def __set_rva_delta(self, header_offset):
"""
:param header_offset:
:return: This class returns nothing. It is meant to check if it is possible to write the new header between the last header and the first section.
"""
#The header is smaller than this but this is adjusted and therefore padded to file alignment. The next section starts right after
current_size_of_headers = MultiByteHandler.get_dword_given_offset(
self.binary_data, header_offset +
Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_HEADERS)
new_size_of_headers_unpadded = current_size_of_headers + Win32BinaryOffsetsAndSizes.SIZE_OF_SECTION_HEADER
padding_for_new_header = Win32BinaryUtils.compute_padding_size_for_file_alignment(
self.binary_data, header_offset, new_size_of_headers_unpadded)
self.header_padding = padding_for_new_header
new_size_of_headers = new_size_of_headers_unpadded + padding_for_new_header
#I have to check if the RAW size of the header crosses the RVA for the text section. For now, i can ignore. However i need to pad the header.
rva_for_first_section = MultiByteHandler.get_dword_given_offset(
self.binary_data, header_offset +
Win32BinaryOffsetsAndSizes.OFFSET_TO_BEGINNING_OF_SECTION_HEADERS +
Win32BinaryOffsetsAndSizes.
OFFSET_TO_SECTION_RVA_WITHIN_SECTION_HEADER)
if new_size_of_headers > rva_for_first_section:
print(
"Added section crossing RVA for first section. This mode will not work. Leaving..."
)
sys.exit(1)
'''
#virtual_rva_delta = Win32BinaryUtils.compute_padding_size_for_section_alignment(self.binary_data, header_offset, new_size_of_headers)
#self.rva_delta = new_size_of_headers + virtual_rva_delta - rva_for_first_section
'''
return
def __file_align_shell_code(self, header_offset, jump_displacement):
non_padded_shell_code = self.shell_code_generator.get_base_shell_code(
jump_displacement)
padding_size = Win32BinaryUtils.compute_padding_size_for_file_alignment(
self.binary_data, header_offset, len(non_padded_shell_code))
padded_shell_code = self.shell_code_generator.get_padded_shell_code(
padding_size)
self.shell_code = padded_shell_code
def __file_align_shellcode(self, header_offset, raw_offset_of_header_of_section_containing_entrypoint, entrypoint_raw_section_size, jump_displacement):
"""
:param header_offset:
:param raw_offset_of_header_of_section_containing_entrypoint:
:param entrypoint_raw_section_size:
:param jump_displacement: this is the difference between the RVA for the shellcode and the rva for the endpoint. This is used to create shellcode
with a negative jump, i.e., the shellcode executes and then jumps to the entrypoint.
:return: This function is used to create a parametrized and padded shellcode.
"""
default_shell_code = self.shell_code_generator.get_base_shell_code(jump_displacement)
raw_offset_of_entrypoint_section = MultiByteHandler.get_dword_given_offset(self.binary_data, raw_offset_of_header_of_section_containing_entrypoint + Win32BinaryOffsetsAndSizes.OFFSET_TO_SECTION_RAW_OFFSET_WITHIN_SECTION_HEADER)
minimum_raw_offset_for_next_section = raw_offset_of_entrypoint_section + entrypoint_raw_section_size + len(default_shell_code)
padding_size = Win32BinaryUtils.compute_padding_size_for_file_alignment(self.binary_data, header_offset, minimum_raw_offset_for_next_section)
padded_shell_code = self.shell_code_generator.get_padded_shell_code(padding_size)
self.shell_code = padded_shell_code
def __adjust_windows_specific_headers(self, header_offset, new_section_rva,
new_section_virtual_size):
# SizeOfImage
size_of_image_offset = header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_IMAGE
potentially_unaligned_size_of_image = new_section_rva + new_section_virtual_size
aligned_size_of_image = potentially_unaligned_size_of_image + Win32BinaryUtils.compute_padding_size_for_section_alignment(
self.binary_data, header_offset,
potentially_unaligned_size_of_image)
MultiByteHandler.set_dword_given_offset(self.binary_data,
size_of_image_offset,
aligned_size_of_image)
# SifeOfHeaders
size_of_headers_offset = header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_HEADERS
current_size_of_headers = MultiByteHandler.get_dword_given_offset(
self.binary_data, size_of_headers_offset)
updated_size_of_headers = current_size_of_headers + Win32BinaryOffsetsAndSizes.SIZE_OF_SECTION_HEADER
padding = Win32BinaryUtils.compute_padding_size_for_file_alignment(
self.binary_data, header_offset, updated_size_of_headers)
MultiByteHandler.set_dword_given_offset(
self.binary_data, size_of_headers_offset,
updated_size_of_headers + padding)