1+ using Shellcodevv ;
2+ using System ;
3+ using System . Collections . Generic ;
4+ using System . Diagnostics ;
5+ using System . Runtime . InteropServices ;
6+
7+ namespace Shellcodev
8+ {
9+ public class API
10+ {
11+ #region Structures
12+ [ StructLayout ( LayoutKind . Sequential ) ]
13+ public struct Registers
14+ {
15+ public int eax ;
16+ public int ebx ;
17+ public int ecx ;
18+ public int edx ;
19+ public int esi ;
20+ public int edi ;
21+ public int eip ;
22+ public int esp ;
23+ public int ebp ;
24+ }
25+ [ StructLayout ( LayoutKind . Sequential ) ]
26+ public struct PROCESS_INFORMATION
27+ {
28+ public IntPtr hProcess ;
29+ public IntPtr hThread ;
30+ public Int32 dwProcessID ;
31+ public Int32 dwThreadID ;
32+ }
33+
34+ [ StructLayout ( LayoutKind . Sequential ) ]
35+ public struct SECURITY_ATTRIBUTES
36+ {
37+ public Int32 Length ;
38+ public IntPtr lpSecurityDescriptor ;
39+ public bool bInheritHandle ;
40+ }
41+
42+ public enum SECURITY_IMPERSONATION_LEVEL
43+ {
44+ SecurityAnonymous ,
45+ SecurityIdentification ,
46+ SecurityImpersonation ,
47+ SecurityDelegation
48+ }
49+ [ StructLayout ( LayoutKind . Sequential ) ]
50+ public struct STARTUPINFO
51+ {
52+ public Int32 cb ;
53+ public string lpReserved ;
54+ public string lpDesktop ;
55+ public string lpTitle ;
56+ public Int32 dwX ;
57+ public Int32 dwY ;
58+ public Int32 dwXSize ;
59+ public Int32 dwXCountChars ;
60+ public Int32 dwYCountChars ;
61+ public Int32 dwFillAttribute ;
62+ public Int32 dwFlags ;
63+ public Int16 wShowWindow ;
64+ public Int16 cbReserved2 ;
65+ public IntPtr lpReserved2 ;
66+ public IntPtr hStdInput ;
67+ public IntPtr hStdOutput ;
68+ public IntPtr hStdError ;
69+ }
70+ #endregion
71+
72+ [ DllImport ( "instrHandler_x86.dll" , CharSet = CharSet . Ansi , CallingConvention = CallingConvention . Cdecl ) ]
73+ public static extern IntPtr AssembleInstructions ( string instruction ) ;
74+
75+ [ DllImport ( "instrHandler_x86.dll" , CharSet = CharSet . Ansi , CallingConvention = CallingConvention . Cdecl ) ]
76+ public static unsafe extern IntPtr GetRegisters ( string instruction , PROCESS_INFORMATION * pi ) ;
77+
78+ [ DllImport ( "kernel32.dll" ) ]
79+ public static extern bool CreateProcess ( string lpApplicationName , string lpCommandLine , IntPtr lpProcessAttributes , IntPtr lpThreadAttributes ,
80+ bool bInheritHandles , uint dwCreationFlags , IntPtr lpEnvironment ,
81+ string lpCurrentDirectory , ref STARTUPINFO lpStartupInfo , out PROCESS_INFORMATION lpProcessInformation ) ;
82+
83+ [ DllImport ( "kernel32.dll" ) ]
84+ public static extern IntPtr LoadLibrary ( string name ) ;
85+
86+ [ DllImport ( "kernel32.dll" ) ]
87+ public static extern IntPtr OpenProcess ( int dwDesiredAccess , bool bInheritHandle , int dwProcessId ) ;
88+
89+ [ DllImport ( "kernel32.dll" , CharSet = CharSet . Auto ) ]
90+ public static extern IntPtr GetModuleHandle ( string lpModuleName ) ;
91+
92+ [ DllImport ( "kernel32.dll" , CharSet = CharSet . Ansi , ExactSpelling = true , SetLastError = true ) ]
93+ public static extern IntPtr GetProcAddress ( IntPtr hModule , string procName ) ;
