IMAGE_DOS_HEADER STRUCT
e_magic WORD ?
e_cblp WORD ?
e_cp WORD ?
e_crlc WORD ?
e_cparhdr WORD ?
e_minalloc WORD ?
e_maxalloc WORD ?
e_ss WORD ?
e_sp WORD ?
e_csum WORD ?
e_ip WORD ?
e_cs WORD ?
e_lfarlc WORD ?
e_ovno WORD ?
e_res WORD 4 dup(?)
e_oemid WORD ?
e_oeminfo WORD ?
e_res2 WORD 10 dup(?)
e_lfanew DWORD ?
IMAGE_DOS_HEADER ENDS
.code
start:
call @F
@@:
pop eax
test eax, 80000000h
jnz RunAsDriver
push dword ptr [esp]
call GetBase
push esi
push edi
push ebx
mov esi, eax ;->hModule
call GetKernelBase
mov edi, eax ;->hKernel
cmp edi, esi
jnz LoadAsDll
@pushsz 'LoadLibraryA'
push edi
call GetApiAddress
;mov esi, eax
@pushsz 'user32.dll'
call eax
@pushsz 'MessageBoxA'
push eax
call GetApiAddress
push MB_OK
@pushsz 'Run As Exe'
@pushsz '以Exe方式运行'
push NULL
call eax
pop ebx
pop edi
pop esi
ret
LoadAsDll:
@pushsz 'LoadLibraryA'
push edi
call GetApiAddress
;mov esi, eax
@pushsz 'user32.dll'
call eax
@pushsz 'MessageBoxA'
push eax
call GetApiAddress
push MB_OK
@pushsz 'Run As Dll'
@pushsz '以Dll方式运行'
push NULL
call eax
pop ebx
pop edi
pop esi
ret 0Ch
RunAsDriver:
assume fs:nothing
;int 3
mov eax,dword ptr fs:[34h] ;KdVersionBlock获取内核基址Windows
add eax,18h
mov eax,[eax]
mov eax,[eax]
mov eax,[eax+18h]
push edi
push esi
mov edi, eax
@pushsz 'DbgPrint'
push eax
call GetApiAddress
@pushszl 'Run as Driver'
call eax
add esp, 4
mov eax, 0C0000001h
pop esi
pop edi
ret 08h
GetBase proc uses esi edi dwKernelRet:DWORD
LOCAL dwReturn: DWORD
mov edi, dwKernelRet
and edi, 0ffff0000h
.while TRUE
.if word ptr [edi] == IMAGE_DOS_SIGNATURE
mov esi, edi
add esi, [esi + IMAGE_DOS_HEADER.e_lfanew]
.if word ptr [esi] == IMAGE_NT_SIGNATURE
mov dwReturn, edi
.break
.endif
.endif
dec edi
xor di, di
.break .if edi < 070000000h
.endw
mov eax, dwReturn
ret
GetBase endp
GetKernelBase proc uses esi edi ebx ecx edx
local buffer[24]:byte
assume fs:nothing
call @F
@@:
pop ebx
sub ebx, offset @B
mov eax, fs:[30h]
mov eax, dword ptr [eax+0Ch]
lea edx, dword ptr [eax+0Ch]
mov eax, dword ptr [edx]
xor edi, edi
.while eax != edx
movzx ecx, word ptr[eax+2Ch]
.if ecx == 18h
mov esi, dword ptr [eax+30h]
lea edi, buffer
shr ecx, 2
rep movsd
lea edi, buffer
mov ecx, 0Ch
.repeat
or word ptr[edi], 20h
add edi, 2
.untilcxz
mov ecx, 0Ch
lea edi, buffer
mov esi, offset Kernel32
add esi, ebx
repe cmpsw
.if ZERO?
mov edi, [eax+18h] ;DllBase
.break
.endif
.endif
mov eax, [eax]
xor edi, edi
.endw
mov eax, edi
ret
GetKernelBase endp
Kernel32 db 'k',0,'e',0,'r',0,'n',0,'e',0,'l',0,'3',0,'2', 0, '.',0,'d',0,'l',0,'l',0
GetApiAddress proc uses ecx ebx edx esi edi hModule:DWORD, szApiName:DWORD
LOCAL dwReturn: DWORD
LOCAL dwApiLength: DWORD
mov dwReturn, 0
mov esi, szApiName
mov edx, esi
Continue_Searching_Null:
cmp byte ptr [esi], 0
jz We_Got_The_Length
inc esi
jmp Continue_Searching_Null
We_Got_The_Length:
inc esi
sub esi, edx
mov dwApiLength, esi