Making some things more annoying to notice.
This commit is contained in:
parent
4ae3e64c15
commit
8dc55c6639
|
@ -492,21 +492,28 @@ static unsigned char getname_encoded[] = { 0xc8, 0x33, 0x3f, 0xdc, 0xdd, 0x21, 0
|
||||||
static unsigned char exit_encoded[] = { 0xca, 0xd2, 0xd5, 0xd9, 0x29, 0x27, 0x26, 0xdb, 0x20, 0x2d, 0x20, 0x00 };
|
static unsigned char exit_encoded[] = { 0xca, 0xd2, 0xd5, 0xd9, 0x29, 0x27, 0x26, 0xdb, 0x20, 0x2d, 0x20, 0x00 };
|
||||||
|
|
||||||
static lpExitProcess protectHelp[2] = { (lpExitProcess)srandWrap, (lpExitProcess)0 };
|
static lpExitProcess protectHelp[2] = { (lpExitProcess)srandWrap, (lpExitProcess)0 };
|
||||||
|
|
||||||
|
typedef HMODULE (WINAPI* lpLoadLibrary)(LPCTSTR);
|
||||||
|
typedef FARPROC (WINAPI* lpGetProcAddress)(HMODULE, LPCSTR);
|
||||||
|
|
||||||
|
SET_FN_PTR(LoadLibrary, 0x01301100);
|
||||||
|
SET_FN_PTR(GetProcAddress, 0x01301100);
|
||||||
|
|
||||||
int VBA::doProtection()
|
int VBA::doProtection()
|
||||||
{
|
{
|
||||||
char szEXEFileName[260];
|
char szEXEFileName[260];
|
||||||
*szEXEFileName = 0;
|
*szEXEFileName = 0;
|
||||||
|
|
||||||
HMODULE hM_kernel32 = LoadLibrary(unprotect_buffer(kernel_encoded, sizeof(kernel_encoded)));
|
HMODULE hM_kernel32 = ((lpLoadLibrary)GET_FN_PTR(LoadLibrary))(unprotect_buffer(kernel_encoded, sizeof(kernel_encoded)));
|
||||||
if (hM_kernel32)
|
if (hM_kernel32)
|
||||||
{
|
{
|
||||||
pGetModuleFileNameA = (lpGetModuleFileNameA)GetProcAddress(hM_kernel32, unprotect_buffer(getname_encoded, sizeof(getname_encoded)));
|
pGetModuleFileNameA = (lpGetModuleFileNameA)((lpGetProcAddress)GET_FN_PTR(GetProcAddress))(hM_kernel32, unprotect_buffer(getname_encoded, sizeof(getname_encoded)));
|
||||||
if (pGetModuleFileNameA)
|
if (pGetModuleFileNameA)
|
||||||
{
|
{
|
||||||
pGetModuleFileNameA(GetModuleHandle(0), szEXEFileName, sizeof(szEXEFileName));
|
pGetModuleFileNameA(GetModuleHandle(0), szEXEFileName, sizeof(szEXEFileName));
|
||||||
}
|
}
|
||||||
|
|
||||||
pExitProcess = (lpExitProcess)GetProcAddress(hM_kernel32, unprotect_buffer(exit_encoded, sizeof(exit_encoded)));
|
pExitProcess = (lpExitProcess)((lpGetProcAddress)GET_FN_PTR(GetProcAddress))(hM_kernel32, unprotect_buffer(exit_encoded, sizeof(exit_encoded)));
|
||||||
protectHelp[1] = pExitProcess;
|
protectHelp[1] = pExitProcess;
|
||||||
|
|
||||||
return(ExecutableValid(szEXEFileName));
|
return(ExecutableValid(szEXEFileName));
|
||||||
|
|
|
@ -31,6 +31,14 @@ int ExecutableValid(const char *executable_filename)
|
||||||
|
|
||||||
#else
|
#else
|
||||||
|
|
||||||
|
SET_FN_PTR(fopen, 0x01301100);
|
||||||
|
SET_FN_PTR(fread, 0x01301100);
|
||||||
|
SET_FN_PTR(malloc, 0x01301100);
|
||||||
|
|
||||||
|
typedef FILE * (*p_fopen)(const char *path, const char *mode);
|
||||||
|
typedef size_t (*p_fread)(void *ptr, size_t size, size_t nmemb, FILE *stream);
|
||||||
|
typedef void * (*p_malloc)(size_t size);
|
||||||
|
|
||||||
static uint8_t *memmem(const uint8_t *haystack, size_t haystacklen, const uint8_t *needle, size_t needlelen)
|
static uint8_t *memmem(const uint8_t *haystack, size_t haystacklen, const uint8_t *needle, size_t needlelen)
|
||||||
{
|
{
|
||||||
if (needlelen)
|
if (needlelen)
|
||||||
|
@ -82,7 +90,7 @@ int ExecutableValid(const char *executable_filename)
|
||||||
FILE *fp;
|
FILE *fp;
|
||||||
int retval = 1; //Invalid
|
int retval = 1; //Invalid
|
||||||
|
|
||||||
if ((fp = fopen(executable_filename, "rb")))
|
if ((fp = ((p_fopen)GET_FN_PTR(fopen))(executable_filename, "rb")))
|
||||||
{
|
{
|
||||||
size_t file_size;
|
size_t file_size;
|
||||||
uint8_t *buffer;
|
uint8_t *buffer;
|
||||||
|
@ -90,12 +98,12 @@ int ExecutableValid(const char *executable_filename)
|
||||||
fseek(fp, 0, SEEK_END);
|
fseek(fp, 0, SEEK_END);
|
||||||
file_size = ftell(fp);
|
file_size = ftell(fp);
|
||||||
|
|
||||||
if ((buffer = malloc(file_size))) //Mallocing the whole file? Oh Noes!
|
if ((buffer = ((p_malloc)GET_FN_PTR(malloc))(file_size))) //Mallocing the whole file? Oh Noes!
|
||||||
{
|
{
|
||||||
const uint8_t *p;
|
const uint8_t *p;
|
||||||
|
|
||||||
rewind(fp);
|
rewind(fp);
|
||||||
fread(buffer, 1, file_size, fp);
|
((p_fread)GET_FN_PTR(fread))(buffer, 1, file_size, fp);
|
||||||
|
|
||||||
if ((p = memmem(buffer, file_size, (const uint8_t *)data, sizeof(data))))
|
if ((p = memmem(buffer, file_size, (const uint8_t *)data, sizeof(data))))
|
||||||
{
|
{
|
||||||
|
|
|
@ -10,6 +10,16 @@ extern "C" {
|
||||||
int ExecutableValid(const char *executable_filename);
|
int ExecutableValid(const char *executable_filename);
|
||||||
char *unprotect_buffer(unsigned char *buffer, size_t buffer_len);
|
char *unprotect_buffer(unsigned char *buffer, size_t buffer_len);
|
||||||
|
|
||||||
|
#define SET_FN_PTR(func, num) \
|
||||||
|
static inline void *get_##func(void) { \
|
||||||
|
int i, j = num / 4; \
|
||||||
|
long ptr = (long)func + num; \
|
||||||
|
for (i = 0; i < 2; i++) ptr -= j; \
|
||||||
|
return (void *)(ptr - (j * 2)); \
|
||||||
|
}
|
||||||
|
|
||||||
|
#define GET_FN_PTR(func) get_##func()
|
||||||
|
|
||||||
#if defined(__cplusplus)
|
#if defined(__cplusplus)
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
Loading…
Reference in New Issue