-
-
Save ahhh/cf7e0c351d73e0ecbabf0f3ffae865c9 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include "stdafx.h" | |
#include <Windows.h> | |
#include <iostream> | |
void WipePEHeader(HANDLE GetModuleBase) | |
{ | |
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)GetModuleBase; | |
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + (DWORD)pDosHeader->e_lfanew); | |
printf("NT Header at : %p\n", pNTHeader); | |
printf("DOS Header at : %p\n", pDosHeader); | |
printf("Offset : %p\n", (DWORD)pNTHeader - (DWORD)pDosHeader); | |
if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) | |
{ | |
puts("NT Signature mismatch\n"); | |
return; | |
} | |
if (pNTHeader->OptionalHeader.SizeOfHeaders) | |
{ | |
DWORD Protect; | |
DWORD Size = pNTHeader->OptionalHeader.SizeOfHeaders; | |
printf("Header Size : %d\n", Size); | |
VirtualProtect((void*)GetModuleBase, Size, PAGE_READWRITE, &Protect); | |
SecureZeroMemory((void*)GetModuleBase, Size); | |
VirtualProtect((void*)GetModuleBase, Size, Protect, &Protect); | |
} | |
} | |
void Loop() { | |
while (true) { | |
std::cout << "Still looping" << std::endl; | |
Sleep(2000); | |
} | |
} | |
int main() | |
{ | |
HANDLE hImgAddress = GetModuleHandle(NULL); | |
WipePEHeader(hImgAddress); | |
Loop(); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment