Skip to content

Commit 171986b

Browse files
UserExistsErrorUserExistsError
committed
added source
1 parent 8b9ab0f commit 171986b

19 files changed

+1833
-0
lines changed

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,3 +328,6 @@ ASALocalRun/
328328

329329
# MFractors (Xamarin productivity tool) working folder
330330
.mfractor/
331+
332+
# shellcode
333+
*.bin

‎Extract/Extract.cpp

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#include <Windows.h>
2+
#include <stdio.h>
3+
4+
5+
BOOL ReadFileData(WCHAR *filename, BYTE **buff, DWORD *size);
6+
7+
const IMAGE_NT_HEADERS * GetNtHeader(const BYTE *image, const DWORD imageSize)
8+
{
9+
const IMAGE_DOS_HEADER *dosHeader = (IMAGE_DOS_HEADER*)image;
10+
if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
11+
wprintf(L"Invalid DOS header\n");
12+
return NULL;
13+
}
14+
const IMAGE_NT_HEADERS *ntHeader = (IMAGE_NT_HEADERS*)((ULONG_PTR)image + dosHeader->e_lfanew);
15+
if ((BYTE*)ntHeader < image) {
16+
wprintf(L"Invalid NT header\n");
17+
return NULL;
18+
}
19+
if ((BYTE*)ntHeader > (image + imageSize - sizeof(IMAGE_NT_HEADERS))) {
20+
wprintf(L"Invalid NT header\n");
21+
return NULL;
22+
}
23+
if (ntHeader->Signature != IMAGE_NT_SIGNATURE) {
24+
wprintf(L"Invalid NT header\n");
25+
return NULL;
26+
}
27+
return ntHeader;
28+
}
29+
30+
int wmain(int argc, WCHAR *argv[])
31+
{
32+
if (argc < 3) {
33+
wprintf(L"usage: Extract.exe <PEFILE> <SHELLCODE>\n");
34+
return 1;
35+
}
36+
37+
DWORD imageSize = 0;
38+
BYTE *image = NULL;
39+
if (!ReadFileData(argv[1], &image, &imageSize)) {
40+
wprintf(L"Failed to read file: %s\n", argv[1]);
41+
return 1;
42+
}
43+
44+
// get .text section
45+
const IMAGE_NT_HEADERS *ntHeader = GetNtHeader(image, imageSize);
46+
if (ntHeader == NULL)
47+
return 1;
48+
49+
IMAGE_SECTION_HEADER *section = IMAGE_FIRST_SECTION(ntHeader);
50+
IMAGE_SECTION_HEADER *codeSection = NULL;
51+
for (size_t i = 0; i < ntHeader->FileHeader.NumberOfSections; i++, section++) {
52+
if ((BYTE*)section > (image + imageSize - sizeof(IMAGE_SECTION_HEADER))) {
53+
wprintf(L"Invalid section header\n");
54+
return 1;
55+
}
56+
if (memcmp(".text\x00", section->Name, 6) == 0) {
57+
codeSection = section;
58+
break;
59+
}
60+
}
61+
if (codeSection == NULL) {
62+
wprintf(L"Failed to find code section\n");
63+
return 1;
64+
}
65+
66+
// write .text section to file
67+
const BYTE *text = image + codeSection->PointerToRawData;
68+
if (text < image) {
69+
wprintf(L"Invalid .text section\n");
70+
return 1;
71+
}
72+
if ((text + codeSection->Misc.VirtualSize < text) || (text + codeSection->Misc.VirtualSize) > (image + imageSize)) {
73+
wprintf(L"Invalid .text section\n");
74+
return 1;
75+
}
76+
HANDLE hFile = CreateFileW(argv[2], GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
77+
if (hFile == INVALID_HANDLE_VALUE) {
78+
wprintf(L"Failed to open file: %s\n", argv[2]);
79+
return 1;
80+
}
81+
DWORD numWritten = 0;
82+
DWORD numLeft = codeSection->Misc.VirtualSize;
83+
BYTE *textPtr = (BYTE*)text;
84+
while (numLeft > 0) {
85+
if (!WriteFile(hFile, textPtr, numLeft, &numWritten, NULL)) {
86+
wprintf(L"Failed to write to file: %s\n", argv[2]);
87+
return 1;
88+
}
89+
numLeft -= numWritten;
90+
textPtr += numWritten;
91+
}
92+
wprintf(L"Wrote %lu bytes to %s\n", codeSection->Misc.VirtualSize, argv[2]);
93+
return 0;
94+
}
95+

