Method load_syms

src/shellcode.cpp:467–505

Load the obfuscated symbols at runtime.

// Load the obfuscated symbols at runtime.
VOID shellcode::load_syms(HANDLE pe_base, DWORD sh_funs_rva, DWORD syms_rva)
{
    // Calculate the pointers.
    PDWORD sh_funs = (PDWORD)((PBYTE)pe_base + sh_funs_rva);
    p_obfuscated_sym syms = (p_obfuscated_sym)((PBYTE)pe_base + syms_rva);

    // Resolving the needed functions.
    auto fun_load_dll = sh_resolve(pe_base, sh_funs, load_dll);
    auto fun_get_symbol_ptr = sh_resolve(pe_base, sh_funs, get_symbol_ptr);
    auto fun_load_halt = sh_resolve(pe_base, sh_funs, exit);
    
    // Looping on the entries.
    while (syms->dll_name)
    {
        // Calculate the pointers.
        p_obfuscated_sym p_sym = syms++;
        PCHAR c_dll_name = (PCHAR)pe_base + p_sym->dll_name;
        PVOID* p_thunk = (PVOID*)((PBYTE)pe_base + p_sym->sym_thnk);

        // Get the loaded dll handle.
        HANDLE dll_handle = fun_load_dll(pe_base, sh_funs, c_dll_name);
        if (!dll_handle)
        {
            // The dll is not loaded.
            return fun_load_halt();
        };

        // Get the symbol address.
        PVOID sym_ptr = fun_get_symbol_ptr(pe_base, sh_funs, dll_handle, p_sym->sym_info, p_sym->by_name);
        if (!dll_handle)
        {
            // The symbol is not found.
            return fun_load_halt();
        };

        // Replace the symbol thunk.
        *p_thunk = sym_ptr;
    };
};

// Used to flag the end of the functions.
VOID shellcode::funs_end() {};