Skip to content

Commit 4de3c02

Browse files
Sakura529Sakura529
authored
Add files via upload
1 parent df78c32 commit 4de3c02

File tree

6 files changed

+452
-0
lines changed

6 files changed

+452
-0
lines changed

‎shellcode/loader_aozhou.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.14.36212.18 d17.14
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "loader_aozhou", "loader_aozhou\loader_aozhou.vcxproj", "{DD605915-25FA-47E1-AAAA-B02896CCC5DA}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Debug|x64.ActiveCfg = Debug|x64
17+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Debug|x64.Build.0 = Debug|x64
18+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Debug|x86.ActiveCfg = Debug|Win32
19+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Debug|x86.Build.0 = Debug|Win32
20+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Release|x64.ActiveCfg = Release|x64
21+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Release|x64.Build.0 = Release|x64
22+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Release|x86.ActiveCfg = Release|Win32
23+
{DD605915-25FA-47E1-AAAA-B02896CCC5DA}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {AE7D9B62-EB5E-4252-9EB1-FC5F26AD3D38}
30+
EndGlobalSection
31+
EndGlobal

‎shellcode/loader_aozhou/1.cpp‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
#include <windows.h>
2+
#include <intrin.h>
3+
4+
#pragma warning(disable : 28251)
5+
#pragma warning(disable : 6001)
6+
#pragma warning(disable : 4201)
7+
8+
constexpr DWORD Hash(const char* functionName) {
9+
DWORD hash = 0;
10+
while (*functionName) {
11+
hash = (hash * 138) + *functionName;
12+
functionName++;
13+
}
14+
return hash;
15+
}
16+
17+
// 必要的 PEB 结构定义 (为了替代 ASM 硬编码偏移，确保稳定性)
18+
typedef struct _UNICODE_STRING {
19+
USHORT Length;
20+
USHORT MaximumLength;
21+
PWSTR Buffer;
22+
} UNICODE_STRING, * PUNICODE_STRING;
23+
24+
typedef struct _LDR_DATA_TABLE_ENTRY {
25+
LIST_ENTRY InLoadOrderLinks;
26+
LIST_ENTRY InMemoryOrderLinks;
27+
LIST_ENTRY InInitializationOrderLinks;
28+
PVOID DllBase;
29+
PVOID EntryPoint;
30+
ULONG SizeOfImage;
31+
UNICODE_STRING FullDllName;
32+
UNICODE_STRING BaseDllName;
33+
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
34+
35+
typedef struct _PEB_LDR_DATA {
36+
ULONG Length;
37+
BOOLEAN Initialized;
38+
PVOID SsHandle;
39+
LIST_ENTRY InLoadOrderModuleList;
40+
LIST_ENTRY InMemoryOrderModuleList;
41+
LIST_ENTRY InInitializationOrderModuleList;
42+
} PEB_LDR_DATA, * PPEB_LDR_DATA;
43+
44+
typedef struct _PEB {
45+
BOOLEAN InheritedAddressSpace;
46+
BOOLEAN ReadImageFileExecOptions;
47+
BOOLEAN BeingDebugged;
48+
BOOLEAN BitField;
49+
PVOID Mutant;
50+
PVOID ImageBaseAddress;
51+
PPEB_LDR_DATA Ldr;
52+
} PEB, * PPEB;
53+
54+
// 简单的宽字符转小写哈希计算 (用于模块名匹配)
55+
DWORD HashModule(PCWSTR ModuleName) {
56+
DWORD hash = 0;
57+
while (*ModuleName) {
58+
wchar_t c = *ModuleName;
59+
if (c >= 'A' && c <= 'Z') c += 32;
60+
hash = (hash * 138) + c;
61+
ModuleName++;
62+
}
63+
return hash;
64+
}
65+
66+
// 获取 PEB (替代 x64.asm GetPEB64)
67+
__forceinline PPEB GetPEB() {
68+
return (PPEB)__readgsqword(0x60);
69+
}
70+
71+
// 获取模块基址 (替代 x64.asm GetKernel32/Ntdll)
72+
HMODULE GetModuleBase(DWORD dwModuleHash) {
73+
PPEB pPeb = GetPEB();
74+
PPEB_LDR_DATA pLdr = pPeb->Ldr;
75+
PLDR_DATA_TABLE_ENTRY pDte = (PLDR_DATA_TABLE_ENTRY)pLdr->InLoadOrderModuleList.Flink;
76+
77+
while (pDte->DllBase != NULL) {
78+
if (pDte->BaseDllName.Buffer != NULL) {
79+
if (HashModule(pDte->BaseDllName.Buffer) == dwModuleHash) {
80+
return (HMODULE)pDte->DllBase;
81+
}
82+
}
83+
pDte = (PLDR_DATA_TABLE_ENTRY)pDte->InLoadOrderLinks.Flink;
84+
}
85+
return NULL;
86+
}
87+
88+
PVOID GetFuncAddrByHash(HMODULE hModule, DWORD hash) {
89+
PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)hModule;
90+
PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)((BYTE*)hModule + pDos->e_lfanew);
91+
PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((BYTE*)hModule + pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
92+
93+
PDWORD pEAT = (PDWORD)((BYTE*)hModule + pExport->AddressOfFunctions);
94+
PDWORD pENT = (PDWORD)((BYTE*)hModule + pExport->AddressOfNames);
95+
PWORD pEIT = (PWORD)((BYTE*)hModule + pExport->AddressOfNameOrdinals);
96+
97+
for (DWORD i = 0; i < pExport->NumberOfNames; i++) {
98+
char* szFuncName = (char*)((BYTE*)hModule + pENT[i]);
99+
if (Hash(szFuncName) == hash) {
100+
return (BYTE*)hModule + pEAT[pEIT[i]];
101+
}
102+
}
103+
return NULL;
104+
}
105+
106+
// 在这里定义你需要的 API
107+
108+
// 定义需要的 DLL 哈希
109+
constexpr auto HASH_KERNEL32 = Hash("kernel32.dll");
110+
constexpr auto HASH_NTDLL = Hash("ntdll.dll");
111+
// constexpr auto HASH_USER32 = Hash("user32.dll"); // 示例
112+
113+
typedef HANDLE(WINAPI* tCreateFileA)(LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
114+
typedef BOOL(WINAPI* tReadFile)(HANDLE, LPVOID, DWORD, LPDWORD, LPOVERLAPPED);
115+
typedef BOOL(WINAPI* tCloseHandle)(HANDLE);
116+
typedef VOID(WINAPI* tExitProcess)(UINT);
117+
typedef int(WINAPI* tMessageBoxA)(HWND, LPCSTR, LPCSTR, UINT);
118+
119+
typedef NTSTATUS(NTAPI* tNtAllocateVirtualMemory)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
120+
121+
typedef struct _API_TABLE {
122+
123+
tCreateFileA CreateFileA;
124+
tReadFile ReadFile;
125+
tCloseHandle CloseHandle;
126+
tExitProcess ExitProcess;
127+
128+
tNtAllocateVirtualMemory NtAllocateVirtualMemory;
129+
130+
// User32 (示例)
131+
// tMessageBoxA MessageBoxA;
132+
} API_TABLE, * PAPI_TABLE;
133+
134+
// 在这里填写需要解析的函数
135+
BOOL InitAPITable(PAPI_TABLE pApi) {
136+
HMODULE hKernel32 = GetModuleBase(HASH_KERNEL32);
137+
HMODULE hNtdll = GetModuleBase(HASH_NTDLL);
138+
139+
if (!hKernel32 || !hNtdll) return FALSE;
140+
141+
// 解析 Kernel32
142+
pApi->CreateFileA = (tCreateFileA)GetFuncAddrByHash(hKernel32, Hash("CreateFileA"));
143+
pApi->ReadFile = (tReadFile)GetFuncAddrByHash(hKernel32, Hash("ReadFile"));
144+
pApi->CloseHandle = (tCloseHandle)GetFuncAddrByHash(hKernel32, Hash("CloseHandle"));
145+
pApi->ExitProcess = (tExitProcess)GetFuncAddrByHash(hKernel32, Hash("ExitProcess"));
146+
147+
pApi->NtAllocateVirtualMemory = (tNtAllocateVirtualMemory)GetFuncAddrByHash(hNtdll, Hash("NtAllocateVirtualMemory"));
148+
149+
if (!pApi->CreateFileA || !pApi->NtAllocateVirtualMemory) return FALSE;
150+
151+
return TRUE;
152+
}
153+
// PIC 逻辑
154+
155+
void UserLogic(PAPI_TABLE pApi) {
156+
// -----------------------------------------------------------
157+
// 1. 不要使用全局变量
158+
// 2. 字符串必须定义为栈数组 (Stack Strings)
159+
// 3. 不要直接调用系统 API，必须通过 pApi->调用
160+
// -----------------------------------------------------------
161+
162+
// 示例：定义文件名 "work.bin"
163+
volatile char szFileName[] = { 'w', 'o', 'r', 'k', '.', 'b', 'i', 'n', 0 };
164+
165+
// 示例逻辑：打开文件
166+
HANDLE hFile = pApi->CreateFileA((LPCSTR)szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
167+
168+
if (hFile != INVALID_HANDLE_VALUE) {
169+
// 分配内存
170+
PVOID buffer = NULL;
171+
SIZE_T size = 1024;
172+
pApi->NtAllocateVirtualMemory((HANDLE)-1, &buffer, 0, &size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
173+
174+
// ... 读取、执行等逻辑 ...
175+
176+
pApi->CloseHandle(hFile);
177+
}
178+
179+
// 结束 (在 Shellcode 中通常直接 ret，或者调用 ExitProcess)
180+
// pApi->ExitProcess(0);
181+
}
182+
183+
// Shellcode 入口点
184+
185+
#pragma code_seg(".text")
186+
#pragma comment(linker, "/ENTRY:ShellcodeEntry")
187+
188+
extern "C" void ShellcodeEntry() {
189+
// 1. 栈对齐 (可选，但在某些复杂场景下推荐)
190+
// 2. 初始化 API 表
191+
API_TABLE Api;
192+
193+
// 手动清零结构体 (避免链接 memset)
194+
char* p = (char*)&Api;
195+
for (int i = 0; i < sizeof(API_TABLE); i++) {
196+
p[i] = 0;
197+
}
198+
199+
if (InitAPITable(&Api)) {
200+
// 3. 执行用户逻辑
201+
UserLogic(&Api);
202+
}
203+
}

‎shellcode/loader_aozhou/loader_aozhou.vcxproj‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>17.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{dd605915-25fa-47e1-aaaa-b02896ccc5da}</ProjectGuid>
25+
<RootNamespace>loaderaozhou</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v143</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v143</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v143</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v143</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
58+
</ImportGroup>
59+
<ImportGroup Label="Shared">
60+
</ImportGroup>
61+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
62+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
63+
</ImportGroup>
64+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
65+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
66+
</ImportGroup>
67+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
68+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
69+
</ImportGroup>
70+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
71+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
72+
</ImportGroup>
73+
<PropertyGroup Label="UserMacros" />
74+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
75+
<GenerateManifest>false</GenerateManifest>
76+
<LinkIncremental>false</LinkIncremental>
77+
<EmbedManifest>false</EmbedManifest>
78+
</PropertyGroup>
79+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
80+
<ClCompile>
81+
<WarningLevel>Level3</WarningLevel>
82+
<SDLCheck>true</SDLCheck>
83+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
84+
<ConformanceMode>true</ConformanceMode>
85+
</ClCompile>
86+
<Link>
87+
<SubSystem>Console</SubSystem>
88+
<GenerateDebugInformation>true</GenerateDebugInformation>
89+
</Link>
90+
</ItemDefinitionGroup>
91+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
92+
<ClCompile>
93+
<WarningLevel>Level3</WarningLevel>
94+
<FunctionLevelLinking>true</FunctionLevelLinking>
95+
<IntrinsicFunctions>true</IntrinsicFunctions>
96+
<SDLCheck>true</SDLCheck>
97+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
98+
<ConformanceMode>true</ConformanceMode>
99+
</ClCompile>
100+
<Link>
101+
<SubSystem>Console</SubSystem>
102+
<GenerateDebugInformation>true</GenerateDebugInformation>
103+
</Link>
104+
</ItemDefinitionGroup>
105+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
106+
<ClCompile>
107+
<WarningLevel>Level3</WarningLevel>
108+
<SDLCheck>true</SDLCheck>
109+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
110+
<ConformanceMode>true</ConformanceMode>
111+
</ClCompile>
112+
<Link>
113+
<SubSystem>Console</SubSystem>
114+
<GenerateDebugInformation>true</GenerateDebugInformation>
115+
</Link>
116+
</ItemDefinitionGroup>
117+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
118+
<ClCompile>
119+
<WarningLevel>Level3</WarningLevel>
120+
<FunctionLevelLinking>true</FunctionLevelLinking>
121+
<IntrinsicFunctions>false</IntrinsicFunctions>
122+
<SDLCheck>false</SDLCheck>
123+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
124+
<ConformanceMode>false</ConformanceMode>
125+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
126+
<BufferSecurityCheck>false</BufferSecurityCheck>
127+
<WholeProgramOptimization>false</WholeProgramOptimization>
128+
<Optimization>MinSpace</Optimization>
129+
<InlineFunctionExpansion>Default</InlineFunctionExpansion>
130+
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
131+
</ClCompile>
132+
<Link>
133+
<SubSystem>Console</SubSystem>
134+
<GenerateDebugInformation>false</GenerateDebugInformation>
135+
<EntryPointSymbol>
136+
</EntryPointSymbol>
137+
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
138+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
139+
<FixedBaseAddress>false</FixedBaseAddress>
140+
<AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies>
141+
<OptimizeReferences>true</OptimizeReferences>
142+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
143+
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
144+
</Link>
145+
</ItemDefinitionGroup>
146+
<ItemGroup>
147+
<ClCompile Include="1.cpp">
148+
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</ExcludedFromBuild>
149+
</ClCompile>
150+
</ItemGroup>
151+
<ItemGroup>
152+
<MASM Include="x64.asm">
153+
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</ExcludedFromBuild>
154+
</MASM>
155+
</ItemGroup>
156+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
157+
<ImportGroup Label="ExtensionTargets">
158+
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
159+
</ImportGroup>
160+
</Project>

0 commit comments

Comments
 (0)