Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
Citarif ( HORA == 11:30 )
void ReemplazaO(char* str){//Reemplaza la primer ocurrencia de 'O'
if(strstr(str,"O")!=NULL)
{
*strstr(str,"O")='0';
return;
}
}char * strstr ( char * str1, const char * str2 );
//
// By 85
// elhacker.net
// etalking.com.ar
// boyscout_arg@hotmail.com
// 2013
//
#include<windows.h>
#include<stdio.h>
//
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
FARPROC nResult;
nResult=pGetProcAddress(hModule, lpProcName);
if (HIWORD(lpProcName))
{
if (!lstrcmp(lpProcName, "GetProcAddress"))
{
return (FARPROC) &newGetProcAddress;
}
}
return nResult;
}
//
DWORD PatchEAT( DWORD pOrgFunction, DWORD pNewFunction )
{
DWORD dwOldProtect;
DWORD dwOldProtect2;
DWORD pOldFunction = ((DWORD*)pOrgFunction)[0];
VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwOldProtect );
((DWORD*)pOrgFunction)[0] = pNewFunction;
VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), dwOldProtect, &dwOldProtect2 );
return pOldFunction;
}
//
void PatchEatConInlineASM(){
char* gpastr = "GetProcAddress";
DWORD k32base = (DWORD)GetModuleHandle("kernel32.dll");
// Logs
DWORD peheader=0;
DWORD rva_exports_dir=0;
DWORD rva_exports_funcs=0;
DWORD rva_exports_fnames=0;
DWORD va_exports_fnames=0;
DWORD va_eat=0;
int savedeax;
DWORD rEDX;
__asm{
mov ebx, k32base //EBX = kernel32.dll's base address
mov edx,dword ptr ds:[ebx+3Ch] //PE header
mov peheader, edx
mov edx,dword ptr ds:[edx+ebx+78h] //EDX = kernel32.dll's export directory (RVA)
mov rva_exports_dir, edx
mov eax,dword ptr ds:[edx+ebx+1Ch] //Address of exported funcs (EAX = EAT (RVA))
mov rva_exports_funcs, eax
mov edx,dword ptr ds:[edx+ebx+20h] //EDX = Address of function names (RVA)
mov rva_exports_fnames, edx
add edx,ebx //EDX = Address of function names (VA)
mov va_exports_fnames, edx
add eax,ebx //EAX = EAT (VA)
mov va_eat, eax
}
__asm{
get_exports:
xor ecx, ecx
mov esi,gpastr //Address of string "GetProcAddress" (not null-terminated)
mov edi,dword ptr ds:[edx] //EDI = *(EDX = VA of function names)
add edi,ebx //Address of string (Exported function name) (k32+offs en edi)
mov cl,0Eh //14 chars
repe cmpsb //recibe dos direcciones de 2 strings (ESI,EDI)
je short found_set_context //Jump if this is our function
add edx,4 //Next function name
add eax,4 //Next function address
jmp short get_exports
found_set_context:
mov savedeax, eax
mov edx,dword ptr ds:[eax]
add edx,ebx
mov rEDX, edx
}
printf("k32 0x%X\n",k32base);
printf("peheader 0x%X\n",peheader);
printf("rva_exports_dir 0x%X\n",rva_exports_dir);
printf("rva_exports_funcs 0x%X\n",rva_exports_funcs);
printf("rva_exports_fnames 0x%X\n",rva_exports_fnames);
printf("va_exports_fnames 0x%X\n",va_exports_fnames);
printf("va_eat 0x%X\n",va_eat);
printf("primer entrada de va_eat 0x%X\n",*(DWORD*)va_eat);//da un rva
printf("savedeax 0x%X\n",savedeax);// eat entry para gpa
printf("savedeax 0x%X\n",*(DWORD*)savedeax);// el rva en el eat entry correspondiente a gpa
printf("GetProcAddress 0x%X\n",GetProcAddress);
printf("rEDX 0x%X\n",rEDX);
system("pause");
/////////////////////////////////////////////////
// Calcular el rva con mi gpa
DWORD rvaMiGPA = (((DWORD)newGetProcAddress)-DWORD(k32base));
// Inicializar puntero de retorno a la original
pGetProcAddress = (GetProcAddress_t)rEDX;
// Parche
PatchEAT( savedeax, rvaMiGPA );// savedeax = eat entry para gpa
printf("newGetProcAddress 0x%X\n",newGetProcAddress);
// printf("GetProcAddress 0x%X\n",GetProcAddress);
system("pause");
}
//
