Code segment encryption

/* Your system includes */
#include <windows.h>
 
/* Declare .code as a read/write/execute segment */
#pragma section(".code",execute, read, write)
#pragma comment(linker,"/SECTION:.code,ERW")
 
/* .code segment begin (all generated executable code below will go in .code segment ) */
#pragma code_seg(".code")

 
// .stub SECTION
#pragma section(".stub", execute, read, write)
#pragma code_seg(".stub")
 
#define CODE_BASE_ADDRESS	0x15151515 // dumpbin file pointer to raw data (do not change, this will be patched by cryptor)
#define CODE_SIZE			0x14141414 // dumpbin size of Virtual memory (do not change, this will be patched by cryptor)
 
/* Decrypt .code block encrypted by cryptor */
/* In this function do not declare array to avoid security cookies checks (see http://msdn.microsoft.com/en-us/library/8dbf701c.aspx) */
/* Or disable security check (GS- option) on prog compilation */
void decryptCodeSection()
{
	unsigned char *ptr;
	long int i;
	long int nbytes;
	int cpt = 0;
	BYTE  key[] = { '1','2','3','4','5','6','7','8','\0'};/* Note: Avoid strings if you plan to encryt .rdata segment */
	int keyLength = 8;
	ptr = (unsigned char *)CODE_BASE_ADDRESS;/* This will be patched by cryptor*/
	nbytes = CODE_SIZE;/* This will be patched by cryptor*/
 
	// decrypt code segment    
    for( i = 0 ; i < nbytes ; i++ )
    {
		ptr[i]=ptr[i]^key[cpt];
		cpt = cpt + 1;
		if(cpt == keyLength)
			cpt = 0;
    }
	return;
}
 
/* Program first entry function */
int main()
{
	decryptCodeSection();
	realmain(); /* Call decrypted program entry point */
	return 0;
}

// create a data segment
#pragma section(".codedata", read, write)
// create the code section (to be decrypted)
#pragma section(".code",execute, read, write)
// Merge  .codedata into .code (which will be encrypted by cryptor)
#pragma comment(linker,"/MERGE:.codedata=.code")

// .stub SECTION
#pragma section(".stub", execute, read, write)
#pragma comment(linker,"/entry:\"ProgEntry\"") // new entry point
#pragma code_seg(".stub")
 
// decryption routine
 
/* Entry point function*/
int ProgEntry()
{
	decryptCodeSection();
	mainCRTStartup(); /* Call runtime library entry point, which will then call main */
	return 0;
}

/**
 * Get information of .code and .stub segments 
 */
void getSegmentsInfo(LPVOID baseAddress, SEGMENT_INFO_PTR codeSegmentInfo,SEGMENT_INFO_PTR stubSegmentInfo)
{
	PIMAGE_DOS_HEADER dosHeader;
	PIMAGE_NT_HEADERS peHeader;
	IMAGE_OPTIONAL_HEADER32 optionalHeader;
 
	dosHeader = (PIMAGE_DOS_HEADER)baseAddress;
	if(((*dosHeader).e_magic)!=IMAGE_DOS_SIGNATURE)
	{
		printf("getSegmentsInfo: Dos signature not matched\n");
		return;
	}
	printf("getSegmentsInfo: Dos signature=%X\n",(*dosHeader).e_magic);
 
	peHeader = (PIMAGE_NT_HEADERS)((DWORD)baseAddress+(*dosHeader).e_lfanew);
	if(((*peHeader).Signature)!=IMAGE_NT_SIGNATURE)
	{
		printf("getSegmentsInfo: PE signature not matched\n");
		return;
	}
	printf("getSegmentsInfo: PE signature=%X\n",(*peHeader).Signature);
 
	optionalHeader = (*peHeader).OptionalHeader;
	if((optionalHeader.Magic)!=0x10B)
	{
		printf("getSegmentsInfo: Optional header magic number does not match\n");
		return;
	}
	printf("getSegmentsInfo: OPtional header magic nb=%X\n",optionalHeader.Magic);
 
	(*codeSegmentInfo).moduleBase = optionalHeader.ImageBase;
	(*stubSegmentInfo).moduleBase = optionalHeader.ImageBase;
 
	printf("getSegmentsInfo: # sections=%d\n",(*peHeader).FileHeader.NumberOfSections);
 