94+
95+ [ DllImport ( "kernel32.dll" , SetLastError = true , ExactSpelling = true ) ]
96+ public static extern IntPtr VirtualAllocEx ( IntPtr hProcess , IntPtr lpAddress , uint dwSize , uint flAllocationType , uint flProtect ) ;
97+
98+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
99+ public static extern bool WriteProcessMemory ( IntPtr hProcess , IntPtr lpBaseAddress , byte [ ] lpBuffer , uint nSize , out UIntPtr lpNumberOfBytesWritten ) ;
100+
101+ [ DllImport ( "kernel32.dll" ) ]
102+ public static extern IntPtr CreateRemoteThread ( IntPtr hProcess , IntPtr lpThreadAttributes , uint dwStackSize , IntPtr lpStartAddress , IntPtr lpParameter , uint dwCreationFlags , IntPtr lpThreadId ) ;
103+ }
104+
105+ public class AssemblyHandler
106+ {
107+ public string Assembler ( string instructions )
108+ {
109+ IntPtr pointer = API . AssembleInstructions ( instructions ) ;
110+ string bytes = Marshal . PtrToStringAnsi ( pointer ) ;
111+ if ( bytes == "InvalidInstruction" )
112+ return "Error!: Invalid instruction." ;
113+
114+ //SetRegisters(instructions, MainWindow.pi);
115+
116+ //Starting from 0, place space every second byte
117+ string temp = null ;
118+ for ( int i = 0 ; i < bytes . Length ; i ++ )
119+ {
120+ if ( i % 2 != 0 )
121+ temp += bytes [ i ] + " " ;
122+ else
123+ temp += bytes [ i ] ;
124+ }
125+
126+ return temp ;
127+ }
128+
129+ #region Registers
130+
131+ private void AppendRegisters ( API . Registers registers )
132+ {
133+ List < string > list = new List < string > ( ) ;
134+ string [ ] regs = { "EAX: " , "EBX: " , "ECX: " , "EDX: " } ;
135+ object [ ] r = { registers . eax , registers . ebx , registers . ecx , registers . edx } ;
136+
137+ var main = MainWindow . ReturnInstance ( ) ;
138+
139+
140+ for ( int i = 0 ; i < regs . Length ; i ++ )
141+ {
142+ int toHex = Convert . ToInt32 ( r [ i ] ) ;
143+ string hex = toHex . ToString ( "X8" ) ;
144+ list . Add ( regs [ i ] + hex ) ;
145+ }
146+
147+ string str = string . Join ( " " , list ) ;
148+ main . registersBox . AppendText ( str ) ;
149+ }
150+
151+ private void AppendIndexes ( API . Registers registers )
152+ {
153+ List < string > list = new List < string > ( ) ;
154+ string [ ] indexes = { "EDI: " , "ESI: " } ;
155+ object [ ] index = { registers . edi , registers . esi } ;
156+
157+ var main = MainWindow . ReturnInstance ( ) ;
158+
159+ for ( int i = 0 ; i < indexes . Length ; i ++ )
160+ {
161+ int toHex = Convert . ToInt32 ( index [ i ] ) ;
162+ string hex = toHex . ToString ( "X8" ) ;
163+ list . Add ( indexes [ i ] + hex ) ;
164+ }
165+
166+ string str = string . Join ( " " , list ) ;
167+ main . indexesBox . AppendText ( str ) ;
168+ }
169+
170+ private void AppendPointers ( API . Registers registers )
171+ {
172+ List < string > list = new List < string > ( ) ;
173+ string [ ] pointers = { "EIP: " , "ESP: " , "EBP: " } ;
174+ object [ ] pointer = { registers . eip , registers . esp , registers . ebp } ;
175+
176+ var main = MainWindow . ReturnInstance ( ) ;
177+
178+ for ( int i = 0 ; i < pointers . Length ; i ++ )
179+ {