void PatchEatSinInlineASM(){
DWORD k32base = (DWORD)GetModuleHandle("kernel32.dll");
DWORD exports = k32base+0x262C;
DWORD* dwEAT = (DWORD*)(exports+0x28);//953 entradas
printf("EAT 0x%X\n",dwEAT);
//for(int i=0;i<409-1;i++) dwEAT+=0x1;
//printf("GPA EAT 0x%X\n",dwEAT);
//printf("*GPA EAT 0x%X\n",*(dwEAT));
DWORD dwEATgpa = (DWORD)(dwEAT+0x198);
printf("GPA EAT 0x%X\n",(dwEAT+0x198));//0x199 = 409
printf("*GPA EAT 0x%X\n",*(dwEAT+0x198));
DWORD rvaGPA = dwEAT[409-1];//409 = gpa index
DWORD dwGPA = k32base+rvaGPA;
printf("rvaGPA 0x%X\n",rvaGPA);
printf("dwGPA 0x%X\n",dwGPA);
// printf("GetProcAddress 0x%X\n",GetProcAddress);
//system("pause");
/////////////////////////////////////////////////
// Calcular el rva de mi gpa
DWORD rvaMiGPA = (((DWORD)newGetProcAddress)-DWORD(k32base));
printf("dwEATgpa 0x%X\n",dwEATgpa);
printf("rvaMiGPA 0x%X\n",rvaMiGPA);
// Inicializar puntero de retorno a la original
pGetProcAddress = (GetProcAddress_t)dwGPA;
// Parche
PatchEAT( dwEATgpa, rvaMiGPA );
printf("newGetProcAddress 0x%X\n",newGetProcAddress);
// printf("GetProcAddress 0x%X\n",GetProcAddress);
system("pause");
}
//
int main(){
// 1
// PatchEatConInlineASM();
// 2
PatchEatSinInlineASM();
/////////////////////////////////////////////////
// Test
DWORD test = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
printf("test 0x%X\n",test);
printf("pGetProcAddress 0x%X\n",pGetProcAddress);// retorno a la original
system("pause");
return 0;
}
//
//
// By 85
// PatchEAT, PatchIAT (Googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
#include<windows.h>
#include<stdio.h>
//
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
FARPROC nResult;
nResult=pGetProcAddress(hModule, lpProcName);
if (HIWORD(lpProcName))
{
if (!lstrcmp(lpProcName, "GetProcAddress"))
{
return (FARPROC) &newGetProcAddress;
}
}
return nResult;
}
//
bool PatchEAT(HMODULE hTargetMod,CHAR* FuncName,VOID* newAdd,VOID** OrigAdd)
{
#define _sword sizeof(WORD) //AddressOfNameOrdinals
#define _sdword sizeof(DWORD)
DWORD addEAT,beforeProtection;
IMAGE_DOS_HEADER* dos_header=(IMAGE_DOS_HEADER*)hTargetMod;
IMAGE_NT_HEADERS* nt_header=NULL;
if(dos_header->e_magic!=IMAGE_DOS_SIGNATURE)
return false;
nt_header=((PIMAGE_NT_HEADERS)((DWORD)(dos_header)+(DWORD)(dos_header->e_lfanew)));
if(nt_header->Signature!=IMAGE_NT_SIGNATURE)
return false;
addEAT=nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
IMAGE_EXPORT_DIRECTORY* pEAT=(IMAGE_EXPORT_DIRECTORY*)((DWORD)addEAT+(DWORD)hTargetMod);
for(DWORD i=0;i<pEAT->NumberOfFunctions;i++){
DWORD* pName=(DWORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfNames+(_sdword*i)));
//printf("add nombre 0x%X\n",pName);
//system("pause");
if(strcmp((char*)((DWORD)hTargetMod+*pName),FuncName) == 0){
WORD* AddNamePtrs=(WORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfNameOrdinals+(i*_sword)));
DWORD* AddFuncRVA=(DWORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfFunctions+(_sdword**AddNamePtrs)));
//if(!strcmp((char*)((DWORD)hTargetMod+*pName),"GetProcAddress")){
//printf("AddNamePtrs 0x%X\n",AddNamePtrs);
// printf("Add de la func rva 0x%X\n",AddFuncRVA);
// printf("Add func 0x%X\n",*AddFuncRVA+DWORD(hTargetMod));
// system("pause");
//}
if(!VirtualProtect(AddFuncRVA,_sdword,PAGE_READWRITE,&beforeProtection))
return false;
*OrigAdd=(void*)(*AddFuncRVA+DWORD(hTargetMod));
*AddFuncRVA=(((DWORD)newAdd)-DWORD(hTargetMod));//copia el nuevo rva
if(!VirtualProtect(AddFuncRVA,_sdword,beforeProtection,&beforeProtection))
return false;
break;
}
}
