能力值：
( LV2，RANK：10 )
|
-
-
6 楼
好的，我这就贴啊。我是怕大家不耐烦看。
.data
szFilter db "PE files(*.exe, *.dll)", 0, "*.exe;*.dll", 0, "All files(*.*)", 0, "*.*", 0, 0
szCaption db "test packer by thirdlee", 0
szOpenFileErr db "打开文件失败！", 0
szNotPEFile db "该文件不是PE文件！", 0
szSectionName db ".lee", 0
szModified db "这个文件已经被我修改过了。", 0
szBackup db ".bak", 0
szMemErr db "申请内存失败！", 0
szOver db "修改完毕！", 0
szEncryptSec db ".text", 0
pShellMap dd 0
pSecMap dd 0
dwSecOffset dd 0
dwSecSize dd 0
dwSecVirtualAddr dd 0
dwRWSize dd 1024*60
dwCount dd 0
.data?
ofn OPENFILENAME <>
hInst dd ?
szFileName db MAX_PATH dup (?)
hFile HANDLE ?
dosh IMAGE_DOS_HEADER <>
nth IMAGE_NT_HEADERS32 <>
sech IMAGE_SECTION_HEADER <>
szFileBackup db MAX_PATH dup (?)
.code
main:
;获取实例句柄
invoke GetModuleHandle, eax
mov hInst, eax
;填充打开文件对话框的结构体
mov ofn.hInstance, eax
mov ofn.lStructSize, sizeof ofn
mov ofn.lpstrFilter, offset szFilter
mov ofn.lpstrFile, offset szFileName ;用来保存选中的文件名（含路径）
mov ofn.nMaxFile, sizeof szFileName
;调用通用的打开文件对话框
invoke GetOpenFileName, offset ofn
.if eax == 0
invoke ExitProcess, 0
.endif
;打开文件
invoke CreateFile, offset szFileName, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ \
or FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox, NULL, offset szOpenFileErr, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
mov hFile, eax
invoke ReadFile, hFile, offset dosh, sizeof IMAGE_DOS_HEADER, esp, 0
.if dosh.e_magic != IMAGE_DOS_SIGNATURE
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szNotPEFile, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
invoke SetFilePointer, hFile, dosh.e_lfanew, NULL, FILE_BEGIN
invoke ReadFile, hFile, offset nth, sizeof IMAGE_NT_HEADERS32, esp, 0
.if nth.Signature != IMAGE_NT_SIGNATURE
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szNotPEFile, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
movzx ecx, nth.FileHeader.NumberOfSections
xor ebx, ebx
xor edx, edx
ReadSection:
push ecx
push ebx
push edx
invoke ReadFile, hFile, offset sech, sizeof IMAGE_SECTION_HEADER, esp, 0
invoke lstrcmp, offset szSectionName, offset sech.Name1
.if eax == 0
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szModified, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
;获取要加密节的相关信息
invoke lstrcmp, offset szEncryptSec, offset sech.Name1
.if eax == 0
push sech.PointerToRawData
pop dwSecOffset
push sech.SizeOfRawData
pop dwSecSize
mov dwSecSize, 10h
push sech.VirtualAddress
pop dwSecVirtualAddr
mov eax, nth.OptionalHeader.ImageBase
add dwSecVirtualAddr, eax
mov sech.Characteristics, 0E00000E0h
mov eax, sizeof IMAGE_SECTION_HEADER
neg eax
invoke SetFilePointer, hFile, eax, NULL, FILE_CURRENT
invoke WriteFile, hFile, offset sech, sizeof IMAGE_SECTION_HEADER, esp, 0
.endif
pop edx
mov eax, sech.PointerToRawData
add eax, sech.SizeOfRawData
mov edx, eax
pop ebx
mov eax, sech.VirtualAddress
add eax, sech.Misc.VirtualSize
mov ebx, eax
pop ecx
dec ecx
.if ecx > 0
jmp ReadSection
.endif
pushad
;这个文件没有被改过，在改之前先备份
invoke lstrcpy, offset szFileBackup, offset szFileName
invoke lstrcat, offset szFileBackup, offset szBackup
invoke CopyFile, offset szFileName, offset szFileBackup, FALSE
;给新加的节赋名称
invoke lstrcpy, offset sech.Name1, offset szSectionName
popad
mov eax, ShellSize
mov sech.Misc.VirtualSize, eax
mov sech.VirtualAddress, ebx
mov sech.PointerToRawData, edx
mov sech.SizeOfRawData, eax
mov sech.PointerToRelocations, ecx
mov sech.PointerToLinenumbers, ecx
mov dword ptr sech.NumberOfRelocations, ecx
;文件按块对齐
xor edx, edx
mov eax, sech.SizeOfRawData
mov ebx, 1ffh
idiv ebx
.if edx != 0
sub edx, 200h
neg edx
add sech.SizeOfRawData, edx
.endif
;节对齐
mov ebx, sech.VirtualAddress
mov edx, 00000fffh
and ebx, edx
.if ebx != 0
sub ebx, 1000h
neg ebx
add sech.VirtualAddress, ebx
.endif
;修改节属性
mov sech.Characteristics, 0E00000E0h
;写入新的节头信息
invoke WriteFile, hFile, offset sech, sizeof IMAGE_SECTION_HEADER, esp, 0
;申请内存来读第一个节数据
invoke VirtualAlloc, NULL, dwSecSize, MEM_COMMIT, PAGE_READWRITE
.if eax == NULL
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szMemErr, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
mov pSecMap, eax
;读入第一个节
push 0
pop dwCount
invoke SetFilePointer, hFile, dwSecOffset, NULL, FILE_BEGIN
mov eax, dwSecSize
xor edx,edx
idiv dwRWSize
mov ecx, eax
mov eax, pSecMap
add eax, dwCount
@@ReadSecData:
.if ecx > 0
push edx
invoke ReadFile, hFile, eax, dwRWSize, esp, 0
pop edx
add eax, dwRWSize
dec ecx
jmp @@ReadSecData
.endif
.if edx != 0
invoke ReadFile, hFile, eax, edx, esp, 0
.endif
;对读出的数据进行加密处理
push 0
pop dwCount
mov ecx, dwSecSize
mov eax, pSecMap
add eax, dwCount
@@Crypt:
xor byte ptr [eax], 1
inc eax
loop @@Crypt
;把数据写回去
push 0
pop dwCount
invoke SetFilePointer, hFile, dwSecOffset, NULL, FILE_BEGIN
mov eax, dwSecSize
xor edx, edx
idiv dwRWSize
mov ecx, eax
mov eax, pSecMap
add eax, dwCount
@@WriteSecData:
.if ecx > 0
push edx
invoke WriteFile, hFile, eax, dwRWSize, esp, 0
pop edx
add eax, dwRWSize
dec ecx
jmp @@WriteSecData
.endif
.if edx != 0
invoke WriteFile, hFile, eax, edx, esp, 0
.endif
;释放申请的内存空间
invoke VirtualFree, pSecMap, 0, MEM_RELEASE
inc nth.FileHeader.NumberOfSections
mov eax, sech.Misc.VirtualSize
add nth.OptionalHeader.SizeOfImage, eax
mov edx, 00000fffh
and eax, edx
.if eax != 0
sub eax, 1000h
neg eax
add nth.OptionalHeader.SizeOfImage, eax
.endif
;去掉bound import
;(88)表示11*8， 即 DataDirectory[11]
push 0
pop nth.OptionalHeader.DataDirectory(88).VirtualAddress
;拷贝壳代码
invoke VirtualAlloc, NULL, ShellSize, MEM_COMMIT, PAGE_READWRITE
.if eax == NULL
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szMemErr, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
.endif
mov pShellMap, eax
push dwSecVirtualAddr
push dwSecSize
mov ecx, ShellSize
mov esi, ShellStart
mov edi, offset pShellMap
rep movsb
pop dwSecSize
pop dwSecVirtualAddr
;保存旧入口地址
mov eax, dword ptr nth.OptionalHeader.AddressOfEntryPoint
add eax, dword ptr nth.OptionalHeader.ImageBase
mov ebx, offset OldOep - offset ShellStart
add ebx, offset pShellMap
mov dword ptr[ebx], eax
;保存第一个节表的虚拟地址
mov eax, dwSecVirtualAddr
mov ebx, offset SecStart - offset ShellStart
add ebx, offset pShellMap
mov dword ptr [ebx], eax
;保存第一个节的大小
mov eax, dwSecSize
mov ebx, offset SecSize - offset ShellStart
add ebx, offset pShellMap
mov dword ptr [ebx], eax
;写入新的入口地址
mov eax, sech.VirtualAddress
add eax, ShellCodeStart - ShellStart + 4
mov nth.OptionalHeader.AddressOfEntryPoint, eax
invoke SetFilePointer, hFile, dosh.e_lfanew, NULL, FILE_BEGIN
invoke WriteFile, hFile, offset nth, sizeof IMAGE_NT_HEADERS32, esp, 0
mov eax, sech.PointerToRawData
push eax
invoke SetFilePointer, hFile, eax, NULL, FILE_BEGIN
mov eax, ShellSize
invoke WriteFile, hFile, offset pShellMap, eax, esp, 0
invoke VirtualFree, pShellMap, 0, MEM_RELEASE
pop eax
add eax, sech.SizeOfRawData
dec eax
invoke SetFilePointer, hFile, eax, NULL, FILE_BEGIN
invoke WriteFile, hFile, offset szCaption, 1, esp, 0
invoke CloseHandle, hFile
invoke MessageBox, NULL, offset szOver, offset szCaption, MB_OK or MB_ICONINFORMATION
invoke ExitProcess, 0
end main
|
