CN112347490A

CN112347490A - Application program shell adding method

Info

Publication number: CN112347490A
Application number: CN202010528419.XA
Authority: CN
Inventors: 吴建亮; 胡鹏; 张振林
Original assignee: Guangzhou Jeeseen Network Technologies Co Ltd
Current assignee: Guangzhou Jeeseen Network Technologies Co Ltd
Priority date: 2020-06-11
Filing date: 2020-06-11
Publication date: 2021-02-09

Abstract

The invention discloses a method for adding a shell to an application program, which comprises the steps of copying an executable file into a memory, splitting a section to extract a resource table, modifying a PE (provider edge) head, integrating other sections into a section, putting the sections together, encrypting the sections, adding A, B, C, storing codes for adding the shell and repairing relocation tables of the codes, wherein the first section is used for storing a code checking module; the second is used for repairing the operating environment of the shelled program; the third one is used to decompress the sections, marshal the data of the a section into a dll file, and load it.

Description

Application program shell adding method

Technical Field

The invention relates to the technical field of computers, in particular to a method for adding a shell to an application program.

Background

The shell adding is to change the code of executable program file or dynamic link library file through a series of mathematical operations to achieve the purpose of reducing the file volume or encrypting the program code. Existing shell-added products are compressed shells such as Upx, ASpack, for example, encryptable shells such as patents CN201110437932.9, CN 201310648196.0.

However, the compact shell such as Upx and ASpack cannot prevent ida static analysis, and the encrypted shell disclosed in patents CN201110437932.9 and CN201310648196.0 has no compact code, and the volume of the packed file is large. Therefore, it is necessary to develop a solution to solve the above problems.

Disclosure of Invention

In view of the above, the present invention is directed to a method for shell-adding an application program, which can prevent static analysis and dynamic analysis and reduce the file volume as much as possible.

In order to achieve the purpose, the invention adopts the following technical scheme:

a method for adding shell to application program includes copying executable file into internal memory, splitting up sections to extract resource table, modifying PE head, integrating other sections into one section, encrypting, adding three sections A, B, C, storing codes for adding shell and repairing their relocation table, the first for storing code checking module; encryption import table, encryption function name table, function address table, hash value of function name filled in them, and entry point pointing to function in section C.

Preferably, the code for both sections B and C are copied from the sections in the prepared dll file, section B is mainly used to decrypt and repair the target file, and section C is mainly used to decompress the target file.

Preferably, the code flow of the section B is mainly divided into the following steps, and when each step is executed, the next code is decrypted: obtaining a key function; calculating key codes in the section B into a hash value for decrypting a target section, then splitting the section, and integrating the resource table and the resource table together to restore the original memory arrangement; mapping the segments according to the mapping granularity of the target file; decrypting the import table and loading the file in the import table; encrypting the function address table, and pointing the function address table to a new structure; firstly, the hash value of the module name is transmitted, then the hash value of the function name is transmitted, and then the function address calculation function is skipped; repairing the TLS; a portion of the code of the entry point is checked and a jump is made to the entry point.

Preferably, the main code flow of the section C is to load a key module to obtain a required function; creating a thread to clear hardware breakpoints and closing logs; decompressing other sections; checking the full code; applying for a heap space, storing the decrypted section B codes, and repairing a relocation table of the section B; a decryption section A, which is manually mapped into the memory, and the module information is added into the module linked list; enter the start function of decrypted segment B.

Compared with the prior art, the invention has obvious advantages and beneficial effects, and specifically, the technical scheme includes that:

by adopting the method, when each step of function runs, the function is calculated into the hash value, and the next step of decryption is performed, so that ida static compilation is prevented, and program debugging is prevented. When the shell is added, the file volume is reduced by compressing, and the file is decompressed by self after running; and manually loading the import table, manually loading the dll file in the self section, encrypting the function name table and increasing the shelling difficulty.

Drawings

FIG. 1 is a schematic flow chart of a preferred embodiment of the present invention;

FIG. 2 is a code flow diagram of section B in the preferred embodiment of the present invention.

