[分享]年末发点代码系列（1）

实现pchunter里看起来模块都是被替换的功能。
头文件太多内容，就不发了。
实际上就是PEB LDR遍历一遍，修改一下PE的属性
获得PEB使用Ntdll的函数

#include "../Common/common.h"

namespace user

{

#define RVATOVA(_base_, _offset_) ((PUCHAR)(_base_) + (ULONG)(_offset_))

	static void mark_pe_packed(PVOID Image)

	{

		__try

		{

			PIMAGE_NT_HEADERS32 pHeaders32 = (PIMAGE_NT_HEADERS32)

				((PUCHAR)Image + ((PIMAGE_DOS_HEADER)Image)->e_lfanew);

			auto _is64 = false;

			auto image_base = reinterpret_cast<char *>(Image);

			if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386)

			{

				// 32-bit image

				//if (pHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)

				{

					DWORD old = 0;

					VirtualProtectEx(GetCurrentProcess(), pHeaders32, sizeof(IMAGE_NT_HEADERS32), PAGE_EXECUTE_READWRITE, &old);

					pHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = 1;

					pHeaders32->OptionalHeader.AddressOfEntryPoint = 0;

				}

			}

			else if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64)

			{

				// 64-bit image

				PIMAGE_NT_HEADERS64 pHeaders64 = (PIMAGE_NT_HEADERS64)

					((PUCHAR)Image + ((PIMAGE_DOS_HEADER)Image)->e_lfanew);

				//if (pHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)

				{

					DWORD old = 0;

					VirtualProtectEx(GetCurrentProcess(), pHeaders64, sizeof(IMAGE_NT_HEADERS64), PAGE_EXECUTE_READWRITE, &old);

					pHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = 1;

					pHeaders64->OptionalHeader.AddressOfEntryPoint = 0;

					_is64 = true;

				}

			}

		}

		__except (EXCEPTION_EXECUTE_HANDLER)

		{

			MessageBoxA(nullptr, "fucker", "ff", MB_OK);

		}

	}

	void mark_all_modules(PVOID Self)

	{

		NTDLL::PROCESS_BASIC_INFORMATION stInfo = { 0 };

		DWORD dwRetnLen = 0;

		DWORD dw = NTDLL::NtQueryInformationProcess(GetCurrentProcess(), NTDLL::ProcessBasicInformation, &stInfo, sizeof(stInfo), &dwRetnLen);

		PPEB pPeb = (PPEB)stInfo.PebBaseAddress;

		PLIST_ENTRY ListHead, Current;

		NTDLL::LDR_DATA_TABLE_ENTRY *pstEntry = NULL;

		ListHead = &(((PPEB)stInfo.PebBaseAddress)->Ldr->InMemoryOrderModuleList);

		Current = ListHead->Flink;

		while (Current != ListHead)

		{

			pstEntry = CONTAINING_RECORD(Current, NTDLL::LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);

			mark_pe_packed(pstEntry->DllBase);

			Current = pstEntry->InMemoryOrderLinks.Flink;

		}

	}

};

int main()

{

	user::mark_all_modules(GetModuleHandle(nullptr));

	MessageBoxA(nullptr, "test", "me", MB_OK);

    return 0;

}