在內存中運行可執行程序，好處是可以給程序加殼，加密源程序，靜態反匯編無法獲得PE輸入節，但是因為運行后仍然是獨立的進程，所以沒辦法防止遠程線程注入，掛接API鉤子。

?? typedef IMAGE_SECTION_HEADER ( * PIMAGE_SECTION_HEADERS)[ 1 ];??
?
?//? 計算對齊后的大小???
?unsigned? long? GetAlignedSize(unsigned? long? Origin, unsigned? long? Alignment)??
? {??
???? return? (Origin? +? Alignment? -?? 1 )? /? Alignment? *? Alignment;??
}???
?
?//? 計算加載pe并對齊需要占用多少內存??
?//? 未直接使用OptionalHeader.SizeOfImage作為結果是因為據說有的編譯器生成的exe這個值會填0???
?unsigned? long? CalcTotalImageSize(PIMAGE_DOS_HEADER MzH??
???????????????????????????????? , unsigned? long? FileLen??
???????????????????????????????? , PIMAGE_NT_HEADERS peH??
???????????????????????????????? , PIMAGE_SECTION_HEADERS peSecH)??
? {??
??? unsigned? long? res;??
???? //? 計算pe頭的大小???
???? res? =? GetAlignedSize( peH -> OptionalHeader.SizeOfHeaders , peH -> OptionalHeader.SectionAlignment);??
?
???? //? 計算所有節的大小???
????? for (? int? i? =?? 0 ; i? <? peH -> FileHeader.NumberOfSections;? ++ i)??
????? {??
???????? //? 超出文件范圍???
????????? if (peSecH[i] -> PointerToRawData? +? peSecH[i] -> SizeOfRawData? >? FileLen)?
????????? {
???????????? return?? 0 ;??
??????? }
???????? else?? if (peSecH[i] -> VirtualAddress) // 計算對齊后某節的大小???
??????????? {??
???????????? if (peSecH[i] -> Misc.VirtualSize)??
????????????? {??
??????????????? res? =? GetAlignedSize( peSecH[i] -> VirtualAddress? +? peSecH[i] -> Misc.VirtualSize??
??????????????????? , peH -> OptionalHeader.SectionAlignment);??
??????????? }???
???????????? else??
????????????? {??
??????????????? res? =? GetAlignedSize( peSecH[i] -> VirtualAddress? +? peSecH[i] -> SizeOfRawData??
??????????????????? , peH -> OptionalHeader.SectionAlignment);??
??????????? }???
??????? }???
???????? else?? if ( peSecH[i] -> Misc.VirtualSize? <? peSecH[i] -> SizeOfRawData )??
????????? {??
??????????? res? +=? GetAlignedSize( peSecH[i] -> SizeOfRawData??
??????????????? , peH -> OptionalHeader.SectionAlignment);??
??????? }???
???????? else??
????????? {??
??????????? res? +=? GetAlignedSize( peSecH[i] -> Misc.VirtualSize??
??????????????? , peH -> OptionalHeader.SectionAlignment);??
??????? } //? if_else???
???? } //? for???
???????
???? return? res;??
}???
?
?//? 加載pe到內存并對齊所有節???
?BOOL AlignPEToMem(? void?? * Buf??
????????????????? ,? long? Len??
????????????????? , PIMAGE_NT_HEADERS? & peH??
????????????????? , PIMAGE_SECTION_HEADERS? & peSecH??
????????????????? ,? void?? *& Mem??
????????????????? , unsigned? long?? & ImageSize)??
? {??
??? PIMAGE_DOS_HEADER SrcMz; //? DOS頭???
???? PIMAGE_NT_HEADERS SrcPeH; //? PE頭???
???? PIMAGE_SECTION_HEADERS SrcPeSecH; //? 節表???
???????
??? SrcMz? =? (PIMAGE_DOS_HEADER)Buf;??
?
???? if ( Len? <?? sizeof (IMAGE_DOS_HEADER) )???
???????? return? FALSE;??
??????
???? if ( SrcMz -> e_magic? !=? IMAGE_DOS_SIGNATURE )??
???????? return? FALSE;??
??????
???? if ( Len? <? SrcMz -> e_lfanew? +? ( long ) sizeof (IMAGE_NT_HEADERS) )??
???????? return? FALSE;??