	/* Fill code information with content of code segment */
	TraverseSectionHeaders(IMAGE_FIRST_SECTION(peHeader),(*peHeader).FileHeader.NumberOfSections,codeSegmentInfo,".code");
	TraverseSectionHeaders(IMAGE_FIRST_SECTION(peHeader),(*peHeader).FileHeader.NumberOfSections,stubSegmentInfo,".stub");
 
	return;
}

/**
 * Look for sectionName segment in mapped file 
 * addrInfo will be filled with the segment information
 */
void TraverseSectionHeaders
(
	PIMAGE_SECTION_HEADER section,
	DWORD nSections,
	SEGMENT_INFO_PTR addrInfo,
	char * sectionName
)
{
	DWORD i ;
	/* Copy pointer to initial section (so this function can be called several times) */
	PIMAGE_SECTION_HEADER localSection = section;
	printf("\n\nTraverseSectionHeaders: searching for segment in section headers\n");
	for(i=0;i<nSections;i++)
	{
		printf("     ====================     \n");
		printf("\tName:			%s\n",(*section).Name);
		if(strcmp((*section).Name,sectionName)==0)
		{
			(*addrInfo).fileSegmentOffset = (*section).PointerToRawData; /* Location of segment in binary file*/
			(*addrInfo).fileSegmentSize = (*section).SizeOfRawData; /* Size of segment */
			(*addrInfo).memorySegmentOffset = (*section).VirtualAddress; /* Offset of segment in memory at runtime */
		}
		section = section+ 1;
	}
	return;
}

/**
 * Encrypt .code segment bytes in the given file 
 */
void cipherBytes(char* fileName, SEGMENT_INFO_PTR addrInfo)
{
	DWORD fileOffset;
	DWORD nbytes;
 
	FILE* fptr;
	BYTE *buffer;
	DWORD nItems;
	DWORD i;
	BYTE  key[] = "ab345izz";
	int keyLength = 8;
	int cpt = 0;
 
	fileOffset = addrInfo->fileSegmentOffset;
	nbytes = addrInfo->fileSegmentSize;
	/* Allocate memory in buffer that will store content of segment */
	buffer = (BYTE*)malloc(nbytes);
	if(buffer == NULL)
	{
		printf("cipherBytes: malloc error \n");
		return;
	} 
 
	/* Open binary file */
	fptr = fopen(fileName,"r+b");
	if(fptr == NULL)
	{
		printf("cipherBytes: fopen error \n");
		return;
	}
	/* Seek .code section using calculated offset and copy content into buffer*/
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("cipherBytes: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fread(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("cipherBytes: Trouble reading nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	/* Encrypt buffer */
    for( i = 0 ; i < nbytes ; i++ )
    {
		buffer[i]=buffer[i]^key[cpt];
		cpt = cpt + 1;
		if(cpt == keyLength)
			cpt = 0;
    }
 
	/* Replace current .code section in file by encrypted one */
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("cipherBytes: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fwrite(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("cipherBytes: Trouble writing nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	printf("Successfully ciphered %d bytes\n",nbytes);
	fclose(fptr);
	return;
}

/**
 * Patch the filepath file (the .stub segment)
 * Here we replace CODE_BASE_ADDRESS and CODE_SIZE by newBaseAddr and newSegSize
 * newBaseAddr is the Virtual memory base address of .code segment in target file
 * newSegSize contains the size of the target file .code segment
 */
void patchStub(char * filepath,  SEGMENT_INFO_PTR addrInfo, DWORD newBaseAddr, DWORD newSegSize )
{
	DWORD fileOffset;
	DWORD nbytes;
	DWORD nItems;
	/* Signature to locate where segment memory base address should be written */
	BYTE baseAddrSignature[] = { 0x15, 0x15, 0x15, 0x15, 0x00 }; 
	/* Signature to locate where segment size should be written*/
	BYTE segSizeSignature[] = { 0x14, 0x14, 0x14, 0x14, 0x00 }; 
	BYTE * baseAddrAddress = NULL;
	BYTE * segSizeAddress = NULL;
	BYTE *buffer;
	FILE* fptr;
	fileOffset = addrInfo->fileSegmentOffset;
	nbytes = addrInfo->fileSegmentSize;
 
