既然要写个Xor的壳子,要往里面添加指令,写个加花器,很简单,2天左右搞完,还是使用我个人的LibPe库。
使用方法Usage: PaninoRecode.exe (file name) offset “code”
示例: PaninoRecode.exe test.exe 1000 "ab ab c2 d3 "
#include#include #include #include #include #include "LibPeH.h" using namespace std; int main(int prmNbr, char* prmArr[]) { //Usage: PaninoRecode.exe (file name) offset "code" char* flNm; flNm = new char[0x100]; DWORD ofst; string cdStr; char* cdRd, * cd; cdRd = (char*)malloc(0x100); memset(cdRd, 0, sizeof(cdRd)); cd = (char*)malloc(0x500); memset(cd, 0, sizeof(cd)); if (prmNbr != 4) { printf(">>> [文件名]:"); scanf("%s",flNm); printf(">>> [偏移]:"); scanf("%x", &ofst); printf(">>> [指令]:"); getline(cin, cdStr); getline(cin, cdStr); } else { strcpy(flNm, prmArr[1]); ofst = strtol(prmArr[2], NULL, 16); strcpy(cdRd, prmArr[3]); cdStr = string(cdRd); printf(">>> [文件名]:%sn",flNm); printf(">>> [偏移]:%xn",ofst ); } struct PeStrc pe=getStrc(flNm); //转化指令 char tbl[] = "0123456789ABCDEFabcdefg"; int ptr=0; for (int i = 0; i < cdStr.size(); i++) { if (strchr(tbl, cdStr[i])) { cd[ptr] = cdStr[i]; ptr++; } } cd[ptr] = ''; if (strlen(cd) % 2 == 1) { cd[ptr++] = '0'; cd[ptr] = ''; } //转换成byte数组 int sz = strlen(cd)/2; byte* bytArr = new byte[0x500]; char* strTmp; strTmp = new char[0x10]; for (int i = 0; i < strlen(cd); i+=2) { strncpy(strTmp, cd + i, 2); strTmp[2] = ''; bytArr[i / 2] = strtol(strTmp,NULL,16); } //如果使用命令行传入参数的方式,则输出指令 if (prmNbr == 4) { printf(">>> [指令]:"); for (int i = 0; i < sz; i++) { printf("%02x", bytArr[i]); } printf("n"); } //写入数据 byte* bff; bff = getBffFromStrc(pe); bffOvrwrt(bff, ofst, bytArr, sz); bffGnrt((char*)(string("New_") + string(flNm)).c_str(), bff, pe.flSz); printf(">>> 修改完成.n"); }
欢迎分享,转载请注明来源:内存溢出
评论列表(0条)