#include "stdafx.h"
#pragma warning(disable:4005)
#include <stdio.h>
#include <windows.h>
#include <winternl.h>
#include <ntstatus.h>
#include <string.h>
#include <tlhelp32.h>
#pragma comment(lib,"ntdll.lib")


typedef VOID (__stdcall *_CheckCRCCallBack)();
typedef VOID (__stdcall *_Sleep)(DWORD dwMilliseconds);
typedef unsigned int (__stdcall *_RtlComputeCrc32)(int dwInitial, void* pData, int iLen);
typedef struct _THREAD_CONTEXT_
{
	_RtlComputeCrc32 funcRtlComputeCrc32;
	_Sleep funcSleep;
	_CheckCRCCallBack funcCallBack;
	PVOID CheckAddress;
	int CheckSize;
}THREAD_CONTEXT,*PTHREAD_CONTEXT;

DWORD GetModuleImageSize(PVOID lphModule)
{
	DWORD dwResult = 0;
	PIMAGE_DOS_HEADER lpDosHeaders;
	PIMAGE_NT_HEADERS lpNtHeaders;

	//	验证模块是否是PE文件
	if (lphModule == NULL) return dwResult;

	lpDosHeaders = (PIMAGE_DOS_HEADER)lphModule;
	if (lpDosHeaders->e_magic == IMAGE_DOS_SIGNATURE)
	{
		lpNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)lphModule + lpDosHeaders->e_lfanew);
		if (lpNtHeaders->Signature == IMAGE_NT_SIGNATURE)
		{
			dwResult = lpNtHeaders->OptionalHeader.SizeOfImage;
		}
	}
	return dwResult;
}

int GetShellCodeLen(BYTE *lpShell)
{
	DWORD dwStart=(DWORD)lpShell;
	int len=0;
	while(*(DWORD *)dwStart!=0xAAAAAAAA)
	{
		dwStart++;
		len++;
	}
	return len;
}

DWORD WINAPI CheckCRC(LPVOID ThreadContext)
{
	unsigned int Crc32=0;
	PTHREAD_CONTEXT ctx = (PTHREAD_CONTEXT)ThreadContext;
	Crc32 = ctx->funcRtlComputeCrc32(0,ctx->CheckAddress,ctx->CheckSize);
	while(1)
	{
		unsigned int crc32_new = ctx->funcRtlComputeCrc32(0,ctx->CheckAddress,ctx->CheckSize);
		if (crc32_new!=Crc32)
		{
			ctx->funcCallBack();
		}
		ctx->funcSleep(3000);
	}
	__asm
	{
			_emit 0xAA
			_emit 0xAA
			_emit 0xAA
			_emit 0xAA
	}
	return 0;

}

VOID __stdcall DefCallBack()
{
	AfxMessageBox(TEXT("进程代码被修改"));
	TerminateProcess(GetCurrentProcess(),-1);
}
VOID CreateAntiBpThread(PVOID Address,int nSize)
{
	PTHREAD_CONTEXT thctx;
	HMODULE NtdllMod = LoadLibraryW(L"ntdll.dll");
	thctx = (PTHREAD_CONTEXT)VirtualAllocEx(GetCurrentProcess(),NULL,sizeof(THREAD_CONTEXT),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

	thctx->funcRtlComputeCrc32 = (_RtlComputeCrc32)GetProcAddress(NtdllMod,"RtlComputeCrc32");
	thctx->funcSleep = (_Sleep)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"Sleep");
	thctx->CheckAddress = Address;
	thctx->CheckSize = nSize;
	thctx->funcCallBack = DefCallBack;
	PVOID ThreadCode =NULL;
	DWORD ThreadSize =0;
	ThreadSize = GetShellCodeLen((BYTE *)CheckCRC);
	ThreadCode = (PVOID)VirtualAllocEx(GetCurrentProcess(),NULL,ThreadSize,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
	RtlCopyMemory(ThreadCode,(PVOID)CheckCRC,ThreadSize);

	CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)ThreadCode,(LPVOID)thctx,0,NULL);
}
VOID SetAntiBp(PVOID ImageBase)
{
	UINT nSectionNumber=0;
	UINT i=0;

	PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)ImageBase;
	PIMAGE_NT_HEADERS NtHeader =NULL;
	PIMAGE_FILE_HEADER FileHeader = NULL;
	PIMAGE_SECTION_HEADER FirstSection = NULL;

	NtHeader = (PIMAGE_NT_HEADERS)((DWORD)DosHeader + DosHeader->e_lfanew);

	FileHeader = (PIMAGE_FILE_HEADER)&NtHeader->FileHeader;

	FirstSection =(PIMAGE_SECTION_HEADER)(DosHeader->e_lfanew + FileHeader->SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + sizeof(UINT32));

	nSectionNumber = FileHeader->NumberOfSections;


	for (i=0;i<nSectionNumber;i++)
	{
		PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)DosHeader + (ULONG_PTR)FirstSection + (i * sizeof(IMAGE_SECTION_HEADER)));

		BOOL IsMonitored =
			(SectionHeader->Characteristics & IMAGE_SCN_MEM_EXECUTE)
			&&
			(SectionHeader->Characteristics &IMAGE_SCN_MEM_READ)
			&&
			(SectionHeader->Characteristics & IMAGE_SCN_CNT_CODE)
			&&
			!(SectionHeader->Characteristics & IMAGE_SCN_MEM_DISCARDABLE)
			;
		if (IsMonitored)//根据段属性来，只有code是需要crc的~~~
		{

			OutputDebugStringA("create code check\r\n");
			CreateAntiBpThread((VOID *)((ULONG_PTR)DosHeader + SectionHeader->VirtualAddress), SectionHeader->Misc.VirtualSize);
		}
	}
}

VOID InitAntiBp()
{
	SetAntiBp(GetModuleHandle(NULL));
	SetAntiBp(GetModuleHandle(TEXT("kernel32.dll"));//可以设置模块哦！
}

[课程]Android-CTF解题方法汇总！