ANTICHAT — форум по информационной безопасности, OSINT и технологиям

// Get VA
#define RVATOVA( base, offset )(((DWORD)(base) + (DWORD)(offset))) 

// Move program's memory
void __CopyMemoryAcrossProcesses( HANDLE hProcess, char* pMemLocal, char* pMemRemote )
{
	DWORD dwOldProt, dwNumBytes, i;
	MEMORY_BASIC_INFORMATION mbi;
	 
	VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
	while (mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0)
	{
		if (!(mbi.Protect & PAGE_GUARD))
		{
			for (i = 0; i < mbi.RegionSize; i += 0x1000)
			{
				VirtualProtectEx(hProcess, pMemRemote + i, 0x1000,PAGE_EXECUTE_READWRITE, &dwOldProt);
				WriteProcessMemory(hProcess, pMemRemote + i, pMemLocal + i, 0x1000, &dwNumBytes);
			}
		}
		pMemLocal += mbi.RegionSize;
		pMemRemote += mbi.RegionSize;
		VirtualQueryEx(hProcess, pMemRemote, &mbi, sizeof(MEMORY_BASIC_INFORMATION));	
	}
}

bool TransferProgram(HANDLE hProcess)
{
	HMODULE g_module = GetModuleHandle(0);
	VirtualFreeEx(hProcess, g_module, 0, MEM_RELEASE);
	
	DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(g_module) + ((PIMAGE_DOS_HEADER)(g_module))->e_lfanew + 
		sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;

	char *pMem = (char *)VirtualAllocEx(hProcess, g_module, dwSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if(pMem == NULL) return FALSE;

	__CopyMemoryAcrossProcesses( hProcess, (char*) g_module, pMem );

	return true;
}

DWORD TransferProgramEx(HANDLE hProcess)
/*
 Return value: image base delta, -1 on error
*/
{
	HMODULE hmodule = GetModuleHandle(0);
	DWORD dwSize = ((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE *)(hmodule) + ((PIMAGE_DOS_HEADER)(hmodule))->e_lfanew + 
		sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;

	MEMORY_BASIC_INFORMATION mbi = {0};
	VirtualQueryEx( hProcess, hmodule, &mbi, sizeof(mbi) );

	LPVOID Allocated;

	// Memory isn't free, relocate
	if( mbi.Protect!=PAGE_NOACCESS && mbi.RegionSize!=0 )
	{
__try_relocate:
		LPVOID DesiredAddress = hmodule;
		*(DWORD*)&DesiredAddress += mbi.RegionSize;

		for(;;)
		{
			Allocated = VirtualAllocEx( hProcess, DesiredAddress, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
			if( Allocated )
				break;
			*(DWORD*)&DesiredAddress += dwSize;
		}
	}
	else
	{
		Allocated = VirtualAllocEx( hProcess, hmodule, dwSize, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
		if( !Allocated )
			goto __try_relocate;
	}

	// move memory
	__CopyMemoryAcrossProcesses( hProcess, (char*) hmodule, (char*) Allocated );

	DWORD ImageBaseDelta = (DWORD)Allocated - (DWORD)hmodule;

	// Nonzero imagebase delta
	if( ImageBaseDelta )
	{
		// Apply fixups
		typedef struct 
		{
			WORD	Offset:12;
			WORD	Type:4;
		} IMAGE_FIXUP_ENTRY, *PIMAGE_FIXUP_ENTRY;

		PIMAGE_OPTIONAL_HEADER poh = 
			(PIMAGE_OPTIONAL_HEADER)(
				(DWORD)hmodule
				+ ((PIMAGE_DOS_HEADER)hmodule)->e_lfanew
				+ sizeof(IMAGE_NT_SIGNATURE)
				+ sizeof(IMAGE_FILE_HEADER)
			);

		// No fixups?
		if( !poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress )
		{
			VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
			VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
			return -1;
		}

		PIMAGE_BASE_RELOCATION Reloc = (PIMAGE_BASE_RELOCATION) RVATOVA(poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress, hmodule);
		int i = 0;

		// Process fixups
		for( PIMAGE_FIXUP_ENTRY Fixup = (PIMAGE_FIXUP_ENTRY)( (DWORD)Reloc + sizeof(IMAGE_BASE_RELOCATION) );
		     (DWORD)Fixup < (DWORD)Reloc + Reloc->SizeOfBlock -2;
			 Fixup ++, i ++
				 )
		{
			if( Fixup->Type == IMAGE_REL_BASED_HIGHLOW )
			{
				DWORD* Patch = (DWORD*)RVATOVA( Reloc->VirtualAddress + Fixup->Offset, Allocated );
				
				DWORD t, r;
				BOOL b = 1;

				// correct fixup
				b &= ReadProcessMemory( hProcess, Patch, &t, 4, &r );
				t += ImageBaseDelta;
				b &= WriteProcessMemory( hProcess, Patch, &t, 4, &r );

				if( !b ) 
				{
					// smth wrong
					VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
					VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
					return -1;
				}
			}
			else 
			{
				// unsupported fixup type
				VirtualFreeEx( hProcess, Allocated, dwSize, MEM_DECOMMIT );
				VirtualFreeEx( hProcess, Allocated, dwSize, MEM_RELEASE  );
				return -1;
			}
		}
	}

	return ImageBaseDelta;
}

	DWORD ImageBaseDelta = TransferProgramEx( hProcess );

	switch(ImageBaseDelta)
	{
	case -1:
		return printf("Cannot copy body\n"), 0;

	case 0:
		printf("Program copied at the same addresses\n");
		break;

	default:
		printf("Program relocated (delta = 0x%08x)\n", ImageBaseDelta);
		break;
	}

	DWORD thID;
	HANDLE hTh;

	hTh = CreateRemoteThread( hProcess, 0, 0, (LPTHREAD_START_ROUTINE)((char*)RemoteThread+ImageBaseDelta), 0, 0, &thID);
	WaitForSingleObject( hTh, INFINITE );

type
   massiv=array[0..3] of byte; // тип массива для хранения
   DW2MAS = ^massiv;

procedure TForm1.Button1Click(Sender: TObject);
var
mas:massiv; // наш массив
d:dword; // наша Dword переменная
begin
d:=$12345678;
mas:=DW2MAS(@d)^;
//теперь содержимое массива будет таким: $78,$56,$34,$12
end;

function incIP(d:dword):dword;assembler;
asm
bswap eax // поменять поряд байт
inc eax // увеличить на 1
bswap eax // поменять обратно
end;

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
var
ca:sockaddr_in;
d:dword;
begin
d:=inet_addr('127.0.0.1'); // сохраним IP адресс
d:=incIP(d); // увеличим на 1
d:=incIP(d); // увеличим на 1
d:=incIP(d); // увеличим на 1
ca.sin_addr.s_addr:=d; // запишем в структуру.
end;

function RoundFloat(R: Extended; Decimals: Integer): Extended;
var
  Factor: Extended;
begin
  Factor := Int(Exp(Decimals * Ln(10)));
  Result := Round(Factor * R) / Factor;
end;

Function FileSizeInKb(YourFile : String) : string;
Var
  arg: extended;
  F : Integer;
Begin
  F:=FileOpen(YourFile,0);
  arg := FileSeek(F,0,2);
  FileClose(F);
  arg:=roundfloat(arg/1024,1);
  result:=floattostr(arg);
End;

function PingPort(host: string; portnum: word; tim: integer): boolean;
var
  k: integer;
  s, opt: Integer;
  FSocket: TSOCKET;
  busy : boolean;
  addr : TSockAddr;
  hEvent : THandle;
  fset : TFDset;
  tv : TTimeval;
  tec :PServEnt;
  PName:String;
  GInitData : TWSADATA;
begin
  result := false;
  WSAStartup(MAKEWORD(2,0), GInitData);
  addr.sin_family := AF_INET;
  addr.sin_addr.s_addr := INADDR_ANY;
  addr.sin_port := htons(portnum);
  hEvent := WSACreateEvent();
  busy:=false;
  FSocket := socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
  WSAEventSelect(FSocket, hEvent, FD_WRITE + FD_CONNECT);
  addr.sin_addr := LookupName(host);
  connect(FSocket, @addr, sizeof(addr));
  if WSAGetLastError()=WSAEINPROGRESS then
    begin
      closesocket (FSocket);
      busy:=true;
    end;
  FD_Zero(fset);
  if busy <> true then
    FD_SET (FSocket, fset);
  tv.tv_sec := tim;
  tv.tv_usec := 0;
  s:=select (1, nil, @fset, nil, @tv);
  if busy then
    exit;
  if FD_ISSET (FSocket, fset) then
    begin
      s:=Sizeof(Opt);
      opt:=1;
      getsockopt(FSocket, SOL_SOCKET, SO_ERROR, @opt, s);
      if opt=0 then
        result := true;
      closesocket(FSocket);
    end;
  WSACloseEvent(hEvent);
  WSACleanup;
end;

procedure CopyFile(file1,file2: string);
var
  FromF, ToF: file;
  NumRead, NumWritten: Integer;
  Buf: array[1..2048] of Char;
begin
  AssignFile(FromF, file1);
  Reset(FromF, 1);
  AssignFile(ToF, File2);
  Rewrite(ToF, 1);
    repeat
      BlockRead(FromF, Buf, SizeOf(Buf), NumRead);
      BlockWrite(ToF, Buf, NumRead, NumWritten);
    until 
      (NumRead = 0) or (NumWritten <> NumRead);
  CloseFile(FromF);
  CloseFile(ToF);
end;