?
??? SrcPeH? =? (PIMAGE_NT_HEADERS)(( int )SrcMz? +? SrcMz -> e_lfanew);??
???? if ( SrcPeH -> Signature? !=? IMAGE_NT_SIGNATURE )??
???????? return? FALSE;??
?
???? if ( (SrcPeH -> FileHeader.Characteristics? &? IMAGE_FILE_DLL)? ||???
??????? (SrcPeH -> FileHeader.Characteristics? &? IMAGE_FILE_EXECUTABLE_IMAGE? ==?? 0 )? ||???
??????? (SrcPeH -> FileHeader.SizeOfOptionalHeader? !=?? sizeof (IMAGE_OPTIONAL_HEADER)) )??
????? {??
???????? return? FALSE;??
??? }???
?
?
??? SrcPeSecH? =? (PIMAGE_SECTION_HEADERS)(( int )SrcPeH? +?? sizeof (IMAGE_NT_HEADERS));??
??? ImageSize? =? CalcTotalImageSize( SrcMz, Len, SrcPeH, SrcPeSecH);??
?
???? if ( ImageSize? ==?? 0? )??
???????? return? FALSE;??
??????
??? Mem? =? VirtualAlloc( NULL, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);? //? 分配內存???
????? if ( Mem? !=? NULL )??
????? {??
???????? //? 計算需要復制的PE頭字節數???
???????? unsigned? long? l? =? SrcPeH -> OptionalHeader.SizeOfHeaders;??
???????? for (? int? i? =?? 0 ; i? <? SrcPeH -> FileHeader.NumberOfSections;? ++ i)??
????????? {??
???????????? if ( (SrcPeSecH[i] -> PointerToRawData)? &&???
??????????????? (SrcPeSecH[i] -> PointerToRawData? <? l) )??
????????????? {??
??????????????? l? =? SrcPeSecH[i] -> PointerToRawData;??
??????????? }???
??????? }???
??????? memmove( Mem, SrcMz, l);??
??????? peH? =? (PIMAGE_NT_HEADERS)(( int )Mem? +? ((PIMAGE_DOS_HEADER)Mem) -> e_lfanew);??
??????? peSecH? =? (PIMAGE_SECTION_HEADERS)(( int )peH? +?? sizeof (IMAGE_NT_HEADERS));??
?
???????? void?? * Pt? =? ( void?? * )((unsigned? long )Mem???
???????????? +? GetAlignedSize( peH -> OptionalHeader.SizeOfHeaders??
??????????? , peH -> OptionalHeader.SectionAlignment)??
??????????? );??
?
???????? for ( i? =?? 0 ; i? <? peH -> FileHeader.NumberOfSections;? ++ i)??
????????? {??
???????????? //? 定位該節在內存中的位置???
????????????? if (peSecH[i] -> VirtualAddress)??
??????????????? Pt? =? ( void?? * )((unsigned? long )Mem? +? peSecH[i] -> VirtualAddress);??
?
???????????? if (peSecH[i] -> SizeOfRawData)??
????????????? {??
???????????????? //? 復制數據到內存???
???????????????? memmove(Pt, ( const?? void?? * )((unsigned? long )(SrcMz)? +? peSecH[i] -> PointerToRawData), peSecH[i] -> SizeOfRawData);??
???????????????? if (peSecH[i] -> Misc.VirtualSize? <? peSecH[i] -> SizeOfRawData)??
??????????????????? Pt? =? ( void?? * )((unsigned? long )Pt? +? GetAlignedSize(peSecH[i] -> SizeOfRawData, peH -> OptionalHeader.SectionAlignment));??
???????????????? else?? //? pt 定位到下一節開始位置???
???????????????????? Pt? =? ( void?? * )((unsigned? long )Pt? +? GetAlignedSize(peSecH[i] -> Misc.VirtualSize, peH -> OptionalHeader.SectionAlignment));??
??????????? }???
???????????? else??
????????????? {??
??????????????? Pt? =? ( void?? * )((unsigned? long )Pt? +? GetAlignedSize(peSecH[i] -> Misc.VirtualSize, peH -> OptionalHeader.SectionAlignment));??
??????????? }???
??????? }???
??? }???
???? return? TRUE;??
}???
?
