || encryptImageBase == 0 || encryptImageSize == 0)
	{
		printf("分配空间失败\n");
		exit(0);
	}

	void* p = NULL;


	if (shellImageBase == encryptImageBase)
	{
		shellImageSize = (shellImageSize >= encryptImageSize) ? shellImageSize : encryptImageSize;

		p = VirtualAllocEx(shellProcess, (void*)shellImageBase, shellImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		//int x = GetLastError();
		//printf("%d\n", x);
	}


	if (p == NULL)
	{
		p = VirtualAllocEx(shellProcess, NULL, encryptImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		if (p) 
		{
			return p;
			//DoRelocation(encryptFileBuffer, (void*)encryptImageBase, p);
		}
		else 
		{
			printf("分配空间失败\n");
			exit(0);
		}
	}


	return p;
}

void DoRelocation(LPVOID pFileBuffer, void* OldBase, void* NewBase)
{
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	unsigned int i,j=0;
	unsigned long* t;
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	PIMAGE_NT_HEADERS peH = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);
	signed long Delta = (signed long)NewBase - peH->OptionalHeader.ImageBase;
	IMAGE_DATA_DIRECTORY relocations = (peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]);
	PIMAGE_BASE_RELOCATION p = (PIMAGE_BASE_RELOCATION)((DWORD)pFileBuffer + relocations.VirtualAddress);
	while (p->VirtualAddress + p->SizeOfBlock)
	{
		unsigned short* pw = (unsigned short*)((int)p + sizeof(*p));
		for (i = 0; i < (p->SizeOfBlock - sizeof(*p)) / sizeof(WORD); ++i)
		{
			if (((*pw) & 0xF000) == 0x3000) {
				t = (unsigned long*)((DWORD)(pFileBuffer)+p->VirtualAddress + ((*pw) & 0x0FFF));
				*t += Delta;
			}
			++pw;
		}
		p = (PIMAGE_BASE_RELOCATION)pw;
	}
}

VOID GetNtHeaderInfo(LPVOID pFileBuffer, DWORD& ImageBase, DWORD& ImageSize)
{
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;

	if (!pFileBuffer)
	{
		printf("文件读取失败\n");
		return;
	}


	if (*((PWORD)pFileBuffer) != IMAGE_DOS_SIGNATURE)
	{
		printf("不是有效的MZ标志\n");
		free(pFileBuffer);
		return;
	}


	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;


	if (*((PDWORD)((DWORD)pFileBuffer + pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE)
	{
		printf("不是有效的PE标志\n");
		free(pFileBuffer);
		return;
	}

	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);


	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);


	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);

	ImageBase = pOptionHeader->ImageBase;
	ImageSize = pOptionHeader->SizeOfImage;

}

VOID GetEncryptFileContext(LPVOID pFileBuffer, DWORD& OEP, DWORD& ImageBase)
{
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	//pFileBuffer= ReadPEFile(lpszFile);

	if (!pFileBuffer)
	{
		printf("文件读取失败\n");
		return;
	}


	if (*((PWORD)pFileBuffer) != IMAGE_DOS_SIGNATURE)
	{
		printf("不是有效的MZ标志\n");
		free(pFileBuffer);
		return;
	}

	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;


	if (*((PDWORD)((DWORD)pFileBuffer + pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE)
	{
		printf("不是有效的PE标志\n");
		free(pFileBuffer);
		return;
	}

	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);


	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);


	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);


	OEP = pOptionHeader->AddressOfEntryPoint;
	ImageBase = pOptionHeader->ImageBase;

}



encode-shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include <string.h>

LPVOID FileBufferToImageBuffer(BYTE* decodebuffer, DWORD& size);

