-
-
Notifications
You must be signed in to change notification settings - Fork 198
/
Copy pathreshdr.asm
142 lines (115 loc) · 3.22 KB
/
reshdr.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
; a PE with a resource in the header, and shuffled resource structure
; Ange Albertini, BSD LICENCE 2009-2013
%include 'consts.inc'
IMAGEBASE equ 400000h
SOME_TYPE equ 315h
org IMAGEBASE
bits 32
SECTIONALIGN equ 1000h
FILEALIGN equ 200h
istruc IMAGE_DOS_HEADER
at IMAGE_DOS_HEADER.e_magic, db 'MZ'
at IMAGE_DOS_HEADER.e_lfanew, dd NT_Headers - IMAGEBASE
iend
resource_data:
Msg db " * resource stored in header and shuffled resource structure", 0ah, 0
RESOURCE_SIZE equ $ - resource_data
align 4, db 0
%include "nthd_std.inc"
istruc IMAGE_DATA_DIRECTORY_16
at IMAGE_DATA_DIRECTORY_16.ImportsVA, dd Import_Descriptor - IMAGEBASE
at IMAGE_DATA_DIRECTORY_16.ResourceVA, dd Directory_Entry_Resource - IMAGEBASE
iend
%include 'section_1fa.inc'
;*******************************************************************************
EntryPoint:
push SOME_TYPE ; lpType
push ares ; lpName
push 0 ; hModule
call [__imp__FindResourceA]
_
push eax
push 0 ; hModule
call [__imp__LoadResource]
_
push eax
call [__imp__printf]
add esp, 1 * 4
_
push 0
call [__imp__ExitProcess]
_c
Import_Descriptor: ;************************************************************
_import_descriptor kernel32.dll
_import_descriptor msvcrt.dll
istruc IMAGE_IMPORT_DESCRIPTOR
iend
_d
kernel32.dll_hintnames:
dd hnExitProcess - IMAGEBASE
dd hnFindResourceA - IMAGEBASE
dd hnLoadResource - IMAGEBASE
dd 0
msvcrt.dll_hintnames:
dd hnprintf - IMAGEBASE
dd 0
_d
hnExitProcess:
dw 0
db 'ExitProcess', 0
hnFindResourceA:
dw 0
db 'FindResourceA', 0
hnLoadResource:
dw 0
db 'LoadResource', 0
hnprintf:
dw 0
db 'printf', 0
_d
kernel32.dll_iat:
__imp__ExitProcess:
dd hnExitProcess - IMAGEBASE
__imp__FindResourceA:
dd hnFindResourceA - IMAGEBASE
__imp__LoadResource:
dd hnLoadResource - IMAGEBASE
dd 0
msvcrt.dll_iat:
__imp__printf:
dd hnprintf - IMAGEBASE
dd 0
_d
kernel32.dll db 'kernel32.dll', 0
msvcrt.dll db 'msvcrt.dll', 0
_d
ares db "#101", 0
_d
resource_directory: ;***********************************************************
; root directory
Directory_Entry_Resource:
istruc IMAGE_RESOURCE_DIRECTORY
at IMAGE_RESOURCE_DIRECTORY.NumberOfIdEntries, dw 1
iend
_resourceDirectoryEntry SOME_TYPE, resource_directory_type_rcdata
resource_data_entry_101:
istruc IMAGE_RESOURCE_DATA_ENTRY
at IMAGE_RESOURCE_DATA_ENTRY.OffsetToData, dd resource_data - IMAGEBASE
at IMAGE_RESOURCE_DATA_ENTRY.Size1, dd RESOURCE_SIZE
iend
; resource subdirectory
resource_directory_languages0:
istruc IMAGE_RESOURCE_DIRECTORY
at IMAGE_RESOURCE_DIRECTORY.NumberOfIdEntries, dw 1
iend
istruc IMAGE_RESOURCE_DIRECTORY_ENTRY
at IMAGE_RESOURCE_DIRECTORY_ENTRY.OffsetToData, dd resource_data_entry_101 - Directory_Entry_Resource
iend
; type subdirectory
resource_directory_type_rcdata:
istruc IMAGE_RESOURCE_DIRECTORY
at IMAGE_RESOURCE_DIRECTORY.NumberOfIdEntries, dw 1
iend
_resourceDirectoryEntry 101, resource_directory_languages0
_d
align FILEALIGN, db 0