内存运行EXE，加载运行时库错误R6034-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] 内存运行EXE，加载运行时库错误R6034 0.00雪花

发表于: 2010-5-25 21:31 6207

[旧帖] 内存运行EXE，加载运行时库错误R6034 0.00雪花

cenchure

2010-5-25 21:31

6207

抄了段代码  从内存中运行 PE 文件，

typedef IMAGE_SECTION_HEADER (*PIMAGE_SECTION_HEADERS)[1];

// 计算对齐后的大小
unsigned long GetAlignedSize(unsigned long Origin, unsigned long Alignment)
{
return (Origin + Alignment - 1) / Alignment * Alignment;
}

// 计算加载pe并对齐需要占用多少内存
// 未直接使用OptionalHeader.SizeOfImage作为结果是因为据说有的编译器生成的exe这个值会填0
unsigned long CalcTotalImageSize(PIMAGE_DOS_HEADER MzH
                              , unsigned long FileLen
                              , PIMAGE_NT_HEADERS peH
                              , PIMAGE_SECTION_HEADERS peSecH)
{
unsigned long res;
// 计算pe头的大小
res = GetAlignedSize( peH->OptionalHeader.SizeOfHeaders
      , peH->OptionalHeader.SectionAlignment
      );

// 计算所有节的大小
for( int i = 0; i < peH->FileHeader.NumberOfSections; ++i)
{
      // 超出文件范围
      if(peSecH[i]->PointerToRawData + peSecH[i]->SizeOfRawData > FileLen)
         return 0;
      else if(peSecH[i]->VirtualAddress)//计算对齐后某节的大小
      {
         if(peSecH[i]->Misc.VirtualSize)
         {
            res = GetAlignedSize( peSecH[i]->VirtualAddress + peSecH[i]->Misc.VirtualSize
                  , peH->OptionalHeader.SectionAlignment
                  );
         }
         else
         {
            res = GetAlignedSize( peSecH[i]->VirtualAddress + peSecH[i]->SizeOfRawData
                  , peH->OptionalHeader.SectionAlignment
                  );
         }
      }
      else if( peSecH[i]->Misc.VirtualSize < peSecH[i]->SizeOfRawData )
      {
         res += GetAlignedSize( peSecH[i]->SizeOfRawData
            , peH->OptionalHeader.SectionAlignment
            );
      }
      else
      {
         res += GetAlignedSize( peSecH[i]->Misc.VirtualSize
            , peH->OptionalHeader.SectionAlignment
            );
      }// if_else
}// for

return res;
}




// 加载pe到内存并对齐所有节
BOOL AlignPEToMem( void *Buf
               , long Len
               , PIMAGE_NT_HEADERS &peH
               , PIMAGE_SECTION_HEADERS &peSecH
               , void *&Mem
               , unsigned long &ImageSize)
{


PIMAGE_DOS_HEADER SrcMz;// DOS头
PIMAGE_NT_HEADERS SrcPeH;// PE头
PIMAGE_SECTION_HEADERS SrcPeSecH;// 节表

SrcMz = (PIMAGE_DOS_HEADER)Buf;

if( Len < sizeof(IMAGE_DOS_HEADER) )
      return FALSE;

if( SrcMz->e_magic != IMAGE_DOS_SIGNATURE )
      return FALSE;

if( Len < SrcMz->e_lfanew + (long)sizeof(IMAGE_NT_HEADERS) )
      return FALSE;

SrcPeH = (PIMAGE_NT_HEADERS)((int)SrcMz + SrcMz->e_lfanew);
if( SrcPeH->Signature != IMAGE_NT_SIGNATURE )
      return FALSE;

if( (SrcPeH->FileHeader.Characteristics & IMAGE_FILE_DLL) ||
      (SrcPeH->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE == 0) ||
      (SrcPeH->FileHeader.SizeOfOptionalHeader != sizeof(IMAGE_OPTIONAL_HEADER)) )
{
      return FALSE;
}


