ZFX + Developia

Code: Alles auswählen

-- updated by Krishty 2018
-- do not remove debug directory (I want that for debugging)
-- do not remove strong name signature
-- fixed file name

-- © 2008 Daniel Pistelli. All rights reserved.
-- Header Pack Script Version: 1.0.0.1

-- This neat little script does the following:
--
-- packs the dos header + PE header + section headers
-- removes useless things like the Rich Signature
-- removes linker references inside the PE header
-- strips the debug information (if any) from the PE
-- if it's a .NET, removes Strong Name Signature
-- updates checksum

-- shows an invalid PE Msgbox
function InvPEMsg()
	MsgBox("The current file seems to be an invalid PE. Cannot proceed!",
		strScriptName, MB_ICONEXCLAMATION)
end

-- --------------------------------------------------
-- the main code starts here
-- --------------------------------------------------

strScriptName = "Header Pack Script 1.0.0.1 - by Daniel Pistelli"

filename = @"test.exe"

local hPE = OpenFile(filename)

if hPE == null then
	MsgBox("Couldn't open file.", "Error", MB_ICONEXCLAMATION)
	return
end

local OptHdrOffset = GetOffset(hPE, PE_OptionalHeader)

if OptHdrOffset == null then
	InvPEMsg()
	return
end

-- --------------------------------------------------
-- START PROCESSING
-- --------------------------------------------------

-- PACK HEADERS

do
	local SecrHdrsOffset = GetOffset(hOriginalPE, PE_SectionHeaders)
	
	local SizeOfSections = GetNumberOfSections(hPE) 
		* IMAGE_SIZEOF_SECTION_HEADER
		
	local FileHdrOffset = GetOffset(hPE, PE_FileHeader)
	
	local SizeOfOptionalHdr = ReadWord(hPE, FileHdrOffset + 16)
	
	local SizeOfPEHeader = 4 + 20 + SizeOfOptionalHdr;
	
	local PEHdrOffset = GetOffset(hPE, PE_NtHeaders)
	
	-- we assume that the PE header comes right after
	-- the Dos header, this is a normal PE
	
	FillBytes(hPE, 0x40, PEHdrOffset - 0x40, 0)
	
	-- move headers
	
	local HeadersSize = SizeOfPEHeader + SizeOfSections
	
	local PEHdrAndSects = ReadBytes(hPE, PEHdrOffset, HeadersSize)
	
	FillBytes(hPE, PEHdrOffset, HeadersSize, 0)
	
	WriteBytes(hPE, 0x40, PEHdrAndSects, HeadersSize)
	
	-- e_lfanew
	WriteDword(hPE, 0x3C, 0x40)
	
	OptHdrOffset = GetOffset(hPE, PE_OptionalHeader)
	
end

-- REMOVE LINKER REF

do

	WriteWord(hPE, OptHdrOffset + 2, 0x0000) 

end

-- UPDATE CHECKSUM

UpdateChecksum(hPE)

-- SAVE FILE

SaveFile(hPE)

Code: Alles auswählen

// replace char16_t with wchar_t, UCount with size_t, toBeginningOf() with std::begin(), and #define WIN32_SHOULD_SUCCEED(CALL) CALL

// Captures the current call stack (excluding this call) as a zero-terminated string.
//  • writes an empty string on failure
//  • layout:
//     our program.exe                  +56789ABC
//     <unknown module>
//     Kernel32.dll                     +56789ABC
//     MaximalLengthIs32CharactersPerF… +56789ABC
//     …
//  • up to 16 entries
void captureCallStack(char16_t result[16 * 45 + 1]) {
	auto toEndOfText = result;

	// Capture the raw call stack:
	void * stackPointers[16];
	auto       toCall = toBeginningOf(stackPointers);
	auto const toEnd  = toCall + RtlCaptureStackBackTrace(1, CAPACITY_OF(stackPointers), stackPointers, nullptr);
	do {
		if(nullptr == *toCall) {
			break; // “GetModuleHandleExW()” does not accept “nullptr”
		}

		// The addresses are useless with Address Space Layout Randomization – instead, get an offset into the module:
		//  • “GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS” allows to pass a code address instead of a string
		//  • “GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT” prevents taking a new reference to the module
		Module * toModule;
		if(WIN32_SHOULD_SUCCEED(GetModuleHandleExW(6, static_cast<char16_t const *>(*toCall), &toModule))) {

			char16_t path[260];
#			if TARGET_OS_VERSION <= TARGET_OS_VERSION_WINDOWS_XP
				// Windows XP does not zero-terminate long paths, so allocate an additional character and zero it manually:
				auto const toEndOfName = path + WIN32_SHOULD_SUCCEED(GetModuleFileNameW(toModule, path, CAPACITY_OF(path) - 1));
				*toEndOfName = u'\0';
#			else
				auto const toEndOfName = path + WIN32_SHOULD_SUCCEED(GetModuleFileNameW(toModule, path, CAPACITY_OF(path)));
#			endif

			// From the path’s end, seek backwards until encountering either
			//  • the path’s beginning
			//  • or a forward or backward slash
			auto toName = toEndOfName;
			for(;;) {
				if(toName == toBeginningOf(path)) {
					break;
				}
				if(*toName == u'\\' || *toName == u'/') {
					++toName; // name begins after the slash
					break;
				}
				--toName;
			}
			auto const nameLength = toEndOfName - toName;

			// Copy the name:
			if(nameLength < 32) {
				toEndOfText = Text::copyUntilZero(toEndOfText, toName);
				toEndOfText = fill(toEndOfText, u' ', static_cast<UCount>(32 - nameLength));
			} else {
				toEndOfText = copyNonOverlapping(toEndOfText, toName, 31);
				*toEndOfText++ = u'\u2026'; // ellipsis
			}

			// Compute the call’s offset in the module:
			//  • always 4-B because even 64-bit Portable Executables are limited to 2³² bytes
			auto const offset = UInt4B(byteDistance(static_cast<void *>(toModule), *toCall));

			// Write the offset:
			*toEndOfText++ = u'+';
			toEndOfText = Text::toHexadecimalZeroPaddedString(toEndOfText, offset);
			*toEndOfText++ = u'\n';

		} else {
			toEndOfText = Text::copyZeroTerminated(toEndOfText, "<unknown module>\n");
		}

	} while(++toCall < toEnd);

	*toEndOfText++ = u'\0'; // we promised a zero terminator
}