	/* Allocate memory in buffer that will store content of segment */
	buffer = (BYTE*)malloc(nbytes);
	if(buffer == NULL)
	{
		printf("patchStub: malloc error \n");
		return;
	}
 
	/* Open binary file */
    fptr = fopen(filepath, "r+b");
	if(fptr == NULL)
	{
		printf("patchStub: fopen error \n");
		return;
	}
 
	/* Seek .stub section using calculated offset*/
	if(fseek(fptr, addrInfo->fileSegmentOffset, SEEK_SET)!=0)
	{
		printf("patchStub: Unable to set file pointer to %ld \n", addrInfo->fileSegmentOffset);
		fclose(fptr);
		return;
	}
	/* Copy content of stub segment into buffer */
	nItems = fread(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("patchStub: Trouble reading nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	/* Search the baseAddress in buffer section */
	baseAddrAddress = binStrstr(buffer,baseAddrSignature);
	/* Change base Address by calculated value */
	memcpy(baseAddrAddress,&newBaseAddr,sizeof(newBaseAddr));
 
	/* Search the baseAddress in buffer section */
	segSizeAddress = binStrstr(buffer,segSizeSignature);
	/* Change base Address by calculated value */
	memcpy(segSizeAddress,&newSegSize,sizeof(newSegSize));
 
    /* Replace current .stub section in file by patched one */
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("patchStub: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fwrite(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("patchStub: Trouble writing nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
    printf("Successfully patched file\n");
	fclose(fptr);
 
    return ;
}

/** 
 * Cryptor entry point 
 */
void main(int argc, char *argv[])
{
	char *fileName;
	HANDLE hFile;
	HANDLE hFileMapping;
	LPVOID fileBaseAddress;
	BOOL retVal;
	/* To store information of .code and .stub segments */
	SEGMENT_INFO codeSegmentInfo;
	SEGMENT_INFO stubSegmentInfo;
 
	if(argc <2)
	{
		printf("main: Not enough arguments");
		return;
	}
	fileName = argv[1];
	/* Map target file */
	retVal = getHMODULE(fileName, &hFile, &hFileMapping, &fileBaseAddress);
	if(retVal==FALSE)
	{
		return;
	}
 
	/* Init structures */
	codeSegmentInfo.moduleBase = (DWORD)NULL;
	codeSegmentInfo.memorySegmentOffset = (DWORD)NULL;
	codeSegmentInfo.fileSegmentOffset = (DWORD)NULL;
	codeSegmentInfo.fileSegmentSize = (DWORD)NULL;
	stubSegmentInfo.moduleBase = (DWORD)NULL;
	stubSegmentInfo.memorySegmentOffset = (DWORD)NULL;
	stubSegmentInfo.fileSegmentOffset = (DWORD)NULL;
	stubSegmentInfo.fileSegmentSize = (DWORD)NULL;
 
	/* Fill segments information */
	getSegmentsInfo(fileBaseAddress,&codeSegmentInfo,&stubSegmentInfo);
 
	printf("\n\n=======================\n");
	printf(".code segment information: \n");
	printf("RAM image base		=0x%08X\n",codeSegmentInfo.moduleBase);
	printf("RAM segment offset	=0x%08X\n",codeSegmentInfo.memorySegmentOffset);
	printf("File offset of code =0x%08X\n",codeSegmentInfo.fileSegmentOffset);
	printf("File size of code	=0x%08X\n",codeSegmentInfo.fileSegmentSize);
	printf("\n\n=======================\n");
	printf(".stub segment information: \n");
	printf("RAM image base		=0x%08X\n",stubSegmentInfo.moduleBase);
	printf("RAM segment offset	=0x%08X\n",stubSegmentInfo.memorySegmentOffset);
	printf("File offset of code =0x%08X\n",stubSegmentInfo.fileSegmentOffset);
	printf("File size of code	=0x%08X\n",stubSegmentInfo.fileSegmentSize);
	closeHandles(hFile, hFileMapping,fileBaseAddress);
	cipherBytes(fileName,&codeSegmentInfo);
 
	patchStub(fileName,&stubSegmentInfo,codeSegmentInfo.moduleBase+codeSegmentInfo.memorySegmentOffset,codeSegmentInfo.fileSegmentSize);
 
	return;
}