1308 lines
40 KiB
C
1308 lines
40 KiB
C
/////////////////////////////////////////////////////
|
|
//
|
|
// Version 1.0 :
|
|
//
|
|
//////////////////////////////////////////////////
|
|
|
|
|
|
#include <windows.h>
|
|
#include <tlhelp32.h>
|
|
#include <stdio.h>
|
|
//#include "PeImpExp.h"
|
|
#include "PEInline.h"
|
|
#include "PTC.h"
|
|
|
|
#include "PTC_abc.h"
|
|
|
|
#ifdef PTC_SYSTEM_ACTIVED // {
|
|
//////////////////////////////////////////////////
|
|
// Global Variables Declarations
|
|
//////////////////////////////////////////////////
|
|
char PTC_ga_cGeneratedCode[PTC_C_CODESIZE];
|
|
long PTC_g_lCurrentRandom;
|
|
long PTC_g_lProtectError;
|
|
|
|
DWORD *PTC_ga_dwLinkedDLLImageBase;
|
|
BOOL PTC_g_bNTSystem;
|
|
|
|
DWORD PTC_g_dwLinkedDLLNumber;
|
|
DWORD PTC_g_dwImportedFunctionsNumber;
|
|
DWORD PTC_gs_dwOldPageProtection;
|
|
|
|
char PTC_ga_szLinkedDLLName[][PTC_C_NAMESIZE] =
|
|
{
|
|
PTC_C_Kernel32_dllName ,
|
|
PTC_C_User32_dllName ,
|
|
PTC_C_PSAPI_dllName ,
|
|
PTC_C_ADVAPI32_dllName ,
|
|
PTC_C_GDI32_dllName ,
|
|
PTC_C_VERSION_dllName ,
|
|
PTC_C_WINMM_dllName ,
|
|
""
|
|
};
|
|
|
|
PTC_tdstImportedFunction PTC_ga_stImportedFunctions[] =
|
|
{
|
|
/* Name , dwAddress , lOwnerDLLIndex , lOtherDLLIndex */
|
|
#if defined(UNICODE)
|
|
PTC_C_GetModuleHandleWName , 0L , 0 , 1 , 6 , 0 , 0 , 0 , /* 0 */
|
|
#else
|
|
PTC_C_GetModuleHandleAName , 0L , 0 , 1 , 6 , 0 , 0 , 0 , /* 0 */
|
|
#endif
|
|
PTC_C_FlushInstructionCacheName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_GetCurrentProcessName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_QueryPerformanceFrequencyName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
#if defined(UNICODE)
|
|
PTC_C_OpenEventWName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_CreateEventWName , 0L , 0 , 0 , 0 , 0 , 0 , 0 , /* 5 */
|
|
#else
|
|
PTC_C_OpenEventAName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_CreateEventAName , 0L , 0 , 0 , 0 , 0 , 0 , 0 , /* 5 */
|
|
#endif
|
|
PTC_C_ResetEventName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_SetEventName , 0L , 0 , 1 , 0 , 0 , 0 , 0 ,
|
|
#if defined(UNICODE)
|
|
PTC_C_CreateFileWName, 0L , 0 , 1 , 6 , 3 , 5 , 0 ,
|
|
#else
|
|
PTC_C_CreateFileAName, 0L , 0 , 1 , 6 , 3 , 5 , 0 ,
|
|
#endif
|
|
PTC_C_WriteFileName, 0L , 0 , 3 , 4 , 0 , 0 , 0 ,
|
|
PTC_C_ReadFileName, 0L , 0 , 3 , 0 , 0 , 0 , 0 , /* 10 */
|
|
PTC_C_CloseHandleName, 0L , 0 , 1 , 5 , 3 , 4 , 6 ,
|
|
PTC_C_SetFilePointerName, 0L , 0 , 4 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_FlushFileBufferName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_QueryPerformanceCounterName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
#if defined(UNICODE)
|
|
PTC_C_GetDriveTypeWName , 0L , 0 , 4 , 0 , 0 , 0 , 0 , /* 15 */
|
|
PTC_C_GetVolumeInformationWName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_GetLogicalDriveStringsWName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
#else
|
|
PTC_C_GetDriveTypeAName , 0L , 0 , 4 , 0 , 0 , 0 , 0 , /* 15 */
|
|
PTC_C_GetVolumeInformationAName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_GetLogicalDriveStringsAName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
#endif
|
|
PTC_C_GetFileSizeName , 0L , 0 , 3 , 1 , 6 , 5 , 0 ,
|
|
PTC_C_CreateToolhelp32SnapshotName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_Process32FirstName , 0L , 0 , 0 , 0 , 0 , 0 , 0 , /* 20 */
|
|
PTC_C_Process32NextName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_Module32FirstName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_Module32NextName , 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_EnumProcessesName , 0L , 2 , 2 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_EnumProcessModulesName , 0L , 2 , 2 , 0 , 0 , 0 , 0 , /* 25 */
|
|
#if defined(UNICODE)
|
|
PTC_C_LoadLibraryWName , 0L , 0 , 3 , 4 , 1 , 6 , 0 ,
|
|
#else
|
|
PTC_C_LoadLibraryAName , 0L , 0 , 3 , 4 , 1 , 6 , 0 ,
|
|
#endif
|
|
PTC_C_FreeLibraryName , 0L , 0 , 4 , 1 , 6 , 5 , 3 ,
|
|
/* ANNECY OA - 21/07/99 { */
|
|
#if defined(UNICODE)
|
|
PTC_C_GetDiskFreeSpaceWName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_SetFileAttributsWName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_GetFileAttributsWName, 0L , 0 , 6 , 5 , 3 , 0 , 0 , /* 30 */
|
|
#else
|
|
PTC_C_GetDiskFreeSpaceAName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_SetFileAttributsAName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_GetFileAttributsAName, 0L , 0 , 6 , 3 , 5 , 0 , 0 , /* 30 */
|
|
#endif
|
|
PTC_C_GetFileInformationByHandleName, 0L , 0 , 0 , 0 , 0 , 0 , 0 ,
|
|
PTC_C_SetErrorModeName, 0L , 0 , 3 , 6 , 0 , 0 , 0 ,
|
|
PTC_C_SetFileTimeName, 0L , 0 , 6 , 1 , 5 , 0 , 0 ,
|
|
PTC_C_GetFileTimeName, 0L , 0 , 6 , 3 , 5 , 1 , 0 ,
|
|
/* END ANNECY OA } */
|
|
"" , 0L , 0 , 0 , 0 , 0 , 0 , 0 /* 35 */
|
|
};
|
|
|
|
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
|
|
DWORD PTC_g_dwBeginLabelAddress[PTC_C_ChecksumTableSize];
