274 lines
7.0 KiB
C++
274 lines
7.0 KiB
C++
// ShellCode.cpp : Defines the entry point for the console application.
|
||
//
|
||
|
||
#include "stdafx.h"
|
||
#include <stdlib.h>
|
||
#include <Windows.h>
|
||
|
||
void EncryptPlug(char *szRec,long nLen,long key) //加密插件
|
||
{
|
||
unsigned long i;
|
||
unsigned char p;
|
||
|
||
p = (unsigned char ) key % 1451 + 61;
|
||
for(i = 0; i < nLen; i++)
|
||
{
|
||
*szRec -= p;
|
||
*szRec++ ^= p;
|
||
}
|
||
}
|
||
|
||
void EncryptData(char *szRec,long nLen,long key) //解密插件
|
||
{
|
||
unsigned long i;
|
||
unsigned char p;
|
||
|
||
p = (unsigned char ) key % 1451 + 61;
|
||
for(i = 0; i < nLen; i++)
|
||
{
|
||
*szRec ^= p;
|
||
*szRec += p;
|
||
szRec++;
|
||
}
|
||
}
|
||
BOOL SaveMain(char *FileName) //生成加密后的文件(Server.dll)
|
||
{
|
||
HANDLE hDllFile;
|
||
DWORD dwDllSize;
|
||
LPVOID pDllBuff;
|
||
DWORD BytesRead;
|
||
DWORD BytesWritten;
|
||
|
||
hDllFile = CreateFile(FileName, GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (hDllFile == INVALID_HANDLE_VALUE)
|
||
return FALSE;
|
||
dwDllSize = GetFileSize(hDllFile, 0);
|
||
|
||
pDllBuff = VirtualAlloc(NULL, dwDllSize, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||
if (pDllBuff == NULL)
|
||
{
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
if (!ReadFile(hDllFile, pDllBuff, dwDllSize, &BytesRead, NULL))
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
CloseHandle(hDllFile);
|
||
|
||
EncryptPlug((char *)pDllBuff, dwDllSize, 1024);
|
||
hDllFile = CreateFile(FileName, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
|
||
if (hDllFile == INVALID_HANDLE_VALUE)
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hDllFile, pDllBuff, dwDllSize, &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return TRUE;
|
||
}
|
||
|
||
BOOL SaveCode(char *FileName) //生成ShellCode(ShellCode.h)
|
||
{
|
||
HANDLE hDllFile;
|
||
DWORD dwDllSize;
|
||
LPVOID pDllBuff;
|
||
DWORD BytesRead;
|
||
LPVOID pOutBuff;
|
||
HANDLE hOutFile;
|
||
DWORD BytesWritten;
|
||
|
||
hDllFile = CreateFile(FileName, GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (hDllFile == INVALID_HANDLE_VALUE)
|
||
return FALSE;
|
||
dwDllSize = GetFileSize(hDllFile, 0);
|
||
|
||
pDllBuff = VirtualAlloc(NULL, dwDllSize, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||
if (pDllBuff == NULL)
|
||
{
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
if (!ReadFile(hDllFile, pDllBuff, dwDllSize, &BytesRead, NULL))
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
CloseHandle(hDllFile);
|
||
|
||
pOutBuff = VirtualAlloc(NULL, (dwDllSize*5-1)+((dwDllSize+32-1)/32*2), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||
if (pOutBuff == NULL)
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
return FALSE;
|
||
}
|
||
|
||
char *pDllChar = (char *)pDllBuff;
|
||
char *pOutChar = (char *)pOutBuff;
|
||
for (DWORD i = 0; i < dwDllSize; i++)
|
||
{
|
||
if (i == dwDllSize - 1)
|
||
{
|
||
sprintf(pOutChar, "0x%0.2X", (unsigned char)*pDllChar++);
|
||
pOutChar += 4;
|
||
}
|
||
else
|
||
{
|
||
sprintf(pOutChar, "0x%0.2X,", (unsigned char)*pDllChar++);
|
||
pOutChar += 5;
|
||
}
|
||
|
||
if (i % 32 == 31 || i == dwDllSize - 1)
|
||
{
|
||
*pOutChar++ = '\r';
|
||
*pOutChar++ = '\n';
|
||
}
|
||
}
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
|
||
char OutData1[] = "/*\r\n ShellCode转换器 By Anonymity\r\n My QQ ????????\r\n"
|
||
" 直接include此单元，使用 ShellCodeSaveFile(\"xxx.xxx\");即可生成文件\r\n*/\r\n\r\n";
|
||
char OutData2[] = "#ifndef _HEX_SHELLCODE_\r\n#define _HEX_SHELLCODE_\r\n#include <windows.h>\r\n\r\n";