SrcPeSecH = (PIMAGE_SECTION_HEADERS)((int)SrcPeH + sizeof(IMAGE_NT_HEADERS));
ImageSize = CalcTotalImageSize( SrcMz, Len, SrcPeH, SrcPeSecH);

if( ImageSize == 0 )
      return FALSE;

Mem = VirtualAlloc( NULL, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); // 分配内存
if( Mem != NULL )
{
      // 计算需要复制的PE头字节数
      unsigned long l = SrcPeH->OptionalHeader.SizeOfHeaders;
      for( int i = 0; i < SrcPeH->FileHeader.NumberOfSections; ++i)
      {
         if( (SrcPeSecH[i]->PointerToRawData) &&
            (SrcPeSecH[i]->PointerToRawData < l) )
         {
            l = SrcPeSecH[i]->PointerToRawData;
         }
      }
      memmove( Mem, SrcMz, l);
      peH = (PIMAGE_NT_HEADERS)((int)Mem + ((PIMAGE_DOS_HEADER)Mem)->e_lfanew);
      peSecH = (PIMAGE_SECTION_HEADERS)((int)peH + sizeof(IMAGE_NT_HEADERS));

      void *Pt = (void *)((unsigned long)Mem
         + GetAlignedSize( peH->OptionalHeader.SizeOfHeaders
         , peH->OptionalHeader.SectionAlignment)
         );

      for(int  i = 0; i < peH->FileHeader.NumberOfSections; ++i)
      {
         // 定位该节在内存中的位置
         if(peSecH[i]->VirtualAddress)
            Pt = (void *)((unsigned long)Mem + peSecH[i]->VirtualAddress);

         if(peSecH[i]->SizeOfRawData)
         {
            // 复制数据到内存
            memmove(Pt, (const void *)((unsigned long)(SrcMz) + peSecH[i]->PointerToRawData), peSecH[i]->SizeOfRawData);
            if(peSecH[i]->Misc.VirtualSize < peSecH[i]->SizeOfRawData)
                  Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->SizeOfRawData, peH->OptionalHeader.SectionAlignment));
            else // pt 定位到下一节开始位置
                  Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment));
         }
         else
         {
            Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment));
         }
      }
}
return TRUE;
}



typedef void *(__stdcall *pfVirtualAllocEx)(unsigned long, void *, unsigned long, unsigned long, unsigned long);
pfVirtualAllocEx MyVirtualAllocEx = NULL;

BOOL IsNT()
{
return MyVirtualAllocEx!=NULL;
}

// 生成外壳程序命令行
char *PrepareShellExe(char *CmdParam, unsigned long BaseAddr, unsigned long ImageSize)
{
if(IsNT())
{
      char *Buf = new char[256];
      memset(Buf, 0, 256);
      GetModuleFileNameA(0, Buf, 256);
      strcat(Buf, CmdParam);
      return Buf; // 请记得释放内存;-)
}
else
{
      // Win98下的处理请参考原文;-)
      // http://community.csdn.net/Expert/topic/4416/4416252.xml?temp=8.709133E-03
      return NULL;
}
}

// 是否包含可重定向列表
BOOL HasRelocationTable(PIMAGE_NT_HEADERS peH)
{
return (peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)
      && (peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
}




#pragma pack(push, 1)
typedef struct{
unsigned long VirtualAddress;
unsigned long SizeOfBlock;
} *PImageBaseRelocation;
#pragma pack(pop)

// 重定向PE用到的地址
void DoRelocation(PIMAGE_NT_HEADERS peH, void *OldBase, void *NewBase)
{
unsigned long Delta = (unsigned long)NewBase - peH->OptionalHeader.ImageBase;
PImageBaseRelocation p = (PImageBaseRelocation)((unsigned long)OldBase
      + peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
while(p->VirtualAddress + p->SizeOfBlock)
{
      unsigned short *pw = (unsigned short *)((int)p + sizeof(*p));
      for(unsigned int i=1; i <= (p->SizeOfBlock - sizeof(*p)) / 2; ++i)
      {
         if((*pw) & 0xF000 == 0x3000){
            unsigned long *t = (unsigned long *)((unsigned long)(OldBase) + p->VirtualAddress + ((*pw) & 0x0FFF));
            *t += Delta;
         }
         ++pw;
      }
      p = (PImageBaseRelocation)pw;
}
}