|
|
DWORD PTC_g_dwEndLabelAddress[PTC_C_ChecksumTableSize];
|
|
BOOL PTC_g_bTakeAddresses;
|
|
DWORD PTC_g_dwChecksum[PTC_C_ChecksumTableSize];
|
|
DWORD PTC_g_dwBeginLabelAddressDelete[PTC_C_ChecksumTableSize];
|
|
DWORD PTC_g_dwEndLabelAddressDelete[PTC_C_ChecksumTableSize];
|
|
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
#define PTC_M_bCanObtainFunctionWithAnotherDLL(lIndex)\
|
|
((PTC_ga_stImportedFunctions [lIndex] . lOwnerDLLIndex != PTC_ga_stImportedFunctions [lIndex] . lOtherDLLIndex[0]) &&\
|
|
(PTC_ga_dwLinkedDLLImageBase [PTC_ga_stImportedFunctions [lIndex] . lOtherDLLIndex[0]] != 0))
|
|
|
|
//////////////////////////////////////////////////
|
|
// Internal Functions
|
|
//////////////////////////////////////////////////
|
|
char *PTC_fn_szGetFunctionExplicitName (long _lIndex);
|
|
char *PTC_fn_szGetDLLExplicitName(long _lIndex);
|
|
|
|
DWORD dwGetAddressOfFunctionInAnotherDLL (char *szDll,char *szFunc);
|
|
|
|
void PTC_fn_vGetGetModuleHandleA (BOOL _bFirstTime);
|
|
void PTC_fn_vGetOneLinkedDLLImageBase(long _iIndex , BOOL _bFirstTime);
|
|
void PTC_fn_vGetOneSystemFunctionPtr (long _iIndex , BOOL _bFirstTime);
|
|
void PTC_fn_vGetAllSystemFunctionsPtr(BOOL _bFirstTime);
|
|
void PTC_fn_vGetAllLinkedDLLImageBase(BOOL _bFirstTime);
|
|
HMODULE PTC_fn_hGetKernel32Handle();
|
|
HMODULE PTC_fn_hScanMemoryForKernel32(LPBYTE lpBuffer,int n,int step);
|
|
BOOL PTC_fn_bLookForKernel32(LPBYTE lpBuffer);
|
|
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// Return the Real Name of The function in PTC_ga_szImportedFunctionName array
|
|
// Used to uncode the name
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
char PTC_g_szFunctionCurrentName[PTC_C_NAMESIZE];
|
|
char *PTC_fn_szGetFunctionExplicitName(long _lIndex)
|
|
{
|
|
return PTC_ga_stImportedFunctions [_lIndex] . szName;
|
|
}
|
|
|
|
char PTC_g_szDLLCurrentName[PTC_C_NAMESIZE];
|
|
char *PTC_fn_szGetDLLExplicitName(long _lIndex)
|
|
{
|
|
DWORD dwKey = *(DWORD*)(PTC_ga_szLinkedDLLName [_lIndex]);
|
|
unsigned char *p_ucCryptKey = (unsigned char*) &dwKey;
|
|
unsigned char cSize = (unsigned char)PTC_ga_szLinkedDLLName [_lIndex] [4];
|
|
char *p_cSource = PTC_ga_szLinkedDLLName [_lIndex] + 5;
|
|
char *p_cTarget = PTC_g_szDLLCurrentName;
|
|
unsigned char cCount;
|
|
|
|
for (cCount = 0 ; cCount < cSize ; cCount++ , p_cSource++ , p_cTarget++ )
|
|
{
|
|
*p_cTarget = (*p_cSource - p_ucCryptKey[0]) ^ p_ucCryptKey[1];
|
|
p_ucCryptKey[0] += p_ucCryptKey[2];
|
|
p_ucCryptKey[1] += p_ucCryptKey[3];
|
|
}
|
|
*p_cTarget = 0;
|
|
|
|
return PTC_g_szDLLCurrentName;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// return Absolute Address
|
|
//////////////////////////////////////////////////
|
|
DWORD PTC_dwGetAddressOfFunctionInAnotherDLL(long _lFunctionIndex)
|
|
{
|
|
DWORD dwIndexMax , dwIndex , dwAddressEntry , dwAddress;
|
|
|
|
dwIndexMax = 4;
|
|
while ( PTC_ga_stImportedFunctions [_lFunctionIndex] . lOtherDLLIndex [dwIndexMax] != PTC_ga_stImportedFunctions [_lFunctionIndex] . lOwnerDLLIndex) dwIndexMax--;
|
|
|
|
dwIndex = (DWORD)PTC_fn_lGetRandomRange (0 , dwIndexMax+1);
|
|
dwAddressEntry = dwGetImportedFunctionEntryFromImageBase (PTC_ga_dwLinkedDLLImageBase [PTC_ga_stImportedFunctions [_lFunctionIndex] . lOtherDLLIndex[dwIndex]] , PTC_fn_szGetFunctionExplicitName (_lFunctionIndex));
|
|
dwAddress = *((DWORD*) dwAddressEntry);
|
|
|
|
return (dwAddress);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// return OffSet Address
|
|
//////////////////////////////////////////////////
|
|
DWORD PTC_dwGetExportedFunctionEntryFromImageBase(long _lFunctionIndex)
|
|
{
|
|
DWORD dwImageBase = PTC_ga_dwLinkedDLLImageBase [PTC_ga_stImportedFunctions [_lFunctionIndex] . lOwnerDLLIndex];
|
|
DWORD dwPtr = dwGetExportedFunctionEntryFromImageBase (dwImageBase , PTC_fn_szGetFunctionExplicitName (_lFunctionIndex));
|
|
|
|
return(dwPtr);
|
|
}
|
|
//////////////////////////////////////////////////
|
|
// Get 'GetModuleHandle' Ptr in USER32.dll
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vGetGetModuleHandleA(BOOL _bFirstTime)
|
|
{
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(8,PTC_fn_vGetGetModuleHandleA);
|
|
return;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_vGetGetModuleHandleA)
|
|
|
|
|
|
if (_bFirstTime)
|
|
{
|
|
DWORD dwAddressEntry , dwAddress , dwKey;
|
|
|
|
/*
|
|
HANDLE hDll = GetModuleHandle (PTC_fn_szGetDLLExplicitName(PTC_C_User32Index));
|
|
|
|
dwAddressEntry = dwGetImportedFunctionEntryFromImageBase ((DWORD) hDll , PTC_fn_szGetFunctionExplicitName(PTC_C_GetModuleHandleIndex));
|
|
dwAddress = *((DWORD*) dwAddressEntry);
|
|
*/
|
|
|
|
PTC_ga_dwLinkedDLLImageBase [PTC_C_Kernel32Index] = (DWORD)PTC_fn_hGetKernel32Handle();
|
|
dwAddressEntry = PTC_dwGetExportedFunctionEntryFromImageBase (PTC_C_GetModuleHandleIndex);
|
|
dwAddress = PTC_ga_dwLinkedDLLImageBase [PTC_C_Kernel32Index] + dwAddressEntry;
|
|
|
|
