Skip to content

Commit

Permalink
[REFACT] Removed unused code
Browse files Browse the repository at this point in the history
  • Loading branch information
hasherezade authored Jan 24, 2017
1 parent 6a9abf6 commit 60410cf
Showing 1 changed file with 1 addition and 76 deletions.
77 changes: 1 addition & 76 deletions chimera_pe/src/pe_raw_to_virtual.h
Original file line number Diff line number Diff line change
Expand Up @@ -6,82 +6,7 @@
#include "pe_hdrs_helper.h"
#include "sysutil.h"

// Map raw PE into virtual memory of remote process
bool copy_pe_to_virtual_r(BYTE* payload, SIZE_T payload_size, LPVOID baseAddress, HANDLE hProcess)
{
if (payload == NULL) return false;

IMAGE_NT_HEADERS32* payload_nt_hdr = get_nt_hrds32(payload);
if (payload_nt_hdr == NULL) {
printf("Invalid payload: %p\n", payload);
return false;
}

SIZE_T written = 0;

//copy payload's headers:
const DWORD kHdrsSize = payload_nt_hdr->OptionalHeader.SizeOfHeaders;
if (!WriteProcessMemory(hProcess, baseAddress, payload, kHdrsSize, &written)) {
return false;
}
if (written != kHdrsSize) return false;

printf("Copied payload's headers to: %p\n", baseAddress);

LPVOID secptr = &(payload_nt_hdr->OptionalHeader);
const DWORD kOptHdrSize = payload_nt_hdr->FileHeader.SizeOfOptionalHeader;

//copy all the sections, one by one:
secptr = LPVOID((ULONGLONG) secptr + kOptHdrSize);

printf("Coping sections remotely:\n");
for (WORD i = 0; i < payload_nt_hdr->FileHeader.NumberOfSections; i++) {
PIMAGE_SECTION_HEADER next_sec = (PIMAGE_SECTION_HEADER)((ULONGLONG)secptr + (IMAGE_SIZEOF_SECTION_HEADER * i));

LPVOID section_place = (BYTE*) baseAddress + next_sec->VirtualAddress;
LPVOID section_raw_ptr = payload + next_sec->PointerToRawData;

if (!WriteProcessMemory(hProcess, section_place, section_raw_ptr, next_sec->SizeOfRawData, &written)) {
return false;
}
if (written != next_sec->SizeOfRawData) return false;
printf("[+] %s to: %p\n", next_sec->Name, section_place);
}
return true;
}

// Map raw PE into virtual memory of local process:
bool copy_pe_to_virtual_l(BYTE* payload, SIZE_T payload_size, LPVOID baseAddress)
{
if (payload == NULL) return false;

IMAGE_NT_HEADERS32* payload_nt_hdr = get_nt_hrds32(payload);
if (payload_nt_hdr == NULL) {
printf("Invalid payload: %p\n", payload);
return false;
}
//copy payload's headers:
const DWORD kHdrsSize = payload_nt_hdr->OptionalHeader.SizeOfHeaders;
memcpy(baseAddress, payload, kHdrsSize);

LPVOID secptr = &(payload_nt_hdr->OptionalHeader);
const DWORD kOptHdrSize = payload_nt_hdr->FileHeader.SizeOfOptionalHeader;

//copy all the sections, one by one:
secptr = LPVOID((ULONGLONG) secptr + kOptHdrSize);

printf("Coping sections locally:\n");
for (WORD i = 0; i < payload_nt_hdr->FileHeader.NumberOfSections; i++) {
PIMAGE_SECTION_HEADER next_sec = (PIMAGE_SECTION_HEADER)((ULONGLONG)secptr + (IMAGE_SIZEOF_SECTION_HEADER * i));

LPVOID section_place = (BYTE*) baseAddress + next_sec->VirtualAddress;
LPVOID section_raw_ptr = payload + next_sec->PointerToRawData;
memcpy(section_place, section_raw_ptr, next_sec->SizeOfRawData);
printf("[+] %s to: %p\n", next_sec->Name, section_place);
}
return true;
}

bool sections_raw_to_virtual(BYTE* payload, SIZE_T destBufferSize, OUT BYTE* destAddress)
{
if (payload == NULL) return false;
Expand Down Expand Up @@ -146,4 +71,4 @@ bool sections_raw_to_virtual(BYTE* payload, SIZE_T destBufferSize, OUT BYTE* des
memcpy(section_mapped, section_raw_ptr, sec_size);
}
return true;
}
}

0 comments on commit 60410cf

Please sign in to comment.