// 卸载原外壳占用内存
BOOL UnloadShell(HANDLE ProcHnd, unsigned long BaseAddr)
{
typedef unsigned long (__stdcall *pfZwUnmapViewOfSection)(unsigned long, unsigned long);
pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;
BOOL res = FALSE;
HMODULE m = LoadLibraryA("ntdll.dll");
if(m){
      ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress (m, "ZwUnmapViewOfSection");
      if(ZwUnmapViewOfSection)
         res = (ZwUnmapViewOfSection((unsigned long)ProcHnd, BaseAddr) == 0);
      FreeLibrary(m);
}
return res;
}

// 创建外壳进程并获取其基址、大小和当前运行状态
BOOL CreateChild(char *Cmd, CONTEXT &Ctx, HANDLE &ProcHnd, HANDLE &ThrdHnd,
               unsigned long &ProcId, unsigned long &BaseAddr, unsigned long &ImageSize)
{
STARTUPINFOA si;
PROCESS_INFORMATION pi;
unsigned long old;
MEMORY_BASIC_INFORMATION MemInfo;
memset(&si, 0, sizeof(si));
memset(&pi, 0, sizeof(pi));
si.cb = sizeof(si);

BOOL res = CreateProcessA(NULL, Cmd, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, "d://prjtest", &si, &pi); // 以挂起方式运行进程;
if(res){
      ProcHnd = pi.hProcess;
      ThrdHnd = pi.hThread;
      ProcId = pi.dwProcessId;
      // 获取外壳进程运行状态，[ctx.Ebx+8]内存处存的是外壳进程的加载基址，ctx.Eax存放有外壳进程的入口地址
      Ctx.ContextFlags = CONTEXT_FULL;
      GetThreadContext(ThrdHnd, &Ctx);
      ReadProcessMemory(ProcHnd, (void *)(Ctx.Ebx+8), &BaseAddr, sizeof(unsigned long), &old); // 读取加载基址
      void *p = (void *)BaseAddr;
      // 计算外壳进程占有的内存
      while(VirtualQueryEx(ProcHnd, p, &MemInfo, sizeof(MemInfo)))
      {
         if(MemInfo.State = MEM_FREE) break;
         p = (void *)((unsigned long)p + MemInfo.RegionSize);
      }
      ImageSize = (unsigned long)p - (unsigned long)BaseAddr;
}
return res;
}

// 创建外壳进程并用目标进程替换它然后执行
HANDLE AttachPE(char *CmdParam, PIMAGE_NT_HEADERS peH, PIMAGE_SECTION_HEADERS peSecH,
            void *Ptr, unsigned long ImageSize, unsigned long &ProcId,BYTE * papbuf)
{
HANDLE res = INVALID_HANDLE_VALUE;
CONTEXT Ctx;
HANDLE Thrd;
unsigned long Addr, Size;
char *s = PrepareShellExe(CmdParam, peH->OptionalHeader.ImageBase, ImageSize);
if(s==NULL) return res;
if(CreateChild(s, Ctx, res, Thrd, ProcId, Addr, Size)){

      void *p = NULL;
      unsigned long old;
      if((peH->OptionalHeader.ImageBase == Addr) && (Size >= ImageSize)){// 外壳进程可以容纳目标进程并且加载地址一致
         p = (void *)Addr;
         VirtualProtectEx(res, p, Size, PAGE_EXECUTE_READWRITE, &old);
      }
      else if(IsNT()){
         if(UnloadShell(res, Addr)){// 卸载外壳进程占有内存
               p = MyVirtualAllocEx((unsigned long)res, (void *)peH->OptionalHeader.ImageBase, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
         }
         if((p == NULL) && HasRelocationTable(peH)){// 分配内存失败并且目标进程支持重定向