int main()
{
    FILE* a;
    FILE* b;
    FILE* c;
    int i,j;
    const char shelladdr[] = "C:\\Users\\pisanbao\\Desktop\\decode_shell.exe";//shell路径
    const char srcaddr[] = "C:\\Users\\pisanbao\\Desktop\\thread_func.exe";//src路径
    a = fopen(srcaddr, "rb");
    fseek(a, 0, SEEK_END);
    unsigned long long filesize = ftell(a);
    fseek(a, 0, SEEK_SET);
    DWORD* filebuffer = (DWORD *)calloc(1, filesize);
    fread(filebuffer, filesize, 1, a);
    fclose(a);
    // file buffer get
    IMAGE_DOS_HEADER* filedosheader = (IMAGE_DOS_HEADER*)filebuffer;
    IMAGE_NT_HEADERS* filentheader = (IMAGE_NT_HEADERS*)((BYTE*)filebuffer + filedosheader->e_lfanew);
    IMAGE_SECTION_HEADER* filesection = (IMAGE_SECTION_HEADER*)((BYTE*)filebuffer + filedosheader->e_lfanew + 4 + sizeof(IMAGE_FILE_HEADER) + filentheader->FileHeader.SizeOfOptionalHeader+40*(filentheader->FileHeader.NumberOfSections-1));
    filesize = filesection->PointerToRawData + filesection->SizeOfRawData;
    b = fopen(shelladdr, "rb");
    fseek(b, 0, SEEK_END);
    unsigned long long shellsize = ftell(b);
    fseek(b, 0, SEEK_SET);
    DWORD* shellbuffer = (DWORD*)calloc(1, shellsize);
    fread(shellbuffer, shellsize, 1, b);
    fclose(b);
    //shell buffer get
    c = fopen("C:\\Users\\pisanbao\\Desktop\\shell.exe", "ab+");
    IMAGE_DOS_HEADER * shelldosheader = (IMAGE_DOS_HEADER *)shellbuffer;
    IMAGE_NT_HEADERS* shellntheader = (IMAGE_NT_HEADERS*)((BYTE *)shellbuffer + shelldosheader->e_lfanew);
    IMAGE_SECTION_HEADER * shellsection = (IMAGE_SECTION_HEADER *)((BYTE*)shellbuffer + shelldosheader->e_lfanew + 4 + sizeof(IMAGE_FILE_HEADER) + shellntheader->FileHeader.SizeOfOptionalHeader);
    for (i = 0; i < shellntheader->FileHeader.NumberOfSections; i++)
        shellsection++;
    WORD temp = shelldosheader->e_lfanew;
    DWORD tempsize = shellntheader->OptionalHeader.SizeOfHeaders;
    shelldosheader->e_lfanew = sizeof(IMAGE_DOS_HEADER);    
    unsigned long long realimage = filesize;

    if (filesize % 0x1000)
    {
        realimage = ((filesize / 0x1000) + 1) * 0x1000;
    }
    else
    {
        realimage = filesize;
    }
    //unsigned long long tempimage = shellntheader->OptionalHeader.SizeOfImage;
    strcpy((char *)shellsection->Name,".psb");//特征名
    unsigned long long count1;
    if (filesize % 0x200)
    {
        count1 = ((filesize / 0x200) + 1) * 0x200;
    }
    else
    {
        count1 = filesize;
    }
    //新增节主要注意的是要把新增的pe当作一段数据来看
    IMAGE_SECTION_HEADER* tempsection = shellsection;
    tempsection--;
    unsigned long long temptemp;
    DWORD imgsize = filentheader->OptionalHeader.SizeOfImage;
    if (tempsection->Misc.VirtualSize % 0x1000)
    {
        temptemp = ((tempsection->Misc.VirtualSize / 0x1000) + 1) * 0x1000;
    }
    else
    {
        temptemp = tempsection->Misc.VirtualSize;
    }
    unsigned long long realsize = tempsection->SizeOfRawData + tempsection->PointerToRawData;
    shellsection->Misc.VirtualSize = imgsize;
    shellsection->VirtualAddress = tempsection->VirtualAddress + temptemp;
    shellsection->SizeOfRawData = imgsize;
    shellsection->PointerToRawData = realsize;//这边踩坑了，有些编译器会在最后节后面加东西导致文件不对齐
    shellsection->Characteristics = 0xe0500060;
    shellntheader->FileHeader.NumberOfSections += 1;        //节数+1  
    shellntheader->OptionalHeader.SizeOfImage = shellsection->VirtualAddress + imgsize;
    for (i = temp,j=0; i < tempsize; i++,j++)
    {
        *((BYTE*)shellbuffer + sizeof(IMAGE_DOS_HEADER)+j) = *((BYTE*)shellbuffer + i);
        *((BYTE*)shellbuffer + i) = 0;
    }
    fwrite((BYTE*)shellbuffer, realsize, 1, c);
    //新增节完成
    //加密pe最后填充
    srand(233);
    unsigned char key;
    LPVOID encryptFileBuffer = NULL;
    encryptFileBuffer = FileBufferToImageBuffer((BYTE*)filebuffer, imgsize);
    for (i = 0; i < imgsize; i++)
    {
        key = rand();
        *((BYTE*)encryptFileBuffer + i) ^= key;
    }
    fwrite(encryptFileBuffer, imgsize, 1, c);
    free(filebuffer);
    free(encryptFileBuffer);
    free(shellbuffer);
    fclose(c);
    printf("done!\n");
    getchar();
    return 0;
}
LPVOID FileBufferToImageBuffer(BYTE* decodebuffer, DWORD& size)
{
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNTHeader = NULL;
    PIMAGE_FILE_HEADER pPEHeader = NULL;
    PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader_LAST = NULL;