???
typedef? void?? * (__stdcall? * pfVirtualAllocEx)(unsigned? long ,? void?? * , unsigned? long , unsigned? long , unsigned? long );??
pfVirtualAllocEx MyVirtualAllocEx? =? NULL;??
?
BOOL IsNT()??
? {??
???? return? MyVirtualAllocEx != NULL;??
}???
?
?//? 生成外殼程序命令行???
?char?? * PrepareShellExe( char?? * CmdParam, unsigned? long? BaseAddr, unsigned? long? ImageSize)??
? {??
???? if (IsNT())??
????? {??
???????? char?? * Buf? =?? new?? char [ 256 ];??
??????? memset(Buf,? 0 ,? 256 );??
??????? GetModuleFileName( 0 , Buf,? 256 );??
??????? strcat(Buf, CmdParam);??
???????? return? Buf;? //? 請記得釋放內存;-)???
???? }???
???? else??
????? {??
???????? //? Win98下的處理請參考原文;-)??
???????? //?? http://community.csdn.net/Expert/topic/4416/4416252.xml?temp=8.709133E-03????
????????? return? NULL;??
??? }???
}???
?
?//? 是否包含可重定向列表???
?BOOL HasRelocationTable(PIMAGE_NT_HEADERS peH)??
? {??
???? return? (peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)??
???????? &&? (peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);??
}???
?
#pragma pack(push,? 1 )??
typedef? struct? {??
??? unsigned? long? VirtualAddress;??
??? unsigned? long? SizeOfBlock;??
}?? * PImageBaseRelocation;??
#pragma pack(pop)??
?
?//? 重定向PE用到的地址???
?void? DoRelocation(PIMAGE_NT_HEADERS peH,? void?? * OldBase,? void?? * NewBase)??
? {??
??? unsigned? long? Delta? =? (unsigned? long )NewBase? -? peH -> OptionalHeader.ImageBase;??
??? PImageBaseRelocation p? =? (PImageBaseRelocation)((unsigned? long )OldBase???
???????? +? peH -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);??
???? while (p -> VirtualAddress? +? p -> SizeOfBlock)??
????? {??
??????? unsigned? short?? * pw? =? (unsigned? short?? * )(( int )p? +?? sizeof ( * p));??
???????? for (unsigned? int? i = 1 ; i? <=? (p -> SizeOfBlock? -?? sizeof ( * p))? /?? 2 ;? ++ i)??
????????? {??
???????????? if (( * pw)? &?? 0xF000?? ==?? 0x3000 )? {??
??????????????? unsigned? long?? * t? =? (unsigned? long?? * )((unsigned? long )(OldBase)? +? p -> VirtualAddress? +? (( * pw)? &?? 0x0FFF ));??
???????????????? * t? +=? Delta;??
??????????? }???
???????????? ++ pw;??
??????? }???
??????? p? =? (PImageBaseRelocation)pw;??
??? }???
}???
?
?//? 卸載原外殼占用內存???
?BOOL UnloadShell(HANDLE ProcHnd, unsigned? long? BaseAddr)??
? {??
??? typedef unsigned? long? (__stdcall? * pfZwUnmapViewOfSection)(unsigned? long , unsigned? long );??
??? pfZwUnmapViewOfSection ZwUnmapViewOfSection? =? NULL;??
??? BOOL res? =? FALSE;??
??? HMODULE m? =? LoadLibrary( " ntdll.dll " );??
???? if (m)? {??
??????? ZwUnmapViewOfSection? =? (pfZwUnmapViewOfSection)GetProcAddress(m,? " ZwUnmapViewOfSection " );??
???????? if (ZwUnmapViewOfSection)??
??????????? res? =? (ZwUnmapViewOfSection((unsigned? long )ProcHnd, BaseAddr)? ==?? 0 );??
??????? FreeLibrary(m);??
??? }???
???? return? res;??
}???
?
?//? 創建外殼進程并獲取其基址、大小和當前運行狀態???
?BOOL CreateChild( char?? * Cmd, CONTEXT? & Ctx, HANDLE? & ProcHnd, HANDLE? & ThrdHnd,???
???????????????? unsigned? long?? & ProcId, unsigned? long?? & BaseAddr, unsigned? long?? & ImageSize)??
? {??
??? STARTUPINFOA si;??
??? PROCESS_INFORMATION pi;??