180+ int toHex = Convert . ToInt32 ( pointer [ i ] ) ;
181+ string hex = toHex . ToString ( "X8" ) ;
182+ list . Add ( pointers [ i ] + hex ) ;
183+ }
184+
185+ string str = string . Join ( " " , list ) ;
186+ main . pointersBox . AppendText ( str ) ;
187+ }
188+
189+ private string Clear ( string instruction )
190+ {
191+ string [ ] split = instruction . Split ( new char [ ] { ',' , ' ' } ) ;
192+
193+ if ( split [ 0 ] == "xor" && split [ 1 ] == split [ 2 ] )
194+ return split [ 1 ] ;
195+
196+ return null ;
197+ }
198+
199+ // Absolute pain
200+ private API . Registers Configure ( API . Registers registers , API . Registers prevRegisters , string instruction )
201+ {
202+ string reg = Clear ( instruction ) ;
203+
204+ if ( registers . eax != 0 ) prevRegisters . eax = registers . eax ;
205+ else if ( registers . ebx != 0 ) prevRegisters . ebx = registers . ebx ;
206+ else if ( registers . ecx != 0 ) prevRegisters . ecx = registers . ecx ;
207+ else if ( registers . edx != 0 ) prevRegisters . edx = registers . edx ;
208+ else if ( registers . esi != 0 ) prevRegisters . esi = registers . esi ;
209+ else if ( registers . edi != 0 ) prevRegisters . edi = registers . edi ;
210+ else if ( registers . ebp != 0 ) prevRegisters . ebp = registers . ebp ;
211+
212+
213+ prevRegisters . eip = registers . eip ;
214+ prevRegisters . esp = registers . esp ;
215+
216+ switch ( reg )
217+ {
218+ case "eax" :
219+ prevRegisters . eax = 0 ;
220+ break ;
221+ case "ebx" :
222+ prevRegisters . ebx = 0 ;
223+ break ;
224+ case "ecx" :
225+ prevRegisters . ecx = 0 ;
226+ break ;
227+ case "edx" :
228+ prevRegisters . edx = 0 ;
229+ break ;
230+ case "edi" :
231+ prevRegisters . edi = 0 ;
232+ break ;
233+ case "esi" :
234+ prevRegisters . esi = 0 ;
235+ break ;
236+ case "ebp" :
237+ prevRegisters . ebp = 0 ;
238+ break ;
239+
240+ default :
241+ break ;
242+ }
243+
244+ return prevRegisters ;
245+ }
246+
247+ public unsafe void SetRegisters ( string instruction , API . PROCESS_INFORMATION pi )
248+ {
249+ IntPtr pointer = API . GetRegisters ( instruction , & pi ) ;
250+ API . Registers registers = Marshal . PtrToStructure < API . Registers > ( pointer ) ;
251+
252+ MainWindow . registers = Configure ( registers , MainWindow . registers , instruction ) ;
253+
254+ //AppendRegisters(Main.registers);
255+ //AppendIndexes(Main.registers);
256+ //AppendPointers(Main.registers);
257+ }
258+ #endregion
259+ }
260+
261+ public class ShellcodeLoader
262+ {
263+ public ShellcodeLoader ( byte [ ] shellcode )
264+ {
265+ int pid = Process . Start ( "notepad.exe" ) . Id ;
266+ IntPtr pHandle = API . OpenProcess ( 0x1F0FFF , false , pid ) ;
267+
268+ IntPtr memAlloc = API . VirtualAllocEx ( pHandle , IntPtr . Zero , ( uint ) shellcode . Length , 0x00001000 , 0x40 ) ;
269+
270+ UIntPtr bytesWritten ;
271+ API . WriteProcessMemory ( pHandle , memAlloc , shellcode , ( uint ) shellcode . Length , out bytesWritten ) ;
272+
273+ API . CreateRemoteThread ( pHandle , IntPtr . Zero , 0 , memAlloc , IntPtr . Zero , 0 , IntPtr . Zero ) ;
274+ }
275+ }
276+ }
0 commit comments