Detailed Description

The invention has disclosed a application program adds the method of the shell, copy the executable file into the memory first, and split the district and withdraw the resource table, revise PE head, put other districts into a district together and then encrypt, add three districts A, B, C again, the latter two are used for depositing the code which adds the shell and repairing their relocation tables, the first one is used for depositing and is used for the code inspection module; the import table is encrypted, the function names are encrypted into a table, the function address table is filled with the hash value of the function name, and the entry point points to the function in the section C (as shown in fig. 1).

The code for both sections B and C are copied from the sections in the prepared dll file, section B is primarily used to decrypt and repair the destination file, and section C is primarily used to decompress the destination file.

As shown in fig. 2, the code flow of the section B is mainly divided into the following steps, and when each step is executed, the next code is decrypted: obtaining a key function; calculating key codes in the section B into a hash value for decrypting a target section, then splitting the section, and integrating the resource table and the resource table together to restore the original memory arrangement; mapping the segments according to the mapping granularity of the target file; decrypting the import table and loading the file in the import table; encrypting the function address table, and pointing the function address table to a new structure; firstly, the hash value of the module name is transmitted, then the hash value of the function name is transmitted, and then the function address calculation function is skipped; repairing the TLS; a portion of the code of the entry point is checked and a jump is made to the entry point.

The main code flow of the section C is loading a key module to obtain a required function; creating a thread to clear hardware breakpoints and closing logs; decompressing other sections; checking the full code; applying for a heap space, storing the decrypted section B codes, and repairing a relocation table of the section B; a decryption section A, which is manually mapped into the memory, and the module information is added into the module linked list; enter the start function of decrypted segment B.

The design key points of the invention are as follows: by adopting the method, when each step of function runs, the function is calculated into the hash value, and the next step of decryption is performed, so that ida static compilation is prevented, and program debugging is prevented. When the shell is added, the file volume is reduced by compressing, and the file is decompressed by self after running; and manually loading the import table, manually loading the dll file in the self section, encrypting the function name table and increasing the shelling difficulty.

The technical principle of the present invention is described above in connection with specific embodiments. The description is made for the purpose of illustrating the principles of the invention and should not be construed in any way as limiting the scope of the invention. Based on the explanations herein, those skilled in the art will be able to conceive of other embodiments of the present invention without inventive effort, which would fall within the scope of the present invention.

Claims

1. A method for application shell filling, comprising: copying an executable file into a memory, splitting a section to extract a resource table, modifying a PE (provider edge) head, integrating other sections into a section, then encrypting the section, adding A, B, C three sections, storing shelled codes and repairing relocation tables of the shelled codes, wherein the first section is used for storing a code check module; the function address table is encrypted, filled with the hash value of the function name, and the entry point is pointed to the function in the C section.

2. A method of application shell filling as claimed in claim 1, characterized by: the code for both sections B and C are copied from the sections in the prepared dll file, section B is primarily used to decrypt and repair the destination file, and section C is primarily used to decompress the destination file.

3. A method of application shell filling as claimed in claim 1, characterized by: the code flow of the section B is mainly divided into the following steps, and when the code flow runs in each step, the next code is decrypted: obtaining a key function; calculating key codes in the section B into a hash value for decrypting a target section, then splitting the section, and integrating the resource table and the resource table together to restore the original memory arrangement; mapping the segments according to the mapping granularity of the target file; decrypting the import table and loading the file in the import table; encrypting the function address table, and pointing the function address table to a new structure; firstly, the hash value of the module name is transmitted, then the hash value of the function name is transmitted, and then the function address calculation function is skipped; repairing the TLS; a portion of the code of the entry point is checked and a jump is made to the entry point.

4. A method of application shell filling as claimed in claim 1, characterized by: the main code flow of the section C is loading a key module to obtain a required function; creating a thread to clear hardware breakpoints and closing logs; decompressing other sections; checking the full code; applying for a heap space, storing the decrypted section B codes, and repairing a relocation table of the section B; a decryption section A, which is manually mapped into the memory, and the module information is added into the module linked list; enter the start function of decrypted segment B.