dwKey = *((DWORD*) PTC_ga_stImportedFunctions [PTC_C_GetModuleHandleIndex] . szName);
|
|
PTC_ga_stImportedFunctions [PTC_C_GetModuleHandleIndex] . dwAddress = dwAddress ^ dwKey;
|
|
}
|
|
else
|
|
{
|
|
DWORD dwPtr;
|
|
DWORD dwKey = *((DWORD*) PTC_ga_stImportedFunctions [PTC_C_GetModuleHandleIndex] . szName);
|
|
|
|
if (PTC_M_bCanObtainFunctionWithAnotherDLL(PTC_C_GetModuleHandleIndex))
|
|
{
|
|
dwPtr = PTC_dwGetAddressOfFunctionInAnotherDLL (PTC_C_GetModuleHandleIndex);
|
|
}
|
|
else
|
|
{
|
|
HANDLE hDll = GetModuleHandle (PTC_fn_szGetDLLExplicitName(PTC_C_User32Index));
|
|
DWORD dwAddressEntry = dwGetImportedFunctionEntryFromImageBase ((DWORD) hDll , PTC_fn_szGetFunctionExplicitName(PTC_C_GetModuleHandleIndex));
|
|
dwPtr = *((DWORD*) dwAddressEntry);
|
|
}
|
|
// Test if same as previous getting
|
|
if (dwPtr != PTC_ga_stImportedFunctions [PTC_C_GetModuleHandleIndex] . dwAddress)
|
|
{
|
|
PTC_g_lProtectError = 1; // GetModuleHandle Ptr has changed
|
|
}
|
|
PTC_ga_stImportedFunctions [PTC_C_GetModuleHandleIndex] . dwAddress = dwPtr ^ dwKey;
|
|
}
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_vGetGetModuleHandleA);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Get a DLL ImageBase
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vGetOneLinkedDLLImageBase(long _iIndex , BOOL _bFirstTime)
|
|
{
|
|
DWORD dwPtr = (DWORD) PTC_DirectGetModuleHandle (PTC_fn_szGetDLLExplicitName (_iIndex));
|
|
|
|
if (! _bFirstTime && (dwPtr != PTC_ga_dwLinkedDLLImageBase [_iIndex]))
|
|
{
|
|
PTC_g_lProtectError = 1; // GetModuleHandle Ptr has changed
|
|
}
|
|
PTC_ga_dwLinkedDLLImageBase [_iIndex] = dwPtr;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Get One System Function Ptr
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vGetOneSystemFunctionPtr (long _iIndex , BOOL _bFirstTime)
|
|
{
|
|
DWORD dwPtr,dwImageBase;
|
|
DWORD dwKey = *((DWORD*) PTC_ga_stImportedFunctions [_iIndex] . szName);
|
|
|
|
dwImageBase = PTC_ga_dwLinkedDLLImageBase [PTC_ga_stImportedFunctions [_iIndex] . lOwnerDLLIndex];
|
|
|
|
if (dwImageBase == 0L)
|
|
{
|
|
PTC_ga_stImportedFunctions [_iIndex] . dwAddress = 0L;
|
|
return;
|
|
}
|
|
|
|
if (_bFirstTime)
|
|
{
|
|
dwPtr = PTC_dwGetExportedFunctionEntryFromImageBase (_iIndex);
|
|
dwPtr += (dwPtr ? dwImageBase : 0);
|
|
}
|
|
else
|
|
{
|
|
if (PTC_M_bCanObtainFunctionWithAnotherDLL(_iIndex))
|
|
{
|
|
dwPtr = PTC_dwGetAddressOfFunctionInAnotherDLL (_iIndex);
|
|
}
|
|
else
|
|
{
|
|
dwPtr = PTC_dwGetExportedFunctionEntryFromImageBase (_iIndex);
|
|
dwPtr += (dwPtr ? dwImageBase : 0);
|
|
}
|
|
// Test if same as previous getting
|
|
if (dwPtr != PTC_ga_stImportedFunctions [_iIndex] . dwAddress)
|
|
{
|
|
PTC_g_lProtectError = 1; // Function Ptr has changed
|
|
}
|
|
}
|
|
|
|
PTC_ga_stImportedFunctions [_iIndex] . dwAddress = (dwPtr ? dwPtr ^ dwKey : 0L);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// check for kernel32 presence
|
|
//////////////////////////////////////////////////
|
|
BOOL PTC_fn_bLookForKernel32(LPBYTE lpBuffer)
|
|
{
|
|
BOOL bRet=FALSE;
|
|
|
|
// MZ signature
|
|
if (*(USHORT *) lpBuffer == IMAGE_DOS_SIGNATURE)
|
|
{
|
|
// PE signature
|
|
if (*(DWORD *)NTSIGNATURE (lpBuffer) == IMAGE_NT_SIGNATURE)
|
|
{
|
|
// find dllname in export table
|
|
PIMAGE_OPTIONAL_HEADER pPEOptionalHeader=(PIMAGE_OPTIONAL_HEADER) OPTHDROFFSET (lpBuffer);
|
|
if (pPEOptionalHeader)
|
|
{
|
|
// RVA of export table
|
|
DWORD ExportRVA=pPEOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
|
|
if (ExportRVA)
|
|
{
|
|
// pointer on export table
|
|
PIMAGE_EXPORT_DIRECTORY ped=(PIMAGE_EXPORT_DIRECTORY) &lpBuffer[ExportRVA];
|
|
if (ped)
|
|
{
|
|
// pointer on DLL name
|
|
DWORD *dwPtr=(DWORD*) &lpBuffer[ped->Name];
|
|
|
|
#define MASK1 0x20202020
|
|
#define MASK2 0x00002020
|
|
#define MASK3 0x20202000
|
|
#define MASK4 0x000000FF
|
|
|
|
// avoid a silly stricmp
|
|
if ( (dwPtr[0] & ~MASK1) == ('NREK') )
|
|
{
|
|
if ( (dwPtr[1] | MASK2) == ('23le') )
|
|
{
|
|
if ( (dwPtr[2] & ~MASK3) == ('LLD.') )
|
|
{
|
|
if ( (dwPtr[3] & MASK4)==0)
|
|
{
|
|
bRet=TRUE;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return(bRet);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// scan memory with exception handler to prevent from crashing
|
|
//////////////////////////////////////////////////
|
|
#include <excpt.h>
|
|
|
|
/* ASM version */
|
|
HMODULE PTC_fn_hScanMemoryForKernel32(LPBYTE lpBuffer,int n,int step)
|
|
{
|
|
HMODULE lAddress;
|
|
__asm
|
|
{
|
|
// jmp + push the seh routine address on the stack
|
|
call set_seh
|
|
|
|
// Exception handler routine
|
|
mov eax,[esp+0Ch]
|
|
push ebx
|
|
mov ebx,[eax.Edx] // offset A8h
|
|
sub [eax.Eax],ebx // offset B0h
|
|
dec dword ptr [eax.Ecx] // offset ACh
|
|
jnz continue_search
|
|
// end the search, put a valid address in eax
|
|
mov ebx,[eax.Esp] // offset C4h
|
|
mov [eax.Eax],ebx
|
|
continue_search:
|
|
pop ebx
|
|
mov eax,ExceptionContinueExecution
|
|
ret
|
|
|
|
set_seh:
|
|