|
||
char OutData3[64] = {0};
|
||
sprintf(OutData3, "const g_ShellCodeFileSize = %d;\r\n", dwDllSize);
|
||
char OutData4[] = "unsigned char g_ShellCodeFileBuff[] = {\r\n";
|
||
char OutData5[] = "};\r\n\r\n";
|
||
char OutData6[] = "/*\r\nbool ShellCodeSaveFile(char *FileName)\r\n{\r\n\tbool Result = false;"
|
||
"\r\n\tHANDLE hFile;\r\n\tDWORD dwBytesWritten;\r\n"
|
||
"\thFile = CreateFile(FileName,GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,NULL,NULL);\r\n"
|
||
"\tif (hFile == INVALID_HANDLE_VALUE) Result = false;\r\n"
|
||
"\tif (WriteFile(hFile, g_ShellCodeFileBuff, g_ShellCodeFileSize, &dwBytesWritten, NULL)) Result = true;\r\n"
|
||
"\tCloseHandle(hFile);\r\n\treturn Result;\r\n}\r\n*/\r\n\r\n#endif\r\n";
|
||
|
||
hOutFile = CreateFile("ShellCode.h", GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, 0, NULL);
|
||
if (hOutFile == INVALID_HANDLE_VALUE)
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData1, strlen(OutData1), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData2, strlen(OutData2), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData3, strlen(OutData3), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData4, strlen(OutData4), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, pOutBuff, (dwDllSize*5-1)+((dwDllSize+32-1)/32*2), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData5, strlen(OutData5), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hOutFile, OutData6, strlen(OutData6), &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return FALSE;
|
||
}
|
||
VirtualFree(pOutBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hOutFile);
|
||
return TRUE;
|
||
}
|
||
|
||
BOOL SavePlug()
|
||
{
|
||
HANDLE hDllFile;
|
||
DWORD dwDllSize;
|
||
LPVOID pDllBuff;
|
||
DWORD BytesRead;
|
||
DWORD BytesWritten;
|
||
|
||
hDllFile = CreateFile("1.dll", GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (hDllFile == INVALID_HANDLE_VALUE)
|
||
return FALSE;
|
||
dwDllSize = GetFileSize(hDllFile, 0);
|
||
|
||
pDllBuff = VirtualAlloc(NULL, dwDllSize, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||
if (pDllBuff == NULL)
|
||
{
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
if (!ReadFile(hDllFile, pDllBuff, dwDllSize, &BytesRead, NULL))
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
CloseHandle(hDllFile);
|
||
|
||
if (((PIMAGE_DOS_HEADER)pDllBuff)->e_magic == IMAGE_DOS_SIGNATURE)
|
||
EncryptPlug((char *)pDllBuff, dwDllSize, 1024);
|
||
else
|
||
EncryptData((char *)pDllBuff, dwDllSize, 1024);
|
||
|
||
hDllFile = CreateFile("2.dll", GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
|
||
if (hDllFile == INVALID_HANDLE_VALUE)
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
return FALSE;
|
||
}
|
||
if (!WriteFile(hDllFile, pDllBuff, dwDllSize, &BytesWritten, NULL))
|
||
{
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return FALSE;
|
||
}
|
||
VirtualFree(pDllBuff, 0, MEM_RELEASE);
|
||
CloseHandle(hDllFile);
|
||
return TRUE;
|
||
}
|
||
|
||
int main(int argc, char* argv[])
|
||
{
|
||
// unsigned char MyFileTabLe[] = {0xBE, 0x16, 0xCF, 0x52, 0xCD};
|
||
|
||
if (argc == 3)
|
||
{
|
||
if (argv[1][0] != '-') return -1;
|
||
|
||
switch (argv[1][1])
|
||
{
|
||
case 'E': //输入未加密文件名(Server.dll), 生成加密后的文件(Server.dll)
|
||
return SaveMain(argv[2]) ? 0 : -1;
|
||
case 'S': //输入已加密文件名(Server.dll), 生成"ShellCode.h"
|
||
return SaveCode(argv[2]) ? 0 : -1;
|
||
default:
|
||
return -1;
|
||
}
|
||
}
|
||
return SavePlug() ? 0 : -1;
|
||
}
|