??? unsigned? long? old;??
??? MEMORY_BASIC_INFORMATION MemInfo;??
??? memset( & si,? 0 ,? sizeof (si));??
??? memset( & pi,? 0 ,? sizeof (pi));??
??? si.cb? =?? sizeof (si);??
??????
??? BOOL res? =? CreateProcess(NULL, Cmd, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL,? & si,? & pi);? //? 以掛起方式運行進程;???
?????? if (res)? {??
??????? ProcHnd? =? pi.hProcess;??
??????? ThrdHnd? =? pi.hThread;??
??????? ProcId? =? pi.dwProcessId;??
???????? //? 獲取外殼進程運行狀態，[ctx.Ebx+8]內存處存的是外殼進程的加載基址，ctx.Eax存放有外殼進程的入口地址???
???????? Ctx.ContextFlags? =? CONTEXT_FULL;??
??????? GetThreadContext(ThrdHnd,? & Ctx);??
??????? ReadProcessMemory(ProcHnd, ( void?? * )(Ctx.Ebx + 8 ),? & BaseAddr,? sizeof (unsigned? long ),? & old);? //? 讀取加載基址???
????????? void?? * p? =? ( void?? * )BaseAddr;??
???????? //? 計算外殼進程占有的內存???
????????? while (VirtualQueryEx(ProcHnd, p,? & MemInfo,? sizeof (MemInfo)))??
????????? {??
???????????? if (MemInfo.State? =? MEM_FREE)? break ;??
??????????? p? =? ( void?? * )((unsigned? long )p? +? MemInfo.RegionSize);??
??????? }???
??????? ImageSize? =? (unsigned? long )p? -? (unsigned? long )BaseAddr;??
??? }???
???? return? res;??
}???
?
?//? 創建外殼進程并用目標進程替換它然后執行???
?HANDLE AttachPE( char?? * CmdParam, PIMAGE_NT_HEADERS peH, PIMAGE_SECTION_HEADERS peSecH,???
???????????????? void?? * Ptr, unsigned? long? ImageSize, unsigned? long?? & ProcId)??
? {??
??? HANDLE res? =? INVALID_HANDLE_VALUE;??
??? CONTEXT Ctx;??
??? HANDLE Thrd;??
??? unsigned? long? Addr, Size;??
???? char?? * s? =? PrepareShellExe(CmdParam, peH -> OptionalHeader.ImageBase, ImageSize);??
???? if (s == NULL)? return? res;??
???? if (CreateChild(s, Ctx, res, Thrd, ProcId, Addr, Size))? {??
???????? void?? * p? =? NULL;??
??????? unsigned? long? old;??
???????? if ((peH -> OptionalHeader.ImageBase? ==? Addr)? &&? (Size? >=? ImageSize))? { //? 外殼進程可以容納目標進程并且加載地址一致???
???????????? p? =? ( void?? * )Addr;??
??????????? VirtualProtectEx(res, p, Size, PAGE_EXECUTE_READWRITE,? & old);??
??????? }???
???????? else?? if (IsNT())? {??
???????????? if (UnloadShell(res, Addr))? { //? 卸載外殼進程占有內存???
???????????????? p? =? MyVirtualAllocEx((unsigned? long )res, ( void?? * )peH -> OptionalHeader.ImageBase, ImageSize, MEM_RESERVE? |? MEM_COMMIT, PAGE_EXECUTE_READWRITE);??
??????????? }???
???????????? if ((p? ==? NULL)? &&? HasRelocationTable(peH))? { //? 分配內存失敗并且目標進程支持重定向???
???????????????? p? =? MyVirtualAllocEx((unsigned? long )res, NULL, ImageSize, MEM_RESERVE? |? MEM_COMMIT, PAGE_EXECUTE_READWRITE);??
???????????????? if (p) DoRelocation(peH, Ptr, p);? //? 重定向???
???????????? }???
??????? }???
???????? if (p)? {??
??????????? WriteProcessMemory(res, ( void?? * )(Ctx.Ebx + 8 ),? & p,? sizeof (DWORD),? & old);? //? 重置目標進程運行環境中的基址???
???????????? peH -> OptionalHeader.ImageBase? =? (unsigned? long )p;??
???????????? if (WriteProcessMemory(res, p, Ptr, ImageSize,? & old))? { //? 復制PE數據到目標進程???