push fs:[0]
|
|
mov fs:[0],esp
|
|
mov eax,[lpBuffer]
|
|
mov ecx,[n]
|
|
mov edx,[step]
|
|
try_once:
|
|
mov ebx,[eax]
|
|
or ecx,ecx
|
|
jz not_found
|
|
push eax
|
|
push edx
|
|
push ecx
|
|
push eax
|
|
call PTC_fn_bLookForKernel32
|
|
or eax,eax
|
|
pop eax
|
|
pop ecx
|
|
pop edx
|
|
pop eax
|
|
jnz found
|
|
sub eax,edx
|
|
dec ecx
|
|
jz not_found
|
|
jmp try_once
|
|
not_found:
|
|
xor eax,eax
|
|
found:
|
|
mov ebx,fs:[0]
|
|
mov ebx,[ebx]
|
|
mov fs:[0],ebx
|
|
mov [lAddress],eax
|
|
}
|
|
return lAddress;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
HMODULE PTC_fn_hGetKernel32Handle()
|
|
{
|
|
static HMODULE hKernel32=0;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(7,PTC_fn_hGetKernel32Handle);
|
|
return NULL;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_hGetKernel32Handle)
|
|
|
|
|
|
if (!hKernel32)
|
|
{
|
|
LPBYTE lpBuffer=0;
|
|
|
|
// start scanning at 0x80000000 under NT at 0xC0000000 else
|
|
__asm
|
|
{
|
|
mov eax,dword ptr fs:[30h]
|
|
and eax,0x80000000 // NT detected if eax == 0
|
|
shr eax,1
|
|
add eax,0x80000000
|
|
mov dword ptr [lpBuffer],eax
|
|
}
|
|
hKernel32=PTC_fn_hScanMemoryForKernel32(lpBuffer,0x1000,0x10000); // it's fastest to scan the correct zone first
|
|
|
|
if (!hKernel32)
|
|
{
|
|
hKernel32=PTC_fn_hScanMemoryForKernel32((LPBYTE) 0xC0000000,0x1000,0x10000); // works under W9x
|
|
if (!hKernel32)
|
|
{
|
|
hKernel32=PTC_fn_hScanMemoryForKernel32((LPBYTE) 0x80000000,0x1000,0x10000); // works under WinNT
|
|
if (!hKernel32)
|
|
{
|
|
hKernel32=PTC_fn_hScanMemoryForKernel32((LPBYTE) 0x00000000,0xF000,-0x10000); // should not happened
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return(hKernel32);
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_hGetKernel32Handle);
|
|
}
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
|
|
////////////////////////////////////////////////////////
|
|
// Must be done after PTC_fn_vGetAllSystemFunctionsPtr()
|
|
// Is NT System or W95/W98 ????
|
|
////////////////////////////////////////////////////////
|
|
void PTC_fn_vUpdateCurrentSystem()
|
|
{
|
|
HANDLE hSnapshotProcess;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(6,PTC_fn_vUpdateCurrentSystem);
|
|
return;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_vUpdateCurrentSystem)
|
|
|
|
|
|
if ( PTC_ga_stImportedFunctions [PTC_C_CreateToolhelp32SnapshotIndex] . dwAddress == 0L ||
|
|
PTC_ga_stImportedFunctions [PTC_C_Process32FirstIndex] . dwAddress == 0L ||
|
|
PTC_ga_stImportedFunctions [PTC_C_Process32NextIndex] . dwAddress == 0L ||
|
|
PTC_ga_stImportedFunctions [PTC_C_Module32FirstIndex] . dwAddress == 0L ||
|
|
PTC_ga_stImportedFunctions [PTC_C_Module32NextIndex] . dwAddress == 0L)
|
|
{
|
|
// NT System
|
|
PTC_g_bNTSystem = TRUE;
|
|
// Load PSAPI.DLL
|
|
PTC_LoadLibrary (PTC_fn_szGetDLLExplicitName (PTC_C_PSAPIIndex));
|
|
// update array of DLL Image Base
|
|
PTC_fn_vGetOneLinkedDLLImageBase (PTC_C_PSAPIIndex , TRUE);
|
|
|
|
// update array of Functions Image Base
|
|
PTC_fn_vGetOneSystemFunctionPtr (PTC_C_EnumProcessesIndex , TRUE);
|
|
PTC_fn_vGetOneSystemFunctionPtr (PTC_C_EnumProcessModulesIndex , TRUE);
|
|
|
|
return;
|
|
}
|
|
|
|
// Create a ToolHelp32 snapshot containing the process list
|
|
hSnapshotProcess = PTC_CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
|
|
if ( hSnapshotProcess == NULL )
|
|
{
|
|
PTC_g_bNTSystem = TRUE;
|
|
// Load PSAPI.DLL
|
|
PTC_LoadLibrary (PTC_fn_szGetDLLExplicitName (PTC_C_PSAPIIndex));
|
|
// update array of DLL Image Base
|
|
PTC_fn_vGetOneLinkedDLLImageBase (PTC_C_PSAPIIndex , TRUE);
|
|
|
|
// update array of Functions Image Base
|
|
PTC_fn_vGetOneSystemFunctionPtr (PTC_C_EnumProcessesIndex , TRUE);
|
|
PTC_fn_vGetOneSystemFunctionPtr (PTC_C_EnumProcessModulesIndex , TRUE);
|
|
|
|
return;
|
|
}
|
|
|
|
PTC_g_bNTSystem = FALSE;
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_vUpdateCurrentSystem);
|
|
}
|
|
|
|
////////////////////////////////
|
|
// Uses PSAPI.dll
|
|
////////////////////////////////
|
|
#ifdef _DEBUG
|
|
typedef DWORD (WINAPI * PFNGETMODULEFILENAMEEXA)(HANDLE hProcess,HMODULE hModule,LPSTR lpFilename,DWORD nSize);
|
|
#endif
|
|
|
|
DWORD PTC_fn_dwGetRandomDLLImageBaseOnNT()
|
|
{
|
|
HANDLE hProcess;
|
|
DWORD cbNeeded;
|
|
HMODULE hModuleArray[1024];
|
|
DWORD dwModuleSelected;
|
|
DWORD nModules;
|
|
#ifdef _DEBUG
|
|
PFNGETMODULEFILENAMEEXA pfnGetModuleFileNameExA = (PFNGETMODULEFILENAMEEXA) GetProcAddress ((HMODULE)PTC_ga_dwLinkedDLLImageBase [PTC_C_PSAPIIndex], "GetModuleFileNameExA");
|
|
char szModuleName[255];
|
|
#endif
|
|
|
|
hProcess = PTC_GetCurrentProcess ();
|
|
// Count number of modules
|
|
if ( !PTC_EnumProcessModules(hProcess, hModuleArray, sizeof(hModuleArray), &cbNeeded ) )
|
|
{
|
|
return(0L);
|
|
}
|
|
|
|
// Calculate number of modules in the process
|
|
nModules = cbNeeded / sizeof(hModuleArray[0]);
|
|
|
|
if (nModules == 1) // strange, the process uses no DLL !!!!!!!!!!!!!!
