API tools faq
paste
salemarsm

fake_EP_Trick

salemarsm
Feb 29th, 2020
886
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 4.33 KB | None | 0 0
raw download clone embed print report
  1. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  2. ; Fake EP trick
  3. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  4. ; The idea is simple: After loading our program, we change the loaded PE image entry point
  5. ; dynamically to another routine inside our code (In this example is a simple messagebox).
  6. ;
  7. ; So, when the reverse guy dumps it will get the changed EP and change the PE behaviour
  8. ; when the dumped file run. This is just an educational trick with PE headers for my
  9. ; students understand better the PE Format in a practical way on malware analysis classes.
  10. ;
  11. ; This trick defeats:
  12. ;       - Process Dump v2.1 (https://github.com/glmcdona/Process-Dump)
  13. ;       - OllyDumpEx
  14. ;       - Every dumper that grabs info from loaded PE header
  15. ;
  16. ; We move the file location to defeat Scylla too.
  17. ;
  18. ; SWaNk 2020 - VX
  19. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  20.  
  21. format PE GUI 4.0
  22.  
  23. entry start
  24.  
  25. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  26. ; includes
  27. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  28. include '%fasm%\INCLUDE\win32a.inc'
  29.  
  30. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  31. section '.text' code readable writeable executable
  32. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  33.         ; if the file was dumped from memory, with one tool that grab the loaded image,
  34.         ; the EP will chage to this instruction
  35.         push    0
  36.         push    szTitle
  37.         push    szFuckOff
  38.         push    0
  39.         call    [MessageBoxA]
  40.  
  41.         push    0
  42.         call    [ExitProcess]
  43.  
  44. start:
  45.         invoke GetModuleHandleA, 0                              ;get imageBase
  46.         mov     [mHandle], eax
  47.        
  48.         mov     ebx, eax                                        ;save into ebx
  49.         add     ebx, 0xa8                                       ;EP
  50.  
  51.         invoke VirtualProtect, ebx, 4, PAGE_EXECUTE_READWRITE, Old
  52.         mov     byte[ebx], 0x00                                 ;Change EP to our joke payload
  53.         invoke VirtualProtect, ebx, 4, PAGE_EXECUTE_READ, Old
  54.  
  55.         ;Now we rename the file so Scylla can't find it on disk (MoveFileA)
  56.  
  57.         invoke GetModuleFileNameA,0,szfileName, 255             ; return length in eax
  58.         add eax, szfileName                                     ; eax now is in the end of the PE filename
  59.  
  60.         ;Find for the first '\' from backwards to grab the filename
  61.         @@:
  62.         dec     eax
  63.         cmp     byte[eax],'\'            
  64.         jne     @B
  65.         inc     eax                                             ;skip slash
  66.         mov     ebx, eax                                        ;save to rename file back
  67.  
  68.         invoke MoveFileA, eax, tmpName, NULL
  69.  
  70.         ;normal behaviour, just a messagebox, if the file is dumped here the trap is set
  71.         push    0
  72.         push    szTitle
  73.         push    szExample
  74.         push    0
  75.         call    [MessageBoxA]
  76.  
  77.         ;rename to the original name
  78.  
  79.         invoke MoveFileA, tmpName, ebx, NULL
  80.  
  81.         push    0
  82.         call    [ExitProcess]
  83.  
  84. error:
  85.         push    0
  86.         call    [ExitProcess]
  87.  
  88. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  89. section '.data' data readable writeable
  90. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  91.  
  92. szExample       db      'Original file',0
  93. szFuckOff       db      'Hands off asshole',0
  94. szTitle         db      'Fake EP trick',0
  95. mHandle         dd      ?
  96. szfileName      rb      250
  97. tmpName         db      "1.exe",0
  98. Old             dd      ?
  99.  
  100. ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  101. data import
  102.         library kernel,'KERNEL32.DLL',\
  103.                 user32,'USER32.DLL'
  104.  
  105.         import user32,  MessageBoxA,'MessageBoxA'
  106.         import kernel,  ExitProcess,'ExitProcess',\
  107.                         GetModuleHandleA,'GetModuleHandleA',\
  108.                         GetModuleFileNameA,'GetModuleFileNameA',\
  109.                         MoveFileA,'MoveFileA',\
  110.                         VirtualProtect,'VirtualProtect'
  111.  
  112. end data
Advertisement
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!