???????????????? Ctx.ContextFlags? =? CONTEXT_FULL;??
???????????????? if ((unsigned? long )p? ==? Addr)??
??????????????????? Ctx.Eax? =? peH -> OptionalHeader.ImageBase? +? peH -> OptionalHeader.AddressOfEntryPoint;? //? 重置運行環境中的入口地址???
????????????????? else??
??????????????????? Ctx.Eax? =? (unsigned? long )p? +? peH -> OptionalHeader.AddressOfEntryPoint;??
??????????????? SetThreadContext(Thrd,? & Ctx); //? 更新運行環境???
???????????????? ResumeThread(Thrd); //? 執行???
???????????????? CloseHandle(Thrd);??
??????????? }???
???????????? else? { //? 加載失敗,殺掉外殼進程???
???????????????? TerminateProcess(res,? 0 );??
??????????????? CloseHandle(Thrd);??
??????????????? CloseHandle(res);??
??????????????? res? =? INVALID_HANDLE_VALUE;??
??????????? }???
??????? }???
???????? else? { //? 加載失敗,殺掉外殼進程???
???????????? TerminateProcess(res,? 0 );??
??????????? CloseHandle(Thrd);??
??????????? CloseHandle(res);??
??????????? res? =? INVALID_HANDLE_VALUE;??
??????? }???
??? }???
??? delete[] s;??
???? return? res;??
}???
?
? /**/ /**/ /**/ /* ******************************************************/?
{ ******************************************************* }?
{ *???????????????? 從內存中加載并運行exe?????????????? * }?
{ ******************************************************* }?
{ * 參數：??????????????????????????????????????????????? }?
{ * Buffer: 內存中的exe地址?????????????????????????????? }?
{ * Len: 內存中exe占用長度??????????????????????????????? }?
{ * CmdParam: 命令行參數(不包含exe文件名的剩余命令行參數）}?
{ * ProcessId: 返回的進程Id?????????????????????????????? }?
{ * 返回值： 如果成功則返回進程的Handle(ProcessHandle),?? }?
{??????????? 如果失敗則返回INVALID_HANDLE_VALUE?????????? }?
{ ******************************************************* }?
?/****************************************************** */??
HANDLE MemExecute( void?? * ABuffer,? long? Len,? char?? * CmdParam, unsigned? long?? * ProcessId)??
? {??
??? HANDLE res? =? INVALID_HANDLE_VALUE;??
??? PIMAGE_NT_HEADERS peH;??
??? PIMAGE_SECTION_HEADERS peSecH;??
???? void?? * Ptr;??
??? unsigned? long? peSz;??
???? if (AlignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz))??
????? {??
??????? res? =? AttachPE(CmdParam, peH, peSecH, Ptr, peSz,? * ProcessId);??
??????? VirtualFree(Ptr, peSz, MEM_DECOMMIT);??
??? }???
???? return? res;??
}???
?
?//? 初始化???
?class? CInit??
? {??
?public :??
??? CInit()??
????? {??
??????? MyVirtualAllocEx? =? (pfVirtualAllocEx)GetProcAddress(GetModuleHandle( " Kernel32.dll " ),? " VirtualAllocEx " );??
??? }???
} Init;??
?
?int? main( int? argc,? char *? argv[])
? {
??? FILE *? fp;
??? fp? =? fopen( " E://CProject//DBGVIEW.EXE " , " rb " );
?if? ( fp )
????? {

??????? fseek(fp, 0l ,SEEK_END);
???????? int? file_size = ftell(fp); /**/ /* 獲取文件長度 */
???????? fseek(fp, 0l ,SEEK_SET); /**/ /* 回到文件頭部 */???
???????
???????
??????? LPBYTE pBuf? =?? new? BYTE[file_size];??
??????? memset( pBuf,? 0 , file_size);?

??????? fread(pBuf,file_size, 1 ,fp);

??????? DWORD id? =? GetCurrentProcessId();
??????? unsigned? long? ulProcessId? =?? 0 ;??
??????? MemExecute( pBuf, file_size,? "" ,? & ulProcessId);??
??????? delete[] pBuf;??
???????
??? }??
???
???? return?? 0 ;
}

總結

以上是生活随笔為你收集整理的给程序加壳的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。