|
|
{
|
|
return 0L;
|
|
}
|
|
|
|
// choose one
|
|
dwModuleSelected = PTC_fn_lGetRandomRange (0 , nModules - 1) + 1; // the first module is the process itself
|
|
|
|
#ifdef _DEBUG
|
|
pfnGetModuleFileNameExA(hProcess, hModuleArray [dwModuleSelected], szModuleName, sizeof(szModuleName) );
|
|
#endif
|
|
|
|
return (DWORD)hModuleArray [dwModuleSelected];
|
|
}
|
|
|
|
DWORD PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT(char *_szCryptedName)
|
|
{
|
|
HANDLE hProcess;
|
|
DWORD cbNeeded;
|
|
HMODULE hModuleArray[1024];
|
|
DWORD nModules;
|
|
DWORD dwIndex;
|
|
DWORD dwResult = 0;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(4,PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT);
|
|
return 0L;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT)
|
|
|
|
|
|
hProcess = PTC_GetCurrentProcess ();
|
|
// Count number of modules
|
|
if ( !PTC_EnumProcessModules(hProcess, hModuleArray, sizeof(hModuleArray), &cbNeeded ) )
|
|
{
|
|
return(0L);
|
|
}
|
|
// Calculate number of modules in the process
|
|
nModules = cbNeeded / sizeof(hModuleArray[0]);
|
|
|
|
if (nModules == 1) // strange, the process uses no DLL !!!!!!!!!!!!!!
|
|
{
|
|
return 0L;
|
|
}
|
|
|
|
for(dwIndex = 0 ; dwIndex < nModules ; dwIndex++)
|
|
{
|
|
DWORD dwAddress = dwGetExportedFunctionEntryFromImageBase ((DWORD)hModuleArray [dwIndex] , _szCryptedName);
|
|
if (dwAddress) dwResult++;
|
|
}
|
|
return dwResult;
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT);
|
|
}
|
|
|
|
////////////////////////////////
|
|
// Uses CreateToolhelp32 function
|
|
////////////////////////////////
|
|
DWORD PTC_fn_dwGetRandomDLLImageBaseOnW95W98()
|
|
{
|
|
HANDLE hSnapshotModule;
|
|
MODULEENTRY32 modEntry;
|
|
BOOL fModWalkContinue;
|
|
DWORD dwNbModule, dwModuleIndex;
|
|
|
|
hSnapshotModule = PTC_CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, 0 ); // current process only
|
|
modEntry.dwSize = sizeof(MODULEENTRY32);
|
|
|
|
for (fModWalkContinue = PTC_Module32First(hSnapshotModule,&modEntry) , dwNbModule = 0;
|
|
fModWalkContinue;
|
|
fModWalkContinue = PTC_Module32Next(hSnapshotModule,&modEntry) , dwNbModule++ );
|
|
|
|
// choose one
|
|
dwModuleIndex = PTC_fn_lGetRandomRange (0 , dwNbModule-1) + 1; // the first module is the process itself
|
|
|
|
// get selected module
|
|
dwNbModule = 0;
|
|
fModWalkContinue = PTC_Module32First(hSnapshotModule,&modEntry);
|
|
while (dwNbModule != dwModuleIndex)
|
|
{
|
|
fModWalkContinue = PTC_Module32Next(hSnapshotModule,&modEntry);
|
|
}
|
|
|
|
// close handle
|
|
PTC_CloseHandle (hSnapshotModule);
|
|
|
|
return (DWORD)modEntry.hModule;
|
|
}
|
|
|
|
DWORD PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98(char *_szCryptedName)
|
|
{
|
|
HANDLE hSnapshotModule;
|
|
MODULEENTRY32 modEntry;
|
|
BOOL fModWalkContinue;
|
|
DWORD dwNbModule;
|
|
DWORD dwResult = 0;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(5,PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98);
|
|
return 0L;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98)
|
|
|
|
|
|
hSnapshotModule = PTC_CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, 0 ); // current process only
|
|
modEntry.dwSize = sizeof(MODULEENTRY32);
|
|
|
|
for (fModWalkContinue = PTC_Module32First(hSnapshotModule,&modEntry) , dwNbModule = 0;
|
|
fModWalkContinue;
|
|
fModWalkContinue = PTC_Module32Next(hSnapshotModule,&modEntry) , dwNbModule++ )
|
|
{
|
|
DWORD dwAddress = dwGetExportedFunctionEntryFromImageBase ((DWORD)modEntry.hModule , _szCryptedName);
|
|
if (dwAddress) dwResult++;
|
|
}
|
|
|
|
// close handle
|
|
PTC_CloseHandle (hSnapshotModule);
|
|
|
|
return dwResult;
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
DWORD PTC_fn_dwSearchFunctionInImportedTableOfExe(char *_szCryptedName)
|
|
{
|
|
DWORD dwResult,dwAddress;
|
|
DWORD dwKey = *((DWORD*) _szCryptedName);
|
|
PTC_tdstImportedFunction *p_stIF = (PTC_tdstImportedFunction *) PTC_ga_stImportedFunctions;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(9,PTC_fn_dwSearchFunctionInImportedTableOfExe);
|
|
return 0L;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_dwSearchFunctionInImportedTableOfExe)
|
|
|
|
dwResult = dwGetImportedFunctionEntryFromImageBase ((DWORD)PTC_GetModuleHandle(NULL) , _szCryptedName);
|
|
dwAddress = (dwResult ? *((DWORD*) dwResult) : 0L);
|
|
|
|
if (dwAddress)
|
|
{
|
|
while (*(p_stIF -> szName) && (strcmp(p_stIF -> szName,_szCryptedName))) p_stIF++;
|
|
|
|
if(*(p_stIF -> szName))
|
|
{
|
|
return (dwAddress - (p_stIF -> dwAddress ^ dwKey));
|
|
}
|
|
}
|
|
return (0L);
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_dwSearchFunctionInImportedTableOfExe);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Get All System Functions Ptr
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vGetAllSystemFunctionsPtr(BOOL _bFirstTime)
|
|
{
|
|
DWORD dwIndex;
|
|
|
|
for (dwIndex = 1 ; dwIndex < PTC_g_dwImportedFunctionsNumber ; dwIndex++)
|
|
{
|
|
PTC_fn_vGetOneSystemFunctionPtr (dwIndex , _bFirstTime);
|
|
}
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Get all Linked ImageBase
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vGetAllLinkedDLLImageBase(BOOL _bFirstTime)
|
|
{
|
|
DWORD dwIndex;
|
|
|
|
for (dwIndex = 0 ; dwIndex < PTC_g_dwLinkedDLLNumber ; dwIndex++)
|
|
{
|
|
PTC_fn_vGetOneLinkedDLLImageBase (dwIndex , _bFirstTime);
|
|
}
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Return ...
