C + + Realization Shell code example _c language

This article describes the C + + implementation of the shell code, share for everyone to reference. The specific methods are analyzed as follows:

In general, Peid is based on the signature, with Python only two lines of code, using VC to achieve so much code ....

In Python, just introduce the Pefile module, the first code specifies the database file, and the second code returns the result. Look at the Pefile official introduction bar

The following is the C + + code:

Copy Code code as follows:

void Cmypeiddlg::onbnclickedbtnopen ()
{
Get Current work Path
CString strappname;//Current Working directory
:: GetModuleFileName (NULL, Strappname.getbuffer (_max_path), _max_path);
Strappname.releasebuffer ();
int NPOs = Strappname.reversefind ('//');
Strappname = Strappname.left (NPOs + 1);

AfxMessageBox (Strappname);


File name extension filter
LPCTSTR szfilter = "EXE Files (*. EXE) |*. exe| DLL Files (*. DLL) |*. dll| All Files (*.*) |*.*| | ";

The initial directory is c:/windows, the initial selection file name is test, and the initial suffix filter is Chart Files (*.XLC)
CFileDialog Dlg (True,null, Strappname.getbuffer (_max_path), ofn_enablesizing, szfilter,null);
if (dlg. DoModal () = = Idok)
{
CString strfile = dlg. GetPathName (); Full path
GetDlgItem (Idc_edt_file)->setwindowtext (Strfile.getbuffer (_max_path));

TRACE ("/n&&&&&&&&&&&&&&&&&&&& &&&&&&&&&&&&&&&&&&&&&& &&/n ");
TRACE (strfile);
TRACE ("/n&&&&&&&&&&&&&&&&&&&& &&&&&&&&&&&&&&&&&&&&&& &&/n ");
}
}

void Cmypeiddlg::onbnclickedbtnok ()
{
GetDlgItem (Idc_edt_file)->setwindowtext ("C:\\1.exe");

Char Buf[_max_path];
ZeroMemory (buf, _max_path);
GetDlgItemText (Idc_edt_file, buf, _max_path-1);
HANDLE hfile = CreateFile (buf, Generic_read,file_share_read, NULL, open_existing,file_attribute_normal,null);
if (!hfile)
{
MessageBox ("CreateFile failed ...");
Return
}
HANDLE Hmap = createfilemapping (hfile, NULL, page_readonly, 0, 0,null);
if (!HMAP)
{
MessageBox ("Hmap failed ...");
Return
}
LPVOID lpbase = MapViewOfFile (hmap, file_map_read, 0, 0, 0);
if (!lpbase)
{
MessageBox ("Lpbase failed ...");
Return
}

DWORD Dwoep;
Image_dos_header *pdosheader = (image_dos_header*) lpbase;
Image_nt_headers *pntheader = (image_nt_headers*) ((char*) lpbase + pdosheader->e_lfanew);
Dwoep = pntheader->optionalheader.addressofentrypoint;

Pimage_section_header Psectionheader = image_first_section (Pntheader);

CString strtemp;
Strtemp.format ("%0x", Dwoep);
Setdlgitemtext (Idc_edt_oep, Strtemp.getbuffer (4));

DWORD Fileoffset;
for (int i=0; i<pntheader->fileheader.numberofsections;i++)
{
if (Dwoep >= psectionheader->virtualaddress &&
Dwoep < psectionheader->virtualaddress + psectionheader->sizeofrawdata)
{
Fileoffset = dwoep-psectionheader->virtualaddress + psectionheader->pointertorawdata;
}
psectionheader++;
}

Strtemp.empty ();
Strtemp.format ("%0x", Fileoffset);
Setdlgitemtext (Idc_edt_fileoffset, Strtemp.getbuffer (4));

Start reading signatures from file offset
CString Strbuf;
DWORD dwreaded;
SetFilePointer (hfile, fileoffset,0, File_begin);
ReadFile (hfile, Strbuf.getbuffer (), &dwreaded,null);
MessageBox (Strbuf.getbuffer (16));

Char code[] = "\x60\xe8\x03\x00\x00\x00\xe9\xeb\04\x5d\x45\x55\xc3\xe8\x01";
Char filebuf[16];
memcpy (Filebuf, Strbuf.getbuffer (16), 16);
Char ctype[20];
for (int i=0;i<16;i++)
{
if (Code[i]!=filebuf[i])
{
StrCpy (CType, "not Found");
Break
}
else if (i==15)
{
StrCpy (CType, "Aspack");
}
}
Setdlgitemtext (Idc_edt_shelltype, CType);
}

I hope this article will help you with the C + + program design.