return true;
}
//
BOOL PatchIAT(HMODULE ModHandle, DWORD OriginalFunc, DWORD HookFunc, void **pOriginalFunc)
{
DWORD pe_offset,CurAddr,CurPointer,IATanfang,IATende,base;
BOOL Hooked=FALSE;
IMAGE_NT_HEADERS *pehdr;
if(!ModHandle || !OriginalFunc || !HookFunc)
return FALSE;
base=(DWORD)ModHandle;
memcpy(&pe_offset,(void *)(base+0x3C),sizeof(DWORD));
pehdr=(IMAGE_NT_HEADERS *)((DWORD)base + pe_offset);
IATanfang=(DWORD)base+pehdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
IATende=IATanfang+pehdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size;
CurAddr=IATanfang;
while(CurAddr<IATende)
{
memcpy(&CurPointer,(void *)CurAddr,sizeof(DWORD));
if(CurPointer==OriginalFunc)
{
if(pOriginalFunc)
*pOriginalFunc=(PVOID)CurPointer;
DWORD old_attributes,old_attributes2;
if(!VirtualProtect((void *)CurAddr,sizeof(DWORD), PAGE_EXECUTE_READWRITE, &old_attributes))
return FALSE;
memcpy((void *)CurAddr,&HookFunc,sizeof(DWORD));
if(!VirtualProtect((void *)CurAddr,sizeof(DWORD), old_attributes, &old_attributes2))
return FALSE;
Hooked=TRUE;
}
CurAddr+=sizeof(DWORD);
}
return Hooked;
}
//
int main(){
/*DWORD test0a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD test0b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
//printf("GPA original: 0x%X\n",pGetProcAddress);
printf("GPA hook: 0x%X\n",newGetProcAddress);
printf("GPA es ahora (k32): 0x%X\n",test0a);
printf("GPA es ahora (EXE): 0x%X\n",test0b);
system("pause");*/
////////////////////////////////
HINSTANCE lib;
int Res=0;
int hookmode=0;
while( hookmode<1||hookmode>3){
system("cls");
printf("Bienvenido!\n");
printf("Ingrese 1 para realizar un EAT HOOK\n");
printf("Ingrese 2 para realizar un IAT HOOK\n");
scanf("%d",&hookmode);
}
if(hookmode == 1) __asm jmp eathook;
else if(hookmode == 2) __asm jmp iathook;
else if(hookmode == 3) __asm jmp salida;
/////////////////////////////////////////////////
// EAT HOOK
eathook:
Res = PatchEAT(GetModuleHandle("kernel32.dll"),"GetProcAddress",
((VOID*)(&newGetProcAddress)),((VOID**)(&pGetProcAddress)));
if(!Res){
printf("No se ha modificado la EAT objetivo!\n");
ExitProcess(0);
}
// Test 1
DWORD test1a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
printf("GPA original: 0x%X\n",pGetProcAddress);
printf("GPA hook: 0x%X\n",newGetProcAddress);
printf("GPA es ahora (k32): 0x%X\n",test1a);
printf("GPA es ahora (EXE): 0x%X\n",test1b);
system("pause");
lib = LoadLibrary("loaddll.dll");
FreeLibrary(lib);
return 0;
//
////////////////////////////////////////////////
// IAT HOOK
iathook:
Res = PatchIAT(GetModuleHandle(NULL),(DWORD)GetProcAddress,
(DWORD)newGetProcAddress,(void **)&pGetProcAddress);
if(!Res){
printf("No se ha modificado la IAT objetivo!\n");
ExitProcess(0);
}
// Test 2
DWORD test2a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
printf("GPA original: 0x%X\n",pGetProcAddress);
printf("GPA hook: 0x%X\n",newGetProcAddress);
printf("GPA es ahora (k32): 0x%X\n",test2a);
printf("GPA es ahora (EXE): 0x%X\n",test2b);
system("pause");
lib = LoadLibrary("loaddll.dll");
FreeLibrary(lib);
return 0;
//
/////////////////////////////////////////////////
//
salida:
return 0;
}
//
//
// By 85
// PatchEAT, PatchIAT (googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
#include<windows.h>
#include<stdio.h>
//////////////////////////
BOOL APIENTRY DllMain(
HANDLE hModule, // Handle to DLL module
DWORD ul_reason_for_call,
LPVOID lpReserved ) // Reserved
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH:
// A process is loading the DLL.