|
|
//////////////////////////////////////////////////
|
|
DWORD PTC_fn_dwGetRandomDLLImageBase()
|
|
{
|
|
if (PTC_g_bNTSystem)
|
|
return PTC_fn_dwGetRandomDLLImageBaseOnNT ();
|
|
else
|
|
return PTC_fn_dwGetRandomDLLImageBaseOnW95W98 ();
|
|
|
|
return 0L;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Return ...
|
|
//////////////////////////////////////////////////
|
|
DWORD PTC_fn_dwSearchExportedFunctionInEveryDLL(char *_szCryptedName)
|
|
{
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(3,PTC_fn_dwSearchExportedFunctionInEveryDLL);
|
|
return 0L;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_dwSearchExportedFunctionInEveryDLL)
|
|
|
|
|
|
if (PTC_g_bNTSystem)
|
|
return PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT (_szCryptedName);
|
|
else
|
|
return PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98 (_szCryptedName);
|
|
|
|
return 0L;
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_dwSearchExportedFunctionInEveryDLL);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Fill
|
|
//////////////////////////////////////////////////
|
|
__inline void PTC_fn_vInitOneVariable (void *p_vAddr , DWORD dwSizeInByte)
|
|
{
|
|
long lSize = dwSizeInByte / 4;
|
|
long lIndex;
|
|
long *p_lValue = (long*)p_vAddr;
|
|
|
|
for (lIndex = 0 ; lIndex < lSize ; lIndex++ , p_lValue++)
|
|
{
|
|
*p_lValue = PTC_fn_lGetRandom ();
|
|
}
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Init Protections
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vTest();
|
|
|
|
|
|
void PTC_fn_vInit(BOOL _bFirstTime)
|
|
{
|
|
LARGE_INTEGER xCounter;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionCheckSum(2,PTC_fn_vInit);
|
|
return;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_vInit)
|
|
|
|
|
|
// Init Random Sequence
|
|
if (QueryPerformanceCounter (&xCounter))
|
|
{
|
|
PTC_g_lCurrentRandom = xCounter.LowPart;
|
|
}
|
|
else
|
|
{
|
|
PTC_g_lCurrentRandom = 0x12345678;
|
|
}
|
|
|
|
// Fill Generated Code Buffer with random value
|
|
PTC_fn_vInitOneVariable ((void*)PTC_ga_cGeneratedCode , PTC_C_CODESIZE);
|
|
|
|
//VirtualProtect(PTC_ga_cGeneratedCode, PTC_C_CODESIZE, PAGE_EXECUTE, &PTC_gs_dwOldPageProtection);
|
|
|
|
// Compute Size of Arrays
|
|
PTC_g_dwLinkedDLLNumber = (sizeof(PTC_ga_szLinkedDLLName) / PTC_C_NAMESIZE) - 1;
|
|
PTC_g_dwImportedFunctionsNumber = (sizeof(PTC_ga_stImportedFunctions) / sizeof(PTC_tdstImportedFunction)) - 1;
|
|
|
|
// Allocate array of DLL Image Base
|
|
PTC_ga_dwLinkedDLLImageBase = (DWORD*) malloc (PTC_g_dwLinkedDLLNumber * sizeof(DWORD));
|
|
// Fill It with random value
|
|
PTC_fn_vInitOneVariable ((void*)PTC_ga_dwLinkedDLLImageBase, PTC_g_dwLinkedDLLNumber * sizeof(DWORD));
|
|
|
|
|
|
/////////////////////////////////////////////////
|
|
if (_bFirstTime) PTC_g_lProtectError = 0;
|
|
|
|
// Get GetModuleHandle Ptr
|
|
PTC_fn_vGetGetModuleHandleA (_bFirstTime);
|
|
|
|
// Get All DLL ImageBase
|
|
PTC_fn_vGetAllLinkedDLLImageBase (_bFirstTime);
|
|
|
|
// Get All System functions Ptr
|
|
PTC_fn_vGetAllSystemFunctionsPtr (_bFirstTime);
|
|
|
|
// Is NT or W95/98
|
|
if (_bFirstTime) PTC_fn_vUpdateCurrentSystem ();
|
|
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_vInit)
|
|
|
|
///////////////////////////////////////////////
|
|
PTC_fn_vTest ();
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// DesInit Protections
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vDesInit()
|
|
{
|
|
/*
|
|
if (PTC_ga_cGeneratedCode)
|
|
{
|
|
VirtualProtect(PTC_ga_cGeneratedCode, PTC_C_CODESIZE, PTC_gs_dwOldPageProtection, &PTC_gs_dwOldPageProtection);
|
|
free (PTC_ga_cGeneratedCode);
|
|
}
|
|
*/
|
|
if (PTC_ga_dwLinkedDLLImageBase)
|
|
{
|
|
free (PTC_ga_dwLinkedDLLImageBase);
|
|
}
|
|
if (PTC_g_bNTSystem)
|
|
{
|
|
FreeLibrary ((HMODULE)PTC_ga_dwLinkedDLLImageBase [PTC_C_PSAPIIndex]);
|
|
}
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
//
|
|
//////////////////////////////////////////////////
|
|
BOOL PTC_fn_bVerifyOneImportedFunctionPtr()
|
|
{
|
|
DWORD dwRandomImageBase = PTC_fn_dwGetRandomDLLImageBase ();
|
|
|
|
if (dwRandomImageBase)
|
|
{
|
|
DWORD dwRandomFunctionPtr = PTC_fn_lGetRandomRange (0 , PTC_g_dwImportedFunctionsNumber);
|
|
DWORD dwKey = *((DWORD*) PTC_ga_stImportedFunctions [dwRandomFunctionPtr] . szName);
|
|
DWORD dwAddress = PTC_ga_stImportedFunctions [dwRandomFunctionPtr] . dwAddress;
|
|
DWORD dwAddressFounded = dwGetImportedFunctionEntryFromImageBase (dwRandomImageBase , PTC_fn_szGetFunctionExplicitName(dwRandomFunctionPtr));
|
|
DWORD dwPtrFounded = ( dwAddressFounded ? *((DWORD*)dwAddressFounded) : 0L);
|
|
|
|
if (dwPtrFounded && dwAddress && ((dwAddress ^ dwKey) != dwPtrFounded))