    pDosHeader = (PIMAGE_DOS_HEADER)decodebuffer;
    pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)decodebuffer + pDosHeader->e_lfanew);
    pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);
    pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
    pSectionHeader_LAST = (PIMAGE_SECTION_HEADER)((DWORD)pSectionHeader + (pPEHeader->NumberOfSections - 1) * 40);

    unsigned int fileLength = pSectionHeader_LAST->PointerToRawData + pSectionHeader_LAST->SizeOfRawData;
    size = pNTHeader->OptionalHeader.SizeOfImage;
    BYTE* pEncryptBuffer = (BYTE*)malloc(size);
    memset(pEncryptBuffer, 0, size);
    memcpy(pEncryptBuffer, decodebuffer, pNTHeader->OptionalHeader.SizeOfHeaders);
    int i;
    for (i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
    {
        memcpy(pEncryptBuffer + pSectionHeader->VirtualAddress, decodebuffer + pSectionHeader->PointerToRawData, pSectionHeader->SizeOfRawData);
        pSectionHeader++;
    }


    return pEncryptBuffer;
}

流程简介

加壳

encodeshell主要功能是抹去dos stub，新增节并把目标文件xor伪随机数后按照内存对齐后塞入

解壳

  1. 读取主模块数据

  2. 解密得到原来pe文件

  3. 以挂起的形式创建进程

  4. 获取context结构体

  5. 卸载外壳程序

  6. 在指定位置分配空间

  7. 修改外壳context结构体只修改imagebase和oep

  8. 成功

大致流程是这样

过程很简单，主要说一下问题

关于Process Hollowing

github地址:https://github.com/psbazx/PE_shell

最近把这个技术完善的同时遇到了许多问题

在此之前已经完成大部分功能除了一个重定位，如果virtualallocex没有分配内存在指定地址需要我们手动重定位后writeprocessmemory进去
image-20200730142534271

但是出现了一点问题，经过调试重定位完全正确，在调试时write完后attach到进程看指定内存发现是正确的

但是一旦ResumeThread后就出现问题了，地址重定位有问题，仔细比较插值发现是二次重定位了

所以这边不需要重定位直接可以跑，但是在印象中操作系统并不会帮我们干这些事情，让我一时有点懵逼

这边参考腾讯游戏安全实验室文章

https://www.52pojie.cn/thread-501486-1-1.html

image-20200730143146098

所以为什么不行了呢？操作系统自动帮你完成了重定位？

测试下发现winxp必须重定位

目前猜想是win10内核函数的改变，会比较文件imagebase和加载时imagebase

image-20200730143423712

​ WriteProcessMemory(pi.hProcess, (void*)(contx.Ebx + 8), &p, sizeof(DWORD), &old);改变了imagebase

但还不清楚具体会调用哪些函数。。。

等有空了再把这个坑填了

https://www.cnblogs.com/binsys/articles/2711019.html

当你调用resume thread后，主线程从内核函数KiStartUserThread开始运行，它会调用LdrInitializeThunk做Image loader，做完之后才调用的RtlUserThreadStart

LdrInitializeThunk如上链接，会把当前peb+8也就是ebx+8处的imagebase传入LdrPEStartup，当前映射的基地址和pe文件的基地址对比是否相等，不相等则调用对应重定位函数LdrPerformRelocations

查看LdrpInitializeProcess

image-20200803105942111

这边会判断是否相等，不想等则重定位

image-20200803110108339

这边再来看一波win10的LdrpInitializeProcess

image-20200803110705943

判断是否64位，peb64位的imagebase再0x10偏移处v94 = v8+0x10

v8再一开始初始化时是peb

image-20200803110803527

至于32位则需要看syswow64里的ntdll

image-20200803111713334

这边就是+8了

另外，我github上的代码有一些小bug比如中文路径，存在中文路径会内存分配失败

#re #ctf
简单的二进制加密壳
http://www.psbazx.com/2020/05/11/简单的二进制加密壳/
Beitragsautor
皮三宝
Veröffentlicht am
May 10, 2020
Urheberrechtshinweis