Zer0Flag Posted September 15, 2010 Posted September 15, 2010 (edited) Hello, I made a little loader for a reverseME from Lena151. In this case a Patch would be better but I made this for my own practice and I hope someone can use this souce to learn In the attachement you can finde the loader.exe and the reverseMe. #include <Windows.h>#define WIN32_LEAN_AND_MEAN#define VC_EXTRALEANint WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {/*CPU DisasmAddress Hex dump Command Comments0040107B EB 1D JMP SHORT reverseMe.0040109A0040107D . 6A 00 PUSH 0 ; Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL0040107F . 68 00204000 PUSH OFFSET reverseMe.00402000 ; Caption = " Key File ReverseMe"00401084 . 68 17204000 PUSH OFFSET reverseMe.00402017 ; Text = "Evaluation period out of date. Purchase new license"00401089 . 6A 00 PUSH 0 ; hOwner = NULL0040108B . E8 D7020000 CALL <JMP.&USER32.MessageBoxA> ; Jump to USER32.MessageBoxA00401090 . E8 24020000 CALL <JMP.&KERNEL32.ExitProcess> ; KERNEL32.ExitProcess00401095 . E9 83010000 JMP reverseMe.0040121D0040109A > 6A 00 PUSH 0 ; pOverlapped = NULL0040109C . 68 73214000 PUSH OFFSET reverseMe.00402173 ; pBytesRead = reverseMe.402173 -> 0004010A1 . 6A 46 PUSH 46 ; Size = 70.004010A3 . 68 1A214000 PUSH OFFSET reverseMe.0040211A ; Buffer = reverseMe.40211A -> 00004010A8 . 50 PUSH EAX ; hFile004010A9 . E8 2F020000 CALL <JMP.&KERNEL32.ReadFile> ; KERNEL32.ReadFile004010AE . 85C0 TEST EAX,EAX004010B0 EB 02 JMP SHORT reverseMe.004010B4004010B2 . EB 43 JMP SHORT reverseMe.004010F7004010B4 > 33DB XOR EBX,EBX004010B6 . 33F6 XOR ESI,ESI004010B8 . 833D 73214000 1 CMP DWORD PTR DS:[reverseMe.402173],10004010BF 90 NOP004010C0 90 NOP004010C1 > 8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+reverseMe.40211A004010C7 . 3C 00 CMP AL,0004010C9 EB 08 JMP SHORT reverseMe.004010D3004010CB . 3C 47 CMP AL,47004010CD . 75 01 JNE SHORT reverseMe.004010D0004010CF . 46 INC ESI004010D0 > 43 INC EBX004010D1 . EB EE JMP SHORT reverseMe.004010C1004010D3 > 83FE 08 CMP ESI,8004010D6 90 NOP004010D7 90 NOP*/ CONTEXT* tCONTEXT = 0; STARTUPINFO* tSTARTUPINFO = 0; PROCESS_INFORMATION* tPROCESS_INFORMATION = 0; DWORD Patch1 = 0x40107B; DWORD Patch2 = 0x4010B0; DWORD Patch3 = 0x4010BF; DWORD Patch4 = 0x4010C9; DWORD Patch5 = 0x4010D6; UCHAR PatchVal1[] = "\xEB\x1D"; UCHAR PatchVal2[] = "\xEB\x02"; UCHAR PatchVal3[] = "\x90\x90"; UCHAR PatchVal4[] = "\xEB\x08"; UCHAR PatchVal5[] = "\x90\x90"; char* cCommandLine = GetCommandLine(); tCONTEXT = (CONTEXT*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(CONTEXT)); tSTARTUPINFO = (STARTUPINFO*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(STARTUPINFO)); tPROCESS_INFORMATION = (PROCESS_INFORMATION*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(PROCESS_INFORMATION)); tCONTEXT->ContextFlags = CONTEXT_FULL; tSTARTUPINFO->cb = sizeof(STARTUPINFO); if(CreateProcessA("reverseMe.exe", cCommandLine, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, tSTARTUPINFO, tPROCESS_INFORMATION)){ WriteProcessMemory(tPROCESS_INFORMATION->hProcess, (LPVOID)Patch1, &PatchVal1, sizeof(PatchVal1)-1, NULL); WriteProcessMemory(tPROCESS_INFORMATION->hProcess, (LPVOID)Patch2, &PatchVal2, sizeof(PatchVal2)-1, NULL); WriteProcessMemory(tPROCESS_INFORMATION->hProcess, (LPVOID)Patch3, &PatchVal3, sizeof(PatchVal3)-1, NULL); WriteProcessMemory(tPROCESS_INFORMATION->hProcess, (LPVOID)Patch4, &PatchVal4, sizeof(PatchVal4)-1, NULL); WriteProcessMemory(tPROCESS_INFORMATION->hProcess, (LPVOID)Patch5, &PatchVal5, sizeof(PatchVal5)-1, NULL); ResumeThread(tPROCESS_INFORMATION->hThread); } return 0;} ~Zer0Flag Loader_Example.rar Edited September 15, 2010 by Zer0Flag
dexter4life Posted September 21, 2010 Posted September 21, 2010 Please, I am a newbie in the C++ language.1. What is constructor?2. What is "Initializing a constructor all about". Thanks a lot.
Killboy Posted September 21, 2010 Posted September 21, 2010 (edited) a) technically this isn't C++ but C you might want to refrain from posting unrelated questions in random topics c) this isn't really a coding board. RE-related coding questions are fine, but please don't ask anything as general as 'what is a constructor'. try a C++ community (there are hundreds) or ask google, you're faster off that way Edited September 21, 2010 by Killboy
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now