|
|
{
|
|
PTC_g_lProtectError = 1;
|
|
return FALSE;
|
|
}
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
//
|
|
//////////////////////////////////////////////////
|
|
long PTC_fn_lGetCheckSum(DWORD dwBeginAddr, DWORD dwEndAddr);
|
|
|
|
|
|
void PTC_fn_vInitChecksum()
|
|
{
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionDelete(0,PTC_fn_vInitChecksum);
|
|
return;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_vInitChecksum)
|
|
|
|
memset (PTC_g_dwBeginLabelAddress , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwEndLabelAddress , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwChecksum , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwBeginLabelAddressDelete , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwEndLabelAddressDelete , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
|
|
//
|
|
PTC_g_bTakeAddresses = TRUE;
|
|
|
|
// Compute Checksum
|
|
SNA_fn_bGetHandleToRelocationTable (NULL); /* 0 */
|
|
SNA_fn_bGetHandleToRelocationTableInBigFile (NULL); /* 1 */
|
|
PTC_fn_vInit (TRUE); /* 2 */
|
|
PTC_fn_dwSearchExportedFunctionInEveryDLL (NULL); /* 3 */
|
|
PTC_fn_dwSearchExportedFunctionInEveryDLLOnNT (NULL); /* 4 */
|
|
PTC_fn_dwSearchExportedFunctionInEveryDLLOnW95W98 (NULL); /* 5 */
|
|
PTC_fn_vUpdateCurrentSystem (); /* 6 */
|
|
PTC_fn_hGetKernel32Handle (); /* 7 */
|
|
PTC_fn_vGetGetModuleHandleA (TRUE); /* 8 */
|
|
PTC_fn_dwSearchFunctionInImportedTableOfExe (NULL); /* 9 */
|
|
|
|
// Get addresses for delete
|
|
PTC_fn_vInitChecksum (); /* 0 */
|
|
PTC_fn_vComputeAndWriteChecksumFile (); /* 1 */
|
|
PTC_fn_lGetCheckSum (0,0); /* 2 */
|
|
WinMain (NULL,NULL,NULL,0); /* 3 & 4 */
|
|
|
|
//
|
|
PTC_g_bTakeAddresses = FALSE;
|
|
//
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_vInitChecksum)
|
|
|
|
return;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
//
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vComputeAndWriteChecksumFile()
|
|
{
|
|
DWORD *p_dwBeginAddress;
|
|
DWORD *p_dwEndAddress;
|
|
FILE *pFile;
|
|
DWORD i;
|
|
DWORD dwOffsetBegin , dwOffsetEnd , dwOffset;
|
|
char szText[255];
|
|
long lCheckSum;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionDelete(1,PTC_fn_vComputeAndWriteChecksumFile);
|
|
return;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_vComputeAndWriteChecksumFile)
|
|
|
|
// Checksum List
|
|
pFile = fopen ("CheckSum.lst" , "wt");
|
|
if (pFile)
|
|
{
|
|
i = 0;
|
|
dwOffset = (DWORD)PTC_GetModuleHandle(NULL);
|
|
p_dwBeginAddress = PTC_g_dwBeginLabelAddress;
|
|
p_dwEndAddress = PTC_g_dwEndLabelAddress;
|
|
while (*p_dwBeginAddress && *p_dwEndAddress)
|
|
{
|
|
lCheckSum = PTC_fn_lGetCheckSum(*p_dwBeginAddress , *p_dwEndAddress);
|
|
dwOffsetBegin = *p_dwBeginAddress - dwOffset;
|
|
dwOffsetEnd = *p_dwEndAddress - dwOffset;
|
|
sprintf (szText , "%i - Begin: 0x%08x End: 0x%08x Checksum: 0x%08x\n" , i , dwOffsetBegin , dwOffsetEnd , lCheckSum);
|
|
fprintf (pFile , "%i - Begin: 0x%08x End: 0x%08x Checksum: 0x%08x\n" , i , dwOffsetBegin , dwOffsetEnd , lCheckSum);
|
|
|
|
p_dwBeginAddress++;
|
|
p_dwEndAddress++;
|
|
i++;
|
|
}
|
|
fclose (pFile);
|
|
}
|
|
|
|
// Delete List
|
|
pFile = fopen ("Delete.lst" , "wt");
|
|
if (pFile)
|
|
{
|
|
i = 0;
|
|
dwOffset = (DWORD)PTC_GetModuleHandle(NULL);
|
|
p_dwBeginAddress = PTC_g_dwBeginLabelAddressDelete;
|
|
p_dwEndAddress = PTC_g_dwEndLabelAddressDelete;
|
|
while (*p_dwBeginAddress && *p_dwEndAddress)
|
|
{
|
|
dwOffsetBegin = *p_dwBeginAddress - dwOffset;
|
|
dwOffsetEnd = *p_dwEndAddress - dwOffset;
|
|
sprintf (szText , "%i - Begin: 0x%08x End: 0x%08x \n" , i , dwOffsetBegin , dwOffsetEnd);
|
|
fprintf (pFile , "%i - Begin: 0x%08x End: 0x%08x \n" , i , dwOffsetBegin , dwOffsetEnd);
|
|
|
|
p_dwBeginAddress++;
|
|
p_dwEndAddress++;
|
|
i++;
|
|
}
|
|
fclose (pFile);
|
|
}
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_vComputeAndWriteChecksumFile)
|
|
|
|
return;
|
|
}
|
|
|
|
#ifndef RETAIL /* { */
|
|
//////////////////////////////////////////////////
|
|
// Read CheckSum File
|
|
//////////////////////////////////////////////////
|
|
void PTC_fn_vReadChecksumFile()
|
|
{
|
|
DWORD *p_dwBeginAddress = PTC_g_dwBeginLabelAddress;
|
|
DWORD *p_dwEndAddress = PTC_g_dwEndLabelAddress;
|
|
DWORD *p_dwCheckSum = PTC_g_dwChecksum;
|
|
FILE *pFile;
|
|
DWORD dwOffsetBegin , dwOffsetEnd , dwOffset;
|
|
char szText[255];
|
|
char *p_cBegin , *p_cEnd , *p_cChecksum;
|
|
long lChecksum;
|
|
|
|
memset (PTC_g_dwBeginLabelAddress , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwEndLabelAddress , 0 , PTC_C_ChecksumTableSize * sizeof(DWORD));
|
|
memset (PTC_g_dwChecksum , 0 , PTC_C_ChecksumTableSize * sizeof(long));