{
DWORD res1 = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD res2 = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
printf("GPA desde la dll mod=k32 0x%X\n", res1);
printf("GPA desde la dll mod=EXE 0x%X\n", res2);
system("pause");
}
break;
case DLL_THREAD_ATTACH:
// A process is creating a new thread.
break;
case DLL_THREAD_DETACH:
// A thread exits normally.
break;
case DLL_PROCESS_DETACH:
// A process unloads the DLL.
break;
}
return TRUE;
}
////////////////
//
// By 85
// elhacker.net
// etalking.com.ar
// 2013
//
#include<windows.h>
#include<stdio.h>
//
int main(){
HINSTANCE lib = LoadLibrary("loaddll2.dll");
FreeLibrary(lib);
printf("GPA original desde el EXE: 0x%X\n", GetProcAddress);
system("pause");
return 0;
}
//
//
// By 85
// PatchEAT, PatchIAT (googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
#include<windows.h>
#include<stdio.h>
/////////////////////
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
FARPROC nResult;
// nResult=pGetProcAddress(hModule, lpProcName);
nResult=GetProcAddress(hModule, lpProcName);
if (HIWORD(lpProcName))
{
if (!lstrcmp(lpProcName, "GetProcAddress"))
{
return (FARPROC) &newGetProcAddress;
}
}
return nResult;
}
//
bool PatchEAT(HMODULE hTargetMod,CHAR* FuncName,VOID* newAdd,VOID** OrigAdd)
{
// misma que el anterior programa
...
}
//
BOOL PatchIAT(HMODULE ModHandle, DWORD OriginalFunc, DWORD HookFunc, void **pOriginalFunc)
{
// misma que el anterior programa
...
}
//
//////////////////////////
BOOL APIENTRY DllMain(
HANDLE hModule, // Handle to DLL module
DWORD ul_reason_for_call,
LPVOID lpReserved ) // Reserved
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH:
// A process is loading the DLL.
{
int Res=0;
//
//////////////////////////
// EAT HOOK
/* Res = PatchEAT(GetModuleHandle("kernel32.dll"),"GetProcAddress",
((VOID*)(&newGetProcAddress)),((VOID**)(&pGetProcAddress)));
if(!Res){
printf("No se ha modificado la EAT objetivo!\n");
ExitProcess(0);
}
// Test 1
DWORD test1a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
//DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle("loaddll2.dll"),"GetProcAddress");//NO
printf("DLL: GPA original: 0x%X\n",pGetProcAddress);
printf("DLL: GPA original: 0x%X\n",GetProcAddress);
printf("DLL: GPA hook: 0x%X\n",newGetProcAddress);
printf("DLL: GPA es ahora (k32): 0x%X\n",test1a);
printf("DLL: GPA es ahora (EXE): 0x%X\n",test1b);
system("pause");*/
/////////////////////////
// IAT HOOK
Res = PatchIAT(GetModuleHandle(NULL),(DWORD)GetProcAddress,
(DWORD)newGetProcAddress,(void **)&pGetProcAddress);
if(!Res){
printf("No se ha modificado la IAT objetivo!\n");
ExitProcess(0);
}
// Test 2
DWORD test2a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
//DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle("loaddll2.dll"),"GetProcAddress");//NO
printf("DLL: GPA original: 0x%X\n",pGetProcAddress);
printf("DLL: GPA original: 0x%X\n",GetProcAddress);
printf("DLL: GPA hook: 0x%X\n",newGetProcAddress);
printf("DLL: GPA es ahora (k32): 0x%X\n",test2a);
printf("DLL: GPA es ahora (EXE): 0x%X\n",test2b);
system("pause");
}
break;
case DLL_THREAD_ATTACH:
// A process is creating a new thread.
break;
case DLL_THREAD_DETACH:
// A thread exits normally.
break;
case DLL_PROCESS_DETACH:
// A process unloads the DLL.
break;
}
return TRUE;
}
////////////////
/* __asm {
mov ebx, dwGPA
mov edx, [ebx]
mov pGetProcAddress, edx
}*/
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
pGetProcAddress = *(GetProcAddress_t*)dwGPA;