Indetectables

Código: Seleccionar todo

	PIMAGE_DOS_HEADER IDH;
	PIMAGE_NT_HEADERS INTH;
	PIMAGE_SECTION_HEADER ISH;

	DWORD NewSectionSize = dwStubFileSize;

	LPBYTE Temp = (LPBYTE)malloc( dwOriginalFileSize + NewSectionSize );
	CopyMemory(&Temp[0], lpOriginalFileBuffer, dwOriginalFileSize);
	//CopyMemory(&Temp[ dwOriginalFileSize ], lpStubFileBuffer, dwStubFileSize);
	CopyMemory(&Temp[0], lpOriginalFileBuffer, dwOriginalFileSize);
	memset(&Temp[dwOriginalFileSize], 0, NewSectionSize);

	IDH = (PIMAGE_DOS_HEADER)&Temp[0];
	INTH = (PIMAGE_NT_HEADERS)&Temp[ IDH->e_lfanew ];

	for(DWORD i=0; i < INTH->FileHeader.NumberOfSections; i++)
	{
		ISH = (PIMAGE_SECTION_HEADER)&Temp[ IDH->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i ];
		ISH->Misc.VirtualSize = ISH->SizeOfRawData;
	}

	DWORD NumberOfSections = INTH->FileHeader.NumberOfSections;
	DWORD e_lfanew = IDH->e_lfanew;

	ISH = (PIMAGE_SECTION_HEADER)&Temp[ IDH->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * (NumberOfSections-1) ];
	DWORD LastVirtualOffset = ISH->VirtualAddress;

	CopyMemory(&Temp[ IDH->e_lfanew - 0x28 ], &lpOriginalFileBuffer[ IDH->e_lfanew ], sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * INTH->FileHeader.NumberOfSections);
	memset(&Temp[ e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * (NumberOfSections - 1) ], 0, 0x28);

	IDH->e_lfanew = IDH->e_lfanew - 0x28;

	INTH = (PIMAGE_NT_HEADERS)&Temp[ IDH->e_lfanew ];

	ISH = (PIMAGE_SECTION_HEADER)&Temp[ e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * (NumberOfSections - 1) ];
	BYTE SectionName[8] = ".newsec";
	CopyMemory( ISH->Name, SectionName, 8 );

	ISH->SizeOfRawData = NewSectionSize;
	ISH->PointerToRawData = dwOriginalFileSize;
	ISH->Characteristics = 0xE0000020;
	ISH->VirtualAddress = LastVirtualOffset + INTH->OptionalHeader.SectionAlignment;
	ISH->Misc.VirtualSize = NewSectionSize;

	INTH->FileHeader.NumberOfSections = INTH->FileHeader.NumberOfSections + 1;
	INTH->OptionalHeader.SizeOfImage = ISH->VirtualAddress + ISH->Misc.VirtualSize;

	DWORD dwBytesWritten;
	HANDLE hNewFile;
	hNewFile = CreateFile(szFinalFileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
	if( hStubFile == INVALID_HANDLE_VALUE ) {
		MessageBox(g_hWnd, L"IMPOSIBLE CREAR ARCHIVO!", WINDOW_TITLE, MB_OK | MB_ICONERROR);
		return FALSE;
	}
	WriteFile(hNewFile, Temp, (dwOriginalFileSize + NewSectionSize), &dwBytesWritten, NULL);
	CloseHandle(hNewFile);

Código: Seleccionar todo

printf("\tDOS Signature: 0x%x\n", this->m_ImageDosHeader->e_magic); //OK
//Añadimos algo de espacio libre al final del ejecutable
Append(dwSpace, 0xFF);

printf("\tDOS Signature: 0x%x\n", this->m_ImageDosHeader->e_magic); //sigue OK
	
LPBYTE tmpBuff = (LPBYTE) malloc( m_ImageNtHeaders->OptionalHeader.FileAlignment );
printf("\tDOS Signature: 0x%x\n", this->m_ImageDosHeader->e_magic); // MAL! devuelve 0xcdcd | me esta sobreescribiendo ??


//vamos a reinicializar las cabeceras, a ver que tal...
m_ImageDosHeader = (PIMAGE_DOS_HEADER) &m_FileBuffer[ 0 ];
printf("\tDos Signature: 0x%x\n", m_ImageDosHeader->e_magic); // OK! devuelve el valor correcto

/*
DWORD dwFileSize = this->GetSize();
printf("\tFile size: 0x%x\n", dwFileSize);
printf("\tSizeOfHeaders: 0x%x\n", m_ImageNtHeaders->OptionalHeader.SizeOfHeaders);

//Movemos bytes del 'final del fichero' hasta el 'final de las cabeceras'
for(i = 0, l = dwFileSize - m_ImageNtHeaders->OptionalHeader.SizeOfHeaders; i < l; i += m_ImageNtHeaders->OptionalHeader.FileAlignment)
{
	printf("\tSection (i): %d\n", i);
	//Guardamos un bloque (FileAlignment) en el buffer temporal para realizar el desplazamiento
	memcpy(&tmpBuff, &m_FileBuffer[ dwFileSize - dwSpace - i ], m_ImageNtHeaders->OptionalHeader.FileAlignment);

	printf("\t1st MemCpy done!\n");
	//Recolocamos los datos leidos...
	memcpy(&m_FileBuffer[ (dwFileSize - dwSpace - i) + (dwSpace - 1) ], tmpBuff,  m_ImageNtHeaders->OptionalHeader.FileAlignment);

	printf("\t2nd MemCpy done!\n");
}

//Incrementamos el puntero a la "Raw Data" de cada descción
for(i = m_ImageNtHeaders->FileHeader.NumberOfSections - 1; i >= 0; i--) {
	m_ImageSectionHeaders[ i ].SetPointerToRawData( m_ImageSectionHeaders[ i ].GetPointerToRawData() + dwSpace );
}
*/
free( tmpBuff );

Código: Seleccionar todo

VOID PE::Append(DWORD dwBytes, BYTE cValue) {
	m_FileBuffer = (LPBYTE) realloc(m_FileBuffer, (m_FileBufferSize + dwBytes));
	memset(&m_FileBuffer[ m_FileBufferSize ], cValue, dwBytes);
	m_FileBufferSize += dwBytes;
}