            p = MyVirtualAllocEx((unsigned long)res, NULL, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            if(p)
{
DoRelocation(peH, Ptr, p); // 重定向
}
         }
      }
      if(p){
         WriteProcessMemory(res, (void *)(Ctx.Ebx+8), &p, sizeof(DWORD), &old); // 重置目标进程运行环境中的基址
         peH->OptionalHeader.ImageBase = (unsigned long)p;
         if(WriteProcessMemory(res, p, Ptr, ImageSize, &old)){// 复制PE数据到目标进程
            Ctx.ContextFlags = CONTEXT_FULL;
            if((unsigned long)p == Addr)
                  Ctx.Eax = peH->OptionalHeader.ImageBase + peH->OptionalHeader.AddressOfEntryPoint; // 重置运行环境中的入口地址
            else
                  Ctx.Eax = (unsigned long)p + peH->OptionalHeader.AddressOfEntryPoint;
            SetThreadContext(Thrd, &Ctx);// 更新运行环境
            ResumeThread(Thrd);// 执行
            CloseHandle(Thrd);
         }
         else{// 加载失败,杀掉外壳进程
            TerminateProcess(res, 0);
            CloseHandle(Thrd);
            CloseHandle(res);
            res = INVALID_HANDLE_VALUE;
         }
      }
      else{// 加载失败,杀掉外壳进程
         TerminateProcess(res, 0);
         CloseHandle(Thrd);
         CloseHandle(res);
         res = INVALID_HANDLE_VALUE;
      }
}
delete[] s;
return res;
}




/**//*******************************************************\
{ ******************************************************* }
{ *                从内存中加载并运行exe             * }
{ ******************************************************* }
{ * 参数：                                              }
{ * Buffer: 内存中的exe地址                            }
{ * Len: 内存中exe占用长度                               }
{ * CmdParam: 命令行参数(不包含exe文件名的剩余命令行参数）}
{ * ProcessId: 返回的进程Id                            }
{ * 返回值：如果成功则返回进程的Handle(ProcessHandle), }
{          如果失败则返回INVALID_HANDLE_VALUE          }
{ ******************************************************* }
\*******************************************************/
HANDLE MemExecute(void *ABuffer, long Len, char *CmdParam, unsigned long *ProcessId)
{
HANDLE res = INVALID_HANDLE_VALUE;
PIMAGE_NT_HEADERS peH;
PIMAGE_SECTION_HEADERS peSecH;
void *Ptr;
unsigned long peSz;
BYTE* debuffer  =(BYTE*) ABuffer ;

if(AlignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz))
{
      res = AttachPE(CmdParam, peH, peSecH, Ptr, peSz, *ProcessId,debuffer);
      VirtualFree(Ptr, peSz, MEM_DECOMMIT);
}
return res;
}

// 初始化
class CInit
{
public:
CInit()
{
      MyVirtualAllocEx = (pfVirtualAllocEx)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "VirtualAllocEx");
}
}Init;

调用后 EXE 文件时，会R6034 错误，推测应该是 MSVCR90.DLL 加载的问题，不知道哪位给帮忙小小改动下

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

收藏・0

免费・1

支持

最新回复 (2)
bithaha 雪币： 1505 能力值： (RANK：210 ) 在线值：发帖 66 回帖 933 粉丝 4 关注私信	bithaha 5 2 楼 k币太少了12 2010-5-25 22:33 0
cenchure 雪币： 205 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 3 粉丝 0 关注私信	cenchure 3 楼 ,解决了开贴再给 100 Kx 2010-5-28 11:18 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

cenchure

发帖

回帖

RANK

关注

私信

他的文章

内存运行EXE，加载运行时库错误R6034 6208

关于我们

联系我们

企业服务

看雪公众号