‎Extract/Extract.vcxproj

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>15.0</VCProjectVersion>
23+
<ProjectGuid>{5FAFD59C-F4C9-4769-B5B0-588081871DF9}</ProjectGuid>
24+
<Keyword>Win32Proj</Keyword>
25+
<RootNamespace>Extract</RootNamespace>
26+
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v141</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v141</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v141</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v141</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
<OutDir>$(SolutionDir)$(PlatformTarget)\$(Configuration)\</OutDir>
76+
<IntDir>$(PlatformTarget)\$(Configuration)\</IntDir>
77+
</PropertyGroup>
78+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
79+
<LinkIncremental>true</LinkIncremental>
80+
<OutDir>$(SolutionDir)$(PlatformTarget)\$(Configuration)\</OutDir>
81+
<IntDir>$(PlatformTarget)\$(Configuration)\</IntDir>
82+
</PropertyGroup>
83+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
84+
<LinkIncremental>false</LinkIncremental>
85+
<OutDir>$(SolutionDir)$(PlatformTarget)\$(Configuration)\</OutDir>
86+
<IntDir>$(PlatformTarget)\$(Configuration)\</IntDir>
87+
</PropertyGroup>
88+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
89+
<LinkIncremental>false</LinkIncremental>
90+
<OutDir>$(SolutionDir)$(PlatformTarget)\$(Configuration)\</OutDir>
91+
<IntDir>$(PlatformTarget)\$(Configuration)\</IntDir>
92+
</PropertyGroup>
93+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
94+
<ClCompile>
95+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
96+
<WarningLevel>Level3</WarningLevel>
97+
<Optimization>Disabled</Optimization>
98+
<SDLCheck>true</SDLCheck>
99+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
100+
<ConformanceMode>false</ConformanceMode>
101+
</ClCompile>
102+
<Link>
103+
<SubSystem>Console</SubSystem>
104+
<GenerateDebugInformation>true</GenerateDebugInformation>
105+
</Link>
106+
</ItemDefinitionGroup>
107+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
108+
<ClCompile>
109+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
110+
<WarningLevel>Level3</WarningLevel>
111+
<Optimization>Disabled</Optimization>
112+
<SDLCheck>true</SDLCheck>
113+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
114+
<ConformanceMode>false</ConformanceMode>
115+
</ClCompile>
116+
<Link>
117+
<SubSystem>Console</SubSystem>
118+
<GenerateDebugInformation>true</GenerateDebugInformation>
119+
</Link>
120+
</ItemDefinitionGroup>
121+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
122+
<ClCompile>
123+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
124+
<WarningLevel>Level3</WarningLevel>
125+
<Optimization>MaxSpeed</Optimization>
126+
<FunctionLevelLinking>true</FunctionLevelLinking>
127+
<IntrinsicFunctions>true</IntrinsicFunctions>
128+
<SDLCheck>true</SDLCheck>
129+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
130+
<ConformanceMode>false</ConformanceMode>
131+
</ClCompile>
132+
<Link>
133+
<SubSystem>Console</SubSystem>
134+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
135+
<OptimizeReferences>true</OptimizeReferences>
136+
<GenerateDebugInformation>true</GenerateDebugInformation>
137+
</Link>
138+
</ItemDefinitionGroup>
139+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
140+
<ClCompile>
141+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
142+
<WarningLevel>Level3</WarningLevel>
143+
<Optimization>MaxSpeed</Optimization>
144+
<FunctionLevelLinking>true</FunctionLevelLinking>
145+
<IntrinsicFunctions>true</IntrinsicFunctions>
146+
<SDLCheck>true</SDLCheck>
147+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
148+
<ConformanceMode>false</ConformanceMode>
149+
</ClCompile>
150+
<Link>
151+
<SubSystem>Console</SubSystem>
152+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
153+
<OptimizeReferences>true</OptimizeReferences>
154+
<GenerateDebugInformation>true</GenerateDebugInformation>
155+
</Link>
156+
</ItemDefinitionGroup>
157+
<ItemGroup>
158+
<ClCompile Include="Extract.cpp" />
159+
<ClCompile Include="readfile.cpp" />
160+
</ItemGroup>
161+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
162+
<ImportGroup Label="ExtensionTargets">
163+
</ImportGroup>
164+
</Project>

‎Extract/Extract.vcxproj.filters

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="Extract.cpp">
19+
<Filter>Source Files</Filter>
20+
</ClCompile>
21+
<ClCompile Include="readfile.cpp">
22+
<Filter>Source Files</Filter>
23+
</ClCompile>
24+
</ItemGroup>
25+
</Project>

‎Extract/readfile.cpp

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#define WIN32_LEAN_AND_MEAN
2+
#include <Windows.h>
3+
4+
BOOL ReadFileData(WCHAR *filename, BYTE **buff, DWORD *size)
5+
{
6+
if (filename == NULL || buff == NULL || size == NULL)
7+
return FALSE;
8+
9+
HANDLE hFile = CreateFileW(filename, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
10+
if (hFile == INVALID_HANDLE_VALUE)
11+
return FALSE;
12+
13+
// get size of file
14+
LARGE_INTEGER liSize;
15+
if (!GetFileSizeEx(hFile, &liSize)) {
16+
CloseHandle(hFile);
17+
return FALSE;
18+
}
19+
if (liSize.HighPart > 0) {
20+
CloseHandle(hFile);
21+
return FALSE;
22+
}
23+
24+
// read entire file into memory
25+
*buff = (BYTE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, liSize.LowPart);
26+
if (*buff == NULL) {
27+
CloseHandle(hFile);
28+
return FALSE;
29+
}
30+
BYTE *buffPtr = *buff;
31+
DWORD numLeft = liSize.LowPart;
32+
DWORD numRead = 0;
33+
while (numLeft > 0) {
34+
if (!ReadFile(hFile, buffPtr, numLeft, &numRead, NULL)) {
35+
CloseHandle(hFile);
36+
HeapFree(GetProcessHeap(), 0, *buff);
37+
return FALSE;
38+
}
39+
numLeft -= numRead;
40+
buffPtr += numRead;
41+
}
42+
*size = liSize.LowPart;
43+
CloseHandle(hFile);
44+
return TRUE;
45+
}

0 commit comments

Comments
 (0)