update DLL

strCodeTest/strCodeTest/Debug/strCodeTest.Build.CppClean.log

@@ -1,12 +1 @@
-f:\myapp\ccremote\strcodetest\strcodetest\debug\vc141.pdb
-f:\myapp\ccremote\strcodetest\strcodetest\debug\vc141.idb
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.obj
-f:\myapp\ccremote\strcodetest\debug\strcodetest.ilk
 f:\myapp\ccremote\strcodetest\debug\strcodetest.exe
-f:\myapp\ccremote\strcodetest\debug\strcodetest.pdb
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\cl.command.1.tlog
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\cl.read.1.tlog
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\cl.write.1.tlog
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\link.command.1.tlog
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\link.read.1.tlog
-f:\myapp\ccremote\strcodetest\strcodetest\debug\strcodetest.tlog\link.write.1.tlog

strCodeTest/strCodeTest/Debug/strCodeTest.log

@@ -1,9 +1,11 @@
   strCodeTest.cpp
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(18): warning C4018: “<=”: 有符号/无符号不匹配
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(20): warning C4267: “=”: 从“size_t”转换到“char”，可能丢失数据
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(32): warning C4018: “<=”: 有符号/无符号不匹配
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(34): warning C4267: “=”: 从“size_t”转换到“char”，可能丢失数据
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(53): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
-  g:\windows kits\10\include\10.0.17763.0\ucrt\stdio.h(208): note: 参见“fopen”的声明
-g:\ccremote\ccremote\strcodetest\strcodetest\strcodetest.cpp(119): warning C4244: “参数”: 从“time_t”转换到“unsigned int”，可能丢失数据
-  strCodeTest.vcxproj -> G:\CcRemote\CcRemote\strCodeTest\Debug\strCodeTest.exe
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(38): warning C4018: “<=”: 有符号/无符号不匹配
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(40): warning C4267: “=”: 从“size_t”转换到“char”，可能丢失数据
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(52): warning C4018: “<=”: 有符号/无符号不匹配
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(54): warning C4267: “=”: 从“size_t”转换到“char”，可能丢失数据
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(73): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
+  d:\windows kits\10\include\10.0.17763.0\ucrt\stdio.h(208): note: 参见“fopen”的声明
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(139): warning C4244: “参数”: 从“time_t”转换到“unsigned int”，可能丢失数据
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(225): warning C4838: 从“int”转换到“char”需要收缩转换
+f:\myapp\ccremote\strcodetest\strcodetest\strcodetest.cpp(225): warning C4309: “初始化”: 截断常量值
+  strCodeTest.vcxproj -> F:\myapp\CcRemote\strCodeTest\Debug\strCodeTest.exe

strCodeTest/strCodeTest/Debug/strCodeTest.tlog/strCodeTest.lastbuildstate

@@ -1,2 +1,2 @@
 #TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0
-Debug|Win32|G:\CcRemote\CcRemote\strCodeTest\|
+Debug|Win32|F:\myapp\CcRemote\strCodeTest\|

strCodeTest/strCodeTest/strCodeTest.cpp

@@ -8,6 +8,26 @@
 #define SIZE 256
 
 
+
+
+bool CreateMyFile(const char* strFilePath, unsigned char *lpBuffer, size_t dwSize)
+{
+	DWORD dwWritten;
+
+	HANDLE hFile = CreateFile(strFilePath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
+	if (hFile != NULL)
+	{
+		WriteFile(hFile, (LPCVOID)lpBuffer, dwSize, &dwWritten, NULL);
+	}
+	else
+	{
+		return false;
+	}
+	CloseHandle(hFile);
+	return true;
+}
+
+
 char* crycode(char* str)
 {
 	printf("cry: %s \n", str);
@@ -165,18 +185,58 @@ int RC4Test()
 	//加密后EncryptTable会变成ChcekTable，由于加密解密使用的Key一样，因此解密时判断CheckTable一致即可
 	memcpy(ChcekTable, EncryptTable, 0x100);
 	EncryptFunc(buffer, EncryptTable, result);
+
+	
+	
+	unsigned char * buffers = (unsigned char*)malloc(sizeof(char)*result + SIZE + SIZE);
+	
+	memcpy(buffers,ChcekTable,SIZE);
+	
+	memcpy(buffers + SIZE,EncryptTable,SIZE);
+	
+	memcpy(buffers +SIZE + SIZE,buffer,result);
+	
+	CreateMyFile(".\\..\\..\\bin\\hijack\\Cc28256.dat", buffers, result + SIZE + SIZE);
+	
 	//解密
 	EncryptFunc(buffer, ChcekTable, result);
+	
+	free(buffers);
 
-
+	free(buffer);
+	
 	return 0;
 }
+
+bool ChangeAsmJmpExp()
+{
+	// .10000000: 4D                             dec          ebp                       
+	// .10000001: 5A                             pop          edx                       
+	// .10000002: E800000000                     call        .010000007 --↓1            
+	// .10000007: 5B                            1pop          ebx                       
+	// .10000008: 52                             push         edx                       
+	// .10000009: 45                             inc          ebp                       
+	// .1000000A: 55                             push         ebp                       
+	// .1000000B: 8BEC                           mov          ebp,esp                   
+	// .1000000D: 81C3F9AA0000                   add          ebx,00000AA29 ;  导出函数的偏移
+	// .10000013: FFD3                           call         ebx                       
+	// .10000015: C9                             leave                                  
+	// .10000016: C3                             retn ; 
+	char HardCode[] = {0x4D,0x5A,0xE8,0x00,0x00,0x00,0x00,0x5B,0x52,0x45,0x55,0x8B,0xEC,0x81,0xC3,0x29,0xAA,0x00,0x00,0xFF,0xD3,0xC9,0xC3};
+	int CodeLen = 0x15;
+	memcpy(buffer,HardCode,CodeLen);
+	return true;
+}
+
+
 int main()
 {
 	InitEncryptTable();
 	if (LoaderFile())
 	{
+		ChangeAsmJmpExp();
 		RC4Test();
+	
 	}
 	
 	char a[] = "kernel32";

strCodeTest/strCodeTest/strCodeTest.vcxproj

@@ -30,14 +30,14 @@
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <PlatformToolset>v141</PlatformToolset>
-    <CharacterSet>Unicode</CharacterSet>
+    <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <PlatformToolset>v141</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <CharacterSet>Unicode</CharacterSet>
+    <CharacterSet>MultiByte</CharacterSet>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>