|
|
|
|
pFile = fopen ("CheckSum.lst" , "rt");
|
|
if (pFile)
|
|
{
|
|
dwOffset = (DWORD)PTC_GetModuleHandle(NULL);
|
|
while (!feof(pFile))
|
|
{
|
|
if (fgets (szText , 255 , pFile))
|
|
{
|
|
p_cBegin = strstr(szText,"Begin: 0x") + strlen("Begin: 0x");
|
|
p_cEnd = strstr(szText,"End: 0x") + strlen("End: 0x");
|
|
p_cChecksum = strstr(szText,"Checksum: 0x") + strlen("Checksum: 0x");
|
|
|
|
// read dwOffsetBegin
|
|
sscanf (p_cBegin , "%x" , &dwOffsetBegin);
|
|
// read dwOffsetEnd
|
|
sscanf (p_cEnd , "%x" , &dwOffsetEnd);
|
|
// read dwChecksum
|
|
sscanf (p_cChecksum , "%x" , &lChecksum);
|
|
|
|
*p_dwBeginAddress++ = dwOffsetBegin;
|
|
*p_dwEndAddress++ = dwOffsetEnd;
|
|
*p_dwCheckSum++ = (DWORD)lChecksum;
|
|
}
|
|
}
|
|
fclose (pFile);
|
|
}
|
|
|
|
return;
|
|
}
|
|
#endif /* RETAIL } */
|
|
|
|
//////////////////////////////////////////////////
|
|
// Compute CheckSum
|
|
//////////////////////////////////////////////////
|
|
long PTC_fn_lGetCheckSum(DWORD dwBeginAddr, DWORD dwEndAddr)
|
|
{
|
|
long lResult = 0;
|
|
DWORD *dwCurrent;
|
|
|
|
/* ------------------------------------------ */
|
|
/* to get begin and end addresses of function */
|
|
if (PTC_g_bTakeAddresses)
|
|
{
|
|
PTC_M_AddFunctionDelete(2,PTC_fn_lGetCheckSum);
|
|
return (long)0;
|
|
}
|
|
/* ------------------------------------------ */
|
|
/* ------------------------------------------ */
|
|
|
|
|
|
PTC_M_DeclareBeginLabel(PTC_fn_lGetCheckSum)
|
|
|
|
if (dwBeginAddr > dwEndAddr)
|
|
{
|
|
DWORD dwTmp;
|
|
|
|
dwTmp = dwEndAddr;
|
|
dwEndAddr = dwBeginAddr;
|
|
dwBeginAddr = dwTmp;
|
|
}
|
|
|
|
dwBeginAddr -= (dwBeginAddr % 4);
|
|
dwEndAddr -= (dwEndAddr % 4);
|
|
|
|
dwCurrent = (DWORD*)dwBeginAddr;
|
|
|
|
while (dwCurrent < (DWORD*)dwEndAddr)
|
|
{
|
|
lResult += (*(long*)dwCurrent) * (*(long*)dwCurrent);
|
|
dwCurrent++;
|
|
}
|
|
|
|
PTC_M_DeclareEndLabel(PTC_fn_lGetCheckSum)
|
|
|
|
return lResult;
|
|
}
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
|
|
#ifdef _DEBUG
|
|
void PTC_fn_vTestDLLImport();
|
|
#endif
|
|
|
|
void PTC_fn_vTest()
|
|
{
|
|
#ifdef _DEBUG
|
|
PTC_fn_vTestDLLImport();
|
|
#endif
|
|
}
|
|
|
|
#ifdef _DEBUG
|
|
void PTC_fn_vTestChecksum()
|
|
{
|
|
DWORD *p_dwBeginAddress = PTC_g_dwBeginLabelAddress;
|
|
DWORD *p_dwEndAddress = PTC_g_dwEndLabelAddress;
|
|
long *p_lCheckSum = PTC_g_dwChecksum;
|
|
long lCheckSum;
|
|
DWORD dwError;
|
|
DWORD dwOffset;
|
|
|
|
// read checksum in file
|
|
PTC_fn_vReadChecksumFile ();
|
|
|
|
// verify
|
|
dwOffset = (DWORD)PTC_GetModuleHandle(NULL);
|
|
dwError = 0;
|
|
while (*p_dwBeginAddress && *p_dwEndAddress)
|
|
{
|
|
lCheckSum = PTC_fn_lGetCheckSum(*p_dwBeginAddress + dwOffset, *p_dwEndAddress + dwOffset);
|
|
if (lCheckSum != *p_lCheckSum)
|
|
dwError++;
|
|
p_dwBeginAddress++;
|
|
p_dwEndAddress++;
|
|
p_lCheckSum++;
|
|
}
|
|
if (dwError)
|
|
MessageBox(NULL , "Error on checksum" , "ERROR" , MB_OK + MB_ICONEXCLAMATION);
|
|
else
|
|
MessageBox(NULL , "No Error on checksum" , "GOOD" , MB_OK + MB_ICONINFORMATION);
|
|
}
|
|
|
|
void PTC_fn_vTestDLLImport()
|
|
{
|
|
DWORD dwIndex;
|
|
DWORD dwTest , dwOK , dwNo;
|
|
|
|
dwTest = dwOK = dwNo = 0;
|
|
|
|
for (dwIndex = 1 ; dwIndex < PTC_g_dwImportedFunctionsNumber ; dwIndex++)
|
|
{
|
|
PTC_tdstImportedFunction *p_stIF = PTC_ga_stImportedFunctions + dwIndex;
|
|
DWORD dwIdx;
|
|
DWORD dwAddress;
|
|
DWORD dwKey = *((DWORD*) p_stIF -> szName);
|
|
/*
|
|
for (dwIdx = 0 ; dwIdx < 5 ; dwIdx++)
|
|
{
|
|
if ((p_stIF -> lOtherDLLIndex [dwIdx] != 0) && PTC_ga_dwLinkedDLLImageBase [p_stIF -> lOtherDLLIndex [dwIdx]])
|
|
{
|
|
DWORD dwKey = *((DWORD*) p_stIF -> szName);
|
|
DWORD dwAddress = p_stIF -> dwAddress;
|
|
DWORD dwAddressFounded = dwGetImportedFunctionEntryFromImageBase (PTC_ga_dwLinkedDLLImageBase [p_stIF -> lOtherDLLIndex [dwIdx]] , PTC_fn_szGetFunctionExplicitName(dwIndex));
|
|
DWORD dwPtrFounded = ( dwAddressFounded ? *((DWORD*)dwAddressFounded) : 0L);
|
|
|
|
dwTest++;
|
|
if (dwPtrFounded && dwAddress && ((dwAddress ^ dwKey) != dwPtrFounded))
|
|
{
|
|
PTC_g_lProtectError = 1;
|
|
dwNo++;
|
|
}
|
|
else
|
|
{
|
|
PTC_g_lProtectError = -1;
|
|
dwOK++;
|
|
}
|
|
}
|
|
}
|
|
*/
|
|
dwIdx = PTC_fn_dwSearchExportedFunctionInEveryDLL(PTC_fn_szGetFunctionExplicitName(dwIndex));
|
|
|
|
dwAddress = PTC_fn_dwSearchFunctionInImportedTableOfExe(PTC_fn_szGetFunctionExplicitName(dwIndex));
|
|
if (dwAddress)
|
|
{
|
|
dwTest++;
|
|
if( dwAddress == (p_stIF -> dwAddress ^ dwKey)) dwOK++; else dwNo++;
|
|
}
|
|
}
|
|
}
|
|
|
|
#endif
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
//////////////////////////////////////////////////
|
|
#endif // PTC_SYSTEM_ACTIVED }
|