| QUOTE (Мойша Бескозыркин @ 03.10.12 - 16:55) | | QUOTE (onehalf3554 @ 03.10.12 - 20:46) | | QUOTE (Мойша Бескозыркин @ 03.10.12 - 16:36) | | QUOTE (onehalf3554 @ 03.10.12 - 20:00) | | QUOTE (Мойша Бескозыркин @ 03.10.12 - 15:59) | | гамарджоба геноцвалы |
О!!!Дарагой Моисей!Превед! Как там дела у Цили? Много ли кредитов взяла?
|
говорит нашла паспорт один, 5 кредитов на него взяла. в паспорте записан тритон дизирович ванхалвян :ph34r:
|
а мне из альфабанка звонят кажный день, спрашивают кем мне приходиться Циля Моисеевна Бескозыркина.Незнаю чё и отвечать теперь :'(
|
она сказала, что брала кредиты вообще-то в втб24 :ph34r:
|
значит а альфе перекредитовала то, что брала в ВТБ,
всё ещё хуже. :'(
2Kruso чего множко? Ну например вот этого:
| CODE |
implantator::implantator():RVAEntryPoint(0),ImageBase(0),hProcess(0)
{
ic.push_command = 0xCC;//0x55;
ic.mov_command[0]= 0x8B;
ic.mov_command[1]= 0xEC;
ic.jmp_command[0]= 0xE9;
ic.jmp_command[1]= 0xFB;
ic.jmp_command[2]= 0xFF;
ic.jmp_command[3]= 0xFF;
ic.jmp_command[4]= 0xFF;
ic.push_arg_command[0] = 0x68;
ic.call_command[0] = 0xFF;
ic.call_command[1] = 0x15;
ic.jz_command[0] = 0x74;
ic.jz_command[1] = 0x05;
ic.test_command[0] = 0x85;
ic.test_command[1] = 0xC0;
ic.mov_mem[0] = 0x66;
ic.mov_mem[1] = 0xA3;
ic.mov_eax[0] = 0xB8;
ic.mov_eax[1] = 0x01;
ic.mov_eax[2] = 0x00;
ic.mov_eax[3] = 0x00;
ic.mov_eax[4] = 0x00;
Buffer = NULL;
memset(InjectDllName,0,MAX_PATH);
}
void implantator::add_fun(DWORD Offset,char *HintName)
{
/*
Генерация комманды call LoadLibrary
ее байт код будет помещен в массив
BYTE call_command[]
*/
m_calls_param[HintName]=new LOOKUP_AND_CALLOFFSET;
m_calls_param[HintName]->dw_OffsetForCall = Offset;
m_calls_param[HintName]->HintName=HintName;
map_indexator.push_back(HintName);
for (int i=0;i<4;i++){
ic.call_command[i+2] =m_calls_param[HintName]->btOffsetForCall[i];
printf("m_calls_param[HintName]->btOffsetForCall[%d] = %x\n",i,m_calls_param[HintName]->btOffsetForCall[i]);
}
}
void implantator::add_inject_dll_name(string DllName)
{
if (DllName.length()<MAX_PATH)
strncpy(this->InjectDllName,DllName.c_str(),DllName.length());
}
void implantator::add_rva_entry(DWORD RVAEntryPoint)
{
this->RVAEntryPoint = RVAEntryPoint;
}
void implantator::add_image(DWORD ImageBase)
{
this->ImageBase = ImageBase;
}
void implantator::add_handle(HANDLE hProcess)
{
this->hProcess = hProcess;
}
void implantator::add_hThread(HANDLE hThread)
{
this->hThread = hThread;
}
void implantator::ProcessCodeProtectionDisable(void)
{
void *Write_Ptr =reinterpret_cast<void *>(this->ImageBase + this->RVAEntryPoint);
VirtualProtectEx(this->hProcess,
Write_Ptr,
sizeof(imp_commands)+5+strlen(this->InjectDllName)+3,
PAGE_EXECUTE_READWRITE,
&Old_p);
}
void implantator::ProcessCodeProtectionEnable(void)
{
void *Write_Ptr =reinterpret_cast<void *>(this->ImageBase + this->RVAEntryPoint);
VirtualProtectEx(this->hProcess,
Write_Ptr,
sizeof(imp_commands)+
5+strlen(this->InjectDllName)+3,
Old_p,
&Old_p);
}
void
implantator::
Generate(std::vector<BYTE>& OutBuffer)
{
//this->ProcessCodeProtectionDisable();
union
{
DWORD dwd_void;
BYTE bt_void[4];
};
this->Buffer = new BYTE[sizeof(imp_commands)+5+strlen(this->InjectDllName)+3];
ZeroMemory(Buffer,sizeof(imp_commands)+5+strlen(this->InjectDllName)+3);
void *Write_Ptr = NULL;
Write_Ptr =reinterpret_cast<void *>(this->ImageBase + this->RVAEntryPoint);
ReadProcessMemory(this->hProcess,
Write_Ptr,
Buffer,
sizeof(imp_commands)+5+strlen(this->InjectDllName)+3,
NULL);
dwd_void = (this->ImageBase + this->RVAEntryPoint)+sizeof(imp_commands);
ic.mov_mem[2] = bt_void[0];
ic.mov_mem[3] = bt_void[1];
ic.mov_mem[4] = bt_void[2];
ic.mov_mem[5] = bt_void[3];
char NullBuff[2] = {0x00,0x00};
this->FlagAddress = dwd_void;
Write_Ptr = reinterpret_cast<void*>(dwd_void);
WriteProcessMemory(this->hProcess,
Write_Ptr,
NullBuff,
2,
NULL);
dwd_void = (this->ImageBase + this->RVAEntryPoint)+sizeof(imp_commands)+2;
ic.push_arg_command[1] = bt_void[0];
ic.push_arg_command[2] = bt_void[1];
ic.push_arg_command[3] = bt_void[2];
ic.push_arg_command[4] = bt_void[3];
OutBuffer.clear();
OutBuffer.resize(sizeof(ic));
RtlZeroMemory(&OutBuffer[0],OutBuffer.size());
RtlCopyMemory(&OutBuffer[0],&ic,sizeof(ic));
/** Write_Ptr =reinterpret_cast<void *>(this->ImageBase + this->RVAEntryPoint);
WriteProcessMemory(this->hProcess,
Write_Ptr,
&ic,
sizeof(imp_commands),
NULL);
Write_Ptr =reinterpret_cast<void *>(dwd_void);
WriteProcessMemory(this->hProcess,
Write_Ptr,
InjectDllName,
strlen(this->InjectDllName)+1,
NULL);
ProcessCodeProtectionEnable();
*/}
void implantator::RestoreContextProcess(void)
{
this->ProcessCodeProtectionDisable();
CONTEXT Context;
ZeroMemory(&Context,sizeof(Context));
Context.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL;
GetThreadContext(this->hThread,&Context);
Context.Eip =this->ImageBase+this->RVAEntryPoint;
SetThreadContext(this->hThread,&Context);
ProcessCodeProtectionEnable();
}
void implantator::RestorePECode(void)
{
ProcessCodeProtectionDisable();
void *Write_Ptr = NULL;
Write_Ptr =reinterpret_cast<void *>(this->ImageBase + this->RVAEntryPoint);
WriteProcessMemory(this->hProcess,
Write_Ptr,
Buffer,
sizeof(imp_commands)+5+strlen(this->InjectDllName)+3,
NULL);
ProcessCodeProtectionEnable();
}
|
достаточно?
|
Доброе утро! [часть 2], продолжение популярной темы
Страницы: (1224) « Первая ... 747 748 749 750 751 752 753 754 755 756 757 758 [759] 760 761 762 763 764 765 766 767 768 769 770 771 ...
Последняя »
