mmLoader-shellcode-generator.c

// mmLoader-shellcode-generator.cpp : Defines the entry point for the console
// application.
//
//

#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <Strsafe.h>
#include <shlwapi.h>

#include <mmLoader.h>

#pragma comment(linker, "/NODEFAULTLIB")
#pragma comment(linker, "/ENTRY:CodeBag")

LPSTR head = "/************************************************************************/"
             "\r\n"
             "/* \r\n"
#ifdef _WIN64
             " * This file is generated by mmLoaderShellCode Generator (x64)\r\n"
             " * Target platform: 64 bit windows application\r\n"
#else
             " * This file is generated by mmLoaderShellCode Generator (x86)\r\n"
             " * Target platform: 32 bit windows application\r\n"
#endif
             " *\r\n"
             " * https://github.com/tishion \r\n"
             " *\r\n"
             "/************************************************************************/"
             "\r\n"
             "#ifndef __MMLOADERSHELLCODE_H_INCLUDED_\n"
             "#define __MMLOADERSHELLCODE_H_INCLUDED_\n"
             "#pragma once\n"
             "#include <windows.h>\n"
             "\n"
             "#ifdef __cplusplus\n"
             "extern \"C\" {\n"
             "#endif\n"
             "\n"
             "/// <summary>\n"
             "/// Error codes.\n"
             "/// </summary>\n"
             "#define MMEC_OK 0\n"
             "#define MMEC_BAD_PE_FORMAT 1\n"
             "#define MMEC_ALLOCATED_MEMORY_FAILED 2\n"
             "#define MMEC_INVALID_RELOCATION_BASE 3\n"
             "#define MMEC_IMPORT_MODULE_FAILED 4\n"
             "#define MMEC_PROTECT_SECTION_FAILED 5\n"
             "#define MMEC_INVALID_ENTRY_POINT 6\n"
             "#define MMEC_INVALID_WIN32_ENV 0xff\n"
             "\n"
             "/// <summary>\n"
             "/// Enums for MemModuleHelper.\n"
             "/// </summary>\n"
             "typedef enum _MMHELPER_METHOD {\n"
             "  MHM_BOOL_LOAD,       // Call LoadMemModule\n"
             "  MHM_VOID_FREE,       // Call FreeMemModule\n"
             "  MHM_FARPROC_GETPROC, // Call GetMemModuleProc\n"
             "} MMHELPER_METHOD;\n"
             "\n"
             "typedef void **HMEMMODULE;\n"
             "\n"
             "/// <summary>\n"
             "/// Helper function for using shell code.\n"
             "/// </summary>\n"
             "typedef LPVOID(*Type_MemModuleHelper)(MMHELPER_METHOD, LPVOID, LPVOID, LPVOID);\n"
             "\n"
             "/// <summary>\n"
             "/// Helper function for using shell code.\n"
             "/// </summary>\n"
             "/// <remarks>\n"
             "/// If the method == MHM_BOOL_LOAD, then the function performs the LoadMemModule function.\n"
             "/// If the method == MHM_VOID_FREE, then the function performs the FreeMemModule function.\n"
             "/// If the method == MHM_FARPROC_GETPROC, then the function performs the GetMemModuleProc function.\n"
             "/// </remarks>\n"
             "LPVOID\n"
             "MemModuleHelper(_In_ MMHELPER_METHOD method, _In_ LPVOID lpArg1, _In_ LPVOID lpArg2, _In_ "
             "LPVOID lpArg3);\n"
             "\n"
             "/// <summary>\n"
             "/// Loads the memory module.\n"
             "/// </summary>\n"
             "/// <param name=\"lpPeModuleBuffer\">The buffer containing the raw data of the module.</param>\n"
             "/// <param name=\"bCallEntry\">Call the module entry if true.</param>\n"
             "/// <param name=\"pdwError\">The error code.</param>\n"
             "/// <returns>The handle to the memory module instance or NULL.</returns>\n"
             "HMEMMODULE\n"
             "LoadMemModule(_In_ LPVOID lpPeModuleBuffer, _In_ BOOL bCallEntry, _Inout_ DWORD *pdwError);\n"
             "\n"
             "/// <summary>\n"
             "/// Gets the process address of the specific function in the memory module.\n"
             "/// </summary>\n"
             "/// <param name=\"MemModuleHandle\">The handle to the memory module instance.</param>\n"
             "/// <param name=\"lpName\">The function name.</param>\n"
             "/// <returns>The address of the function or null.</returns>\n"
             "FARPROC\n"
             "GetMemModuleProc(_In_ HMEMMODULE MemModuleHandle, _In_ LPCSTR lpName);\n"
             "\n"
             "/// <summary>\n"
             "/// Frees the memory module.HMEMMODULE\n"
             "/// </summary>\n"
             "/// <param name=\"MemModuleHandle\">The handle to the memory module instance.</param>\n"
             "VOID FreeMemModule(_In_ HMEMMODULE MemModuleHandle);\n"
             "\n"
             "\r\n"
             "/// <summary>\r\n"
             "/// The byte array of the mmLoader shell code.\r\n"
             "/// </summary>\r\n"
             "unsigned char mmLoaderShellCode[] = {\r\n";

LPSTR tail = "\r\n};\r\n"
             "\r\n"
             "#ifdef __cplusplus\n"
             "}\n"
             "#endif\n"
             "#endif // __MMLOADERSHELLCODE_H_INCLUDED_";

/// <summary>
///
/// </summary>
void
InitializeConsole() {
  // Create a console
  if (!AllocConsole())
    MessageBox(NULL, _T("Failed to allocate console."), _T("Warning"), MB_OK);
}

/// <summary>
///
/// </summary>
/// <param name="message"></param>
void
ConsoleWrite(LPCSTR message) {
  if (!message)
    return;

  DWORD bytesWritten = 0;
  HANDLE h = GetStdHandle(STD_OUTPUT_HANDLE);
  if (!h || !WriteConsoleA(h, message, lstrlenA(message), &bytesWritten, NULL))
    MessageBoxA(NULL, message, "Warning", MB_OK);
}

///
/// </summary>
/// <param name="message"></param>
void
ConsoleWriteW(LPCWSTR message) {
  if (!message)
    return;

  DWORD bytesWritten = 0;
  HANDLE h = GetStdHandle(STD_OUTPUT_HANDLE);
  if (!h || !WriteConsoleW(h, message, lstrlenW(message), &bytesWritten, NULL))
    MessageBoxW(NULL, message, L"Warning", MB_OK);
}

#ifdef _WIN64
#ifdef _DEBUG
#define SHELLCODE_HEADER_FILE_NAME L"mmLoaderShellCode-x64-Debug.h"
#else
#define SHELLCODE_HEADER_FILE_NAME L"mmLoaderShellCode-x64-Release.h"
#endif
#else
#ifdef _DEBUG
#define SHELLCODE_HEADER_FILE_NAME L"mmLoaderShellCode-x86-Debug.h"
#else
#define SHELLCODE_HEADER_FILE_NAME L"mmLoaderShellCode-x86-Release.h"
#endif
#endif

/// <summary>
///
/// </summary>
#define mml_ZeroMemory(p, len)                                                                                         \
  for (int i = 0; i < len; i++)                                                                                        \
  *(unsigned char *)p = 0

/// <summary>
///
/// </summary>
#define mml_hextoascii(hex)

/// <summary>
/// Frees the memory module.
/// </summary>
extern void
mmLoaderCodeEnd();

/// <summary>
/// main function.
/// </summary>
/// <returns></returns>
int
CodeBag() {
  // Initialize the console
  InitializeConsole();

  LPCWSTR pFolderPath = SHELLCODE_HEADER_FILE_NAME;
  WCHAR pathBuffer[MAX_PATH];
  for (int i = 0; i < MAX_PATH; i++)
    pathBuffer[i] = 0;

  // Get command line
  LPCWSTR pCmd = GetCommandLineW();

  // Parse command line
  int nCount = 0;
  LPWSTR *pArgs = NULL;
  if (pCmd)
    pArgs = CommandLineToArgvW(pCmd, &nCount);
  if (nCount >= 2) {
    if (GetFullPathNameW(pArgs[1], MAX_PATH, pathBuffer, NULL) <= 0) {
      ConsoleWrite("Failed to get the full path of the folder: ");
      ConsoleWriteW(pArgs[2]);
      ConsoleWrite("\r\n");
      return -1;
    }

    if (!PathFileExistsW(pathBuffer)) {
      ConsoleWrite("Path does not exist: ");
      ConsoleWriteW(pathBuffer);
      ConsoleWrite("\r\n");
      return -1;
    }

    if (PathCombineW(pathBuffer, pathBuffer, SHELLCODE_HEADER_FILE_NAME) <= 0) {
      ConsoleWrite("Failed to build file path.\r\n");
      return -1;
    }

    pFolderPath = pathBuffer;
  }

  // Get code start and end address
  unsigned char *pStart = (unsigned char *)&MemModuleHelper;
  unsigned char *pEnd = (unsigned char *)&mmLoaderCodeEnd;

  // Get code length
  ULONGLONG codeLength = (pEnd - pStart);

  // Get the buffer length
  size_t textLength = 512 * 1024;

  // Allocate the heap buffer for the file content
  ConsoleWrite("Allocating buffer..\r\n");
  LPSTR pBuffer = (LPSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, textLength);
  if (!pBuffer) {
    ConsoleWrite("Failed to allocate memory buffer.\r\n");
    return -1;
  }

  // Start to build the file content
  ConsoleWrite("Building the file content..\r\n");
  StringCchCatA(pBuffer, textLength, head);
  unsigned char charTable[] = {"0123456789ABCDEF"};
  unsigned char buf[3] = {0, 0, 0};
  int n = 0;
  for (unsigned char *p = pStart; p < pEnd; p++) {
    // Start one row
    if (0 == n++)
      StringCchCatA(pBuffer, textLength, "\t");

    {
      // Hex to string
      StringCchCatA(pBuffer, textLength, "0x");
      buf[0] = charTable[*p >> 4];
      buf[1] = charTable[*p & 0x0f];
      StringCchCatA(pBuffer, textLength, (char *)buf);
      StringCchCatA(pBuffer, textLength, ", ");
    }
    // End one row
    if (n == 16) {
      StringCchCatA(pBuffer, textLength, "\r\n");
      n = 0;
    }
  }
  StringCchCatA(pBuffer, textLength, tail);

  ConsoleWrite("File content build done:\r\n\r\n");
  ConsoleWrite(pBuffer);

  // Get the valid string length
  StringCchLengthA(pBuffer, textLength, &textLength);

  ConsoleWrite("Create file mmLoaderShellCode.h\r\n");
  // Create file to save the content
  HANDLE h = CreateFileW(pFolderPath, FILE_WRITE_ACCESS, FILE_SHARE_READ, NULL, CREATE_ALWAYS, 0, NULL);
  DWORD dwBytesWritten = 0;
  if (INVALID_HANDLE_VALUE == h || NULL == h) {
    ConsoleWrite("Failed to create file \"mmLoaderShellCode\".\r\n");
    return -1;
  } else {
    // Write the string content to the disk file
    if (!WriteFile(h, pBuffer, (DWORD)textLength, &dwBytesWritten, NULL)) {
      ConsoleWrite("Failed to write content to file \"mmLoaderShellCode\".\r\n");
      return -1;
    }

    FlushFileBuffers(h);
    CloseHandle(h);
  }

  // Free the content buffer
  HeapFree(GetProcessHeap(), 0, pBuffer);

  // Wait for the return key
  ConsoleWrite("\r\nShell code generated done.\r\n");
  //::WaitForSingleObject(::GetCurrentProcess(), INFINITE);